From owner-freebsd-net@FreeBSD.ORG Tue Mar 29 14:07:08 2005 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5E0D316A4CE for ; Tue, 29 Mar 2005 14:07:08 +0000 (GMT) Received: from geppetto.cs.interbusiness.it (relay-2.cs.interbusiness.it [151.99.250.81]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5D19643D3F for ; Tue, 29 Mar 2005 14:07:04 +0000 (GMT) (envelope-from emilio.mastriani@comunicando.biz) Received: from ctdevd01 (host28-213.pool8019.interbusiness.it [80.19.213.28]) j2TE5sY6015326 for ; Tue, 29 Mar 2005 16:05:55 +0200 (MEST) From: "emilio mastriani" To: Date: Tue, 29 Mar 2005 16:08:28 +0200 Organization: comunicando Message-ID: <000001c53468$c90a3660$0900a8c0@ctdevd01> MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4927.1200 Importance: Normal Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.1 Subject: Racoon(8) Deleting SPD Entries X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Mar 2005 14:07:08 -0000 Hi, I have a similar problem. I=92m using native kernel 2.6.9-1.667 in fedora core3 and ipsec-tools -0.3.3-5.6=20 My peer (84.222.18.181) is a zyxel series 600 and I=92m natted behind a same router. The network is: =20 Ipsec-sever (fc3) zyxel/NAT internet zyxel ipsec ipsec client 192.168.0.71------------------192.168.0.1/80.19.213.28------------------ ---------------84.222.18.181/192.168.254.254-------------192.168.254.123 =20 The dialog start, the connection is established, but I can=92t ping and after 360 sec, it go down. =20 The ipsec.conf: #!/usr/bin/setkey -f =20 #configurazione per 192.168.0.71 =20 #svuoto il SAD e SPD flush; spdflush; =20 #security policy spdadd 192.168.0.71 192.168.254.123 any -P out ipsec esp/tunnel/80.19.213.28-84.222.18.181/require; spdadd 192.168.254.123 192.168.0.71 any -P in ipsec esp/tunnel/84.222.18.181-80.19.213.28/require; =20 The racoon.conf =20 # Racoon IKE daemon configuration file. # See 'man racoon.conf' for a description of the format and entries. =20 path include "/etc/racoon"; path pre_shared_key "/etc/racoon/psk.txt"; path certificate "/etc/racoon/certs"; =20 log debug3; =20 padding { maximum_length 20; # maximum padding length. randomize off; # enable randomize length. strict_check off; # enable strict check. exclusive_tail off; # extract last one octet. } =20 listen { #isakmp ::1 [7000]; isakmp 192.168.0.71 [500]; isakmp_natt 192.168.0.71 [4500]; #admin [7002]; #administrative's port by kmpstat strict_address; #required all addresses must be found } =20 #specification of default various timer timer { #these values can be changed per remote node counter 5; #maximum trying count to send interval 20 sec; #maximum interval to resend persend 1; #the number of packets per a send =20 #timer for a waiting to complete each phase phase1 180 sec; phase2 360 sec; } =20 remote anonymous { exchange_mode main; lifetime time 28800 sec; #sec,min,hour nat_traversal on; proposal { encryption_algorithm 3des; hash_algorithm md5; authentication_method pre_shared_key; dh_group 1; } } =20 sainfo anonymous { lifetime time 28800 sec; encryption_algorithm 3des; authentication_algorithm hmac_md5; compression_algorithm deflate; } =20 =20 psk.txt is correctly setted ;-) =20 =20 The racoon_start.sh #!/bin/sh /sbin/setkey -FP sleep 1 /sbin/setkey -F sleep 1 /sbin/setkey -f /etc/ipsec.conf sleep 1 /sbin/setkey -DP sleep 1 killall racoon sleep 1 /usr/sbin/racoon -d -f /etc/racoon/racoon.conf =20 The short trace : Mar 29 15:36:12 laptopemy kernel: device eth0 left promiscuous mode Mar 29 15:36:14 laptopemy kernel: eth0: Promiscuous mode enabled. Mar 29 15:36:14 laptopemy kernel: device eth0 entered promiscuous mode Mar 29 15:36:47 laptopemy kernel: device eth0 left promiscuous mode Mar 29 15:36:52 laptopemy kernel: eth0: Promiscuous mode enabled. Mar 29 15:36:52 laptopemy kernel: device eth0 entered promiscuous mode Mar 29 15:37:58 laptopemy kernel: device eth0 left promiscuous mode Mar 29 15:38:08 laptopemy kernel: eth0: Promiscuous mode enabled. Mar 29 15:38:08 laptopemy kernel: device eth0 entered promiscuous mode Mar 29 15:48:07 laptopemy racoon: INFO: @(#)ipsec-tools 0.3.3 (http://ipsec-tools.sourceforge.net) Mar 29 15:48:07 laptopemy racoon: INFO: @(#)This product linked OpenSSL 0.9.7a Feb 19 2003 (http://www.openssl.org/) Mar 29 15:48:08 laptopemy racoon: WARNING: /etc/racoon/racoon.conf:9: "debug3" it is osboleted. use "debug2" Mar 29 15:48:08 laptopemy racoon: INFO: 192.168.0.71[4500] used as isakmp port (fd=3D8) Mar 29 15:48:08 laptopemy racoon: INFO: 192.168.0.71[4500] used for NAT-T Mar 29 15:48:08 laptopemy racoon: INFO: 192.168.0.71[500] used as isakmp port (fd=3D9) Mar 29 15:48:24 laptopemy racoon: INFO: IPsec-SA request for 84.222.18.181 queued due to no phase1 found. Mar 29 15:48:24 laptopemy racoon: INFO: initiate new phase 1 negotiation: 80.19.213.28[500]<=3D>84.222.18.181[500] Mar 29 15:48:24 laptopemy racoon: INFO: begin Identity Protection mode. Mar 29 15:48:48 laptopemy racoon: INFO: ISAKMP-SA established 80.19.213.28[500]-84.222.18.181[500] spi:5751c3384413cdd1:32fa62bc06fe123c Mar 29 15:48:48 laptopemy racoon: INFO: initiate new phase 2 negotiation: 80.19.213.28[0]<=3D>84.222.18.181[0] Mar 29 15:48:51 laptopemy racoon: WARNING: attribute has been modified. Mar 29 15:48:52 laptopemy racoon: INFO: IPsec-SA established: ESP/Tunnel 84.222.18.181->80.19.213.28 spi=3D113195563(0x6bf3a2b) Mar 29 15:48:52 laptopemy racoon: INFO: IPsec-SA established: ESP/Tunnel 80.19.213.28->84.222.18.181 spi=3D3612357826(0xd75034c2) Mar 29 15:50:27 laptopemy racoon: INFO: purged IPsec-SA proto_id=3DESP spi=3D3612357826. Mar 29 15:50:28 laptopemy racoon: INFO: purged ISAKMP-SA = proto_id=3DISAKMP spi=3D5751c3384413cdd1:32fa62bc06fe123c. Mar 29 15:50:29 laptopemy racoon: INFO: ISAKMP-SA deleted 80.19.213.28[500]-84.222.18.181[500] spi:5751c3384413cdd1:32fa62bc06fe123c =20 Any idea? I don=92t know how to continue. =20 Thanks for all. =20 =20 Dott. Emilio mastriani