Date: Mon, 23 Apr 2018 15:43:16 +0300 From: "Andrey V. Elsukov" <bu7cher@yandex.ru> To: Victor Gamov <vit@otcnet.ru>, freebsd-net@freebsd.org Subject: Re: multiple if_ipsec Message-ID: <8d27fbd2-001d-dc46-3621-c44d8dad5522@yandex.ru> In-Reply-To: <112ea6c0-1927-5f47-24c7-6888295496cf@otcnet.ru> References: <b859ed18-e511-3640-4662-4242a53d999c@otcnet.ru> <5e36ac3f-39ce-72c5-cd97-dd3c4cf551a7@yandex.ru> <30d1c5f9-56e7-c67b-43e1-e6f0457360a8@otcnet.ru> <c2cb415b-bcde-c714-9412-103e674ce673@yandex.ru> <77c37ff9-8de3-dec0-176a-2b34db136bc5@otcnet.ru> <92930ba6-828d-ecb5-ce37-36794ec80ef7@yandex.ru> <112ea6c0-1927-5f47-24c7-6888295496cf@otcnet.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--AxXuOxd76vGsqtvMwHxnSHFSzqkZEblVx
Content-Type: multipart/mixed; boundary="tHL6tgh2FvLuY7hOau2PLwqfHJSvo1t3y";
protected-headers="v1"
From: "Andrey V. Elsukov" <bu7cher@yandex.ru>
To: Victor Gamov <vit@otcnet.ru>, freebsd-net@freebsd.org
Message-ID: <8d27fbd2-001d-dc46-3621-c44d8dad5522@yandex.ru>
Subject: Re: multiple if_ipsec
References: <b859ed18-e511-3640-4662-4242a53d999c@otcnet.ru>
<5e36ac3f-39ce-72c5-cd97-dd3c4cf551a7@yandex.ru>
<30d1c5f9-56e7-c67b-43e1-e6f0457360a8@otcnet.ru>
<c2cb415b-bcde-c714-9412-103e674ce673@yandex.ru>
<77c37ff9-8de3-dec0-176a-2b34db136bc5@otcnet.ru>
<92930ba6-828d-ecb5-ce37-36794ec80ef7@yandex.ru>
<112ea6c0-1927-5f47-24c7-6888295496cf@otcnet.ru>
In-Reply-To: <112ea6c0-1927-5f47-24c7-6888295496cf@otcnet.ru>
--tHL6tgh2FvLuY7hOau2PLwqfHJSvo1t3y
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable
On 23.04.2018 15:10, Victor Gamov wrote:
> # setkey -D
> =3D=3D=3D=3D=3D
> __FreeBSD_IP__ __Cisco_30__
> =C2=A0=C2=A0=C2=A0=C2=A0esp mode=3Dtunnel spi=3D2124688285(0x7ea42b9d) =
reqid=3D26(0x0000001a)
This must be 30 ^^^^^^^
> __FreeBSD_IP__ __Cisco_25__
> =C2=A0=C2=A0=C2=A0=C2=A0esp mode=3Dtunnel spi=3D153891647(0x092c333f) r=
eqid=3D26(0x0000001a)
> =C2=A0=C2=A0=C2=A0=C2=A0E: rijndael-cbc=C2=A0 8f9905fe 6a9cfc76 a0da354=
b 53a7f901 298dca43
> __Cisco_25__ __FreeBSD_IP__
> =C2=A0=C2=A0=C2=A0=C2=A0esp mode=3Dtunnel spi=3D21918183(0x014e71e7) re=
qid=3D26(0x0000001a)
> =C2=A0=C2=A0=C2=A0=C2=A0E: rijndael-cbc=C2=A0 43e8f54a 0bdda6b5 41a637d=
5 4469973d 5b3dc8d0
> __FreeBSD_IP__ __Cisco_26__
> =C2=A0=C2=A0=C2=A0=C2=A0esp mode=3Dtunnel spi=3D2471238029(0x934c198d) =
reqid=3D26(0x0000001a)
This must be 16385 ^^^^^
> __Cisco_26__ __FreeBSD_IP__
> =C2=A0=C2=A0=C2=A0=C2=A0esp mode=3Dtunnel spi=3D103689330(0x062e2c72) r=
eqid=3D26(0x0000001a)
This must be 16385 ^^^^^
> __Cisco_30__ __FreeBSD_IP__
