From owner-freebsd-hackers@FreeBSD.ORG Sun Apr 20 16:26:17 2003 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F14D437B401; Sun, 20 Apr 2003 16:26:16 -0700 (PDT) Received: from gw.nectar.cc (gw.nectar.cc [208.42.49.153]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1DD8843FD7; Sun, 20 Apr 2003 16:26:16 -0700 (PDT) (envelope-from nectar@celabo.org) Received: from madman.celabo.org (madman.celabo.org [10.0.1.111]) (using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits)) (Client CN "madman.celabo.org", Issuer "celabo.org CA" (verified OK)) by gw.nectar.cc (Postfix) with ESMTP id 9F50953; Sun, 20 Apr 2003 18:26:15 -0500 (CDT) Received: by madman.celabo.org (Postfix, from userid 1001) id EA8C178C66; Sun, 20 Apr 2003 18:26:14 -0500 (CDT) Date: Sun, 20 Apr 2003 18:26:14 -0500 From: "Jacques A. Vidrine" To: Lars Eggert Message-ID: <20030420232614.GA41554@madman.celabo.org> Mail-Followup-To: "Jacques A. Vidrine" , Lars Eggert , "Crist J. Clark" , freebsd-hackers@FreeBSD.org References: <20030410161511.GA25681@madman.celabo.org> <20030416052335.GA2519@blossom.cjclark.org> <20030416123621.GC72501@madman.celabo.org> <20030420165538.GA31101@madman.celabo.org> <3EA2D6F5.4060209@isi.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <3EA2D6F5.4060209@isi.edu> X-Url: http://www.celabo.org/ User-Agent: Mutt/1.5.3i-ja.1 cc: freebsd-hackers@FreeBSD.org cc: "Crist J. Clark" Subject: Re: Single IP host and IPsec tunnel mode experience X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 20 Apr 2003 23:26:17 -0000 On Sun, Apr 20, 2003 at 10:20:53AM -0700, Lars Eggert wrote: > On 4/20/2003 9:55 AM, Jacques A. Vidrine wrote: > >On Wed, Apr 16, 2003 at 07:36:21AM -0500, Jacques A. Vidrine wrote: > > > >>On Tue, Apr 15, 2003 at 10:23:35PM -0700, Crist J. Clark wrote: > >> > >>>'uname -a'? > >> > >>The endpoints were both 4.7. > >> > >> > >>>I can't reproduce this on a 4.8 to 4.7 tunnel. On > >>>192.168.64.70, > >>> > >>> spdadd 192.168.64.70/32 10.0.0.0/24 any -P out > >>> ipsec esp/tunnel/192.168.64.70-192.168.64.20/require; > >>> spdadd 10.0.0.0/24 192.168.64.70/32 any -P in > >>> ipsec esp/tunnel/192.168.64.20-192.168.64.70/require; > >>> > >>>And on 192.168.64.20, the gateway to 10.0.0.0/24, > >>> > >>> spdadd 192.168.64.70/32 10.0.0.0/24 any -P in > >>> ipsec esp/tunnel/192.168.64.70-192.168.64.20/require; > >>> spdadd 10.0.0.0/24 192.168.64.70/32 any -P out > >>> ipsec esp/tunnel/192.168.64.20-192.168.64.70/require; > >>> > >>>Works fine. > >> > >>Hmm, yes, that appears to be exactly what I'm trying to do. Well, > >>that's heartening ... it means that there is likely some anomoly in my > >>environment that is hosing me. Now if only I can figure what it is :-) > > > > > >Oddly enough ... ESP works, AH does not. > > Are you going through a NAT box? (Sorry, haven't been following this > thread closely.) AH includes more of the IP header when computing the > crypto checksum (compared to ESP), if those fields get diddled by a NAT > box, the receiver will drop the packets because of bad crypto. One of > the netstat counters on the receiver will show this. No NAT. > If you need to authenticate, maybe try using ESP authentication? Yes, I believe that's what I tested. e.g. 223.223.223.223 117.117.117.117 esp mode=tunnel spi=40396514(0x26866e25) reqid=0(0x00000000) E: 3des-cbc 4dafcf14 1e11dd81 4dafcf14 1e11dd81 4dafcf14 1e11dd81 A: hmac-sha1 4dafcf14 1e11dd81 4dafcf14 1e11dd81 4dafcf14 seq=0x00000000 replay=4 flags=0x00000000 state=mature created: Mar 2 07:52:31 2003 current: Mar 2 07:59:28 2003 diff: 20(s) hard: 30(s) soft: 24(s) last: hard: 0(s) soft: 0(s) current: 0(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 0 hard: 0 soft: 0 sadb_seq=2 pid=90010 refcnt=1 I actually don't need AH ... I was using AH because it is easier to see what is going on. Cheers, -- Jacques A. Vidrine http://www.celabo.org/ NTT/Verio SME . FreeBSD UNIX . Heimdal Kerberos jvidrine@verio.net . nectar@FreeBSD.org . nectar@kth.se