> =C2=A0=C2=A0=C2=A0=C2=A0esp mode=3Dtunnel spi=3D42561509(0x02896fe5) re=
qid=3D26(0x0000001a)
This must be 30 ^^^^^^^
> ipsec30: flags=3D8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 14=
00
> =C2=A0=C2=A0=C2=A0=C2=A0description: -so: Kur
> =C2=A0=C2=A0=C2=A0=C2=A0tunnel inet __FreeBSD_IP__ --> __Cisco_30__
> =C2=A0=C2=A0=C2=A0=C2=A0inet 10.10.98.1 --> 10.10.98.2=C2=A0 netmask 0x=
fffffffc
> =C2=A0=C2=A0=C2=A0=C2=A0nd6 options=3D29<PERFORMNUD,IFDISABLED,AUTO_LIN=
KLOCAL>
> =C2=A0=C2=A0=C2=A0=C2=A0reqid: 30
> =C2=A0=C2=A0=C2=A0=C2=A0groups: ipsec
> ipsec26: flags=3D8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 14=
00
> =C2=A0=C2=A0=C2=A0=C2=A0description: -so: Mur
> =C2=A0=C2=A0=C2=A0=C2=A0tunnel inet __FreeBSD_IP__ --> __Cisco_26__
> =C2=A0=C2=A0=C2=A0=C2=A0inet 10.10.98.9 --> 10.10.98.10=C2=A0 netmask 0=
xfffffffc
> =C2=A0=C2=A0=C2=A0=C2=A0nd6 options=3D29<PERFORMNUD,IFDISABLED,AUTO_LIN=
KLOCAL>
> =C2=A0=C2=A0=C2=A0=C2=A0reqid: 16385
> =C2=A0=C2=A0=C2=A0=C2=A0groups: ipsec
> ipsec25: flags=3D8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 14=
00
> =C2=A0=C2=A0=C2=A0=C2=A0description: -so: Sofy
> =C2=A0=C2=A0=C2=A0=C2=A0tunnel inet __FreeBSD_IP__ --> __Cisco_25__
> =C2=A0=C2=A0=C2=A0=C2=A0inet 10.10.98.5 --> 10.10.98.6=C2=A0 netmask 0x=
fffffffc
> =C2=A0=C2=A0=C2=A0=C2=A0nd6 options=3D29<PERFORMNUD,IFDISABLED,AUTO_LIN=
KLOCAL>
> =C2=A0=C2=A0=C2=A0=C2=A0reqid: 26
> =C2=A0=C2=A0=C2=A0=C2=A0groups: ipsec
Your security associations doesn't match your security policies.
Probably you did interfaces reconfiguration without clearing old SAs.
I think your configuration will work, if you first will done if_ipsec(4)
configuration, then start racoon and it will generate SAs.
To clear all old/stale configured SAs you can first stop racoon, then
run `setkey -DF` and `setkey -DPF`.
--=20
WBR, Andrey V. Elsukov
--tHL6tgh2FvLuY7hOau2PLwqfHJSvo1t3y--
--AxXuOxd76vGsqtvMwHxnSHFSzqkZEblVx
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEzBAEBCAAdFiEE5lkeG0HaFRbwybwAAcXqBBDIoXoFAlrd1OQACgkQAcXqBBDI
oXpeIgf+Jwo70efQh/NiJ8h6pAcNCxSNz5TOZsq35+8iVqTa7pniJoq32lbUVy79
qjJ2lN/rWi6f3qNrOECVTHAVmJHMynRNyjrpkUZBaEc21xKLLaWl2QdJiYBaQePk
gw/gzb4wA4FSMbGIKyQrcFR0EL3Z6AH4837EhECguW28XboQnHxoRVI6fhEwd+s/
WklvNxf9YmMNRlfaxBuxNDI9vGePQRZuVSzign8/3cDXVPwKJywjRgQJCtfO2Dau
3yBWYMQThUHLBK5cMKYvGBkF1uVeth8xGtaB1gFoP/OJMz5WAyV9R7ZcHb3Crg8g
9LB5m4nzgjsi00Bvxx8oXUHReRStWw==
=QcVN
-----END PGP SIGNATURE-----
--AxXuOxd76vGsqtvMwHxnSHFSzqkZEblVx--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?8d27fbd2-001d-dc46-3621-c44d8dad5522>