IPSec tunnel setup problems
Damian Gerow
damian at sentex.net
Mon Apr 21 10:09:39 PDT 2003
Thus spake Crist J. Clark (crist.clark at attbi.com) [21/04/03 11:47]:
> > I've done it. I see continual re-tries for Phase I, nothing for Phase II.
> > Here's what I see:
> >
> > tcpdump:
> > 14:31:33.613674 pyroxene.sentex.ca.isakmp > asylum.afflictions.org.isakmp: isakmp: phase 1 I agg: [|sa]
> > 14:31:53.428132 pyroxene.sentex.ca.isakmp > asylum.afflictions.org.isakmp: isakmp: phase 1 I agg: [|sa]
>
> Well, one weird thing is that pyroxene must be behind some kind of NAT
> device,
Nope. Pyroxene /is/ the NAT device. As is asylum.
> > initiating:
> [snip]
> > 43:09.033625 64.7.134.90:500 -> 199.212.134.18:500: isakmp 1.0 msgid 00000000: phase 1 I agg:
> ^^^
> > sa: doi=ipsec situation=identity
> > p: #1 protoid=isakmp transform=1
> > t: #1 id=iketype=lifetype value=sectype=lifeduration value=0e10type=enc value=blowfishtype=keylen value=0080type=auth value=presharedtype=hash value=sha1type=group desc value=0005))))
> > ke: key len=192)
> > nonce: n len=16)
> > id: idtype=IPv4 protoid=udp port=500 len=4 64.7.134.90)
> ^^^
> > receiving:
> [snip]
> > 40:07.915101 64.7.134.90:41889 -> 199.212.134.18:500: isakmp 1.0 msgid 00000000: phase 1 I agg:
> ^^^^^
> > (sa: doi=ipsec situation=identity
> > (p: #1 protoid=isakmp transform=1
> > (t: #1 id=ike (type=lifetype value=sec)(type=lifeduration value=0e10)(type=enc value=blowfish)(type=keylen value=0080)(type=auth value=preshared)(type=hash value=sha1)(type=group desc value=0005))))
> > (ke: key len=192)
> > (nonce: n len=16)
> > (id: idtype=IPv4 protoid=udp port=500 len=4 64.7.134.90)
> ^^^
>
> > 2003-04-16 14:40:07: DEBUG: remoteconf.c:134:getrmconf(): no remote configuration found.
> > 2003-04-16 14:40:07: ERROR: isakmp.c:851:isakmp_ph1begin_r(): couldn't find configuration.
>
> I'm not 100% as to whether that is a deal-breaker or not.
Hrmm? That's definitely odd... I'll have to check that out, to find out
what's going on. Thanks for pointing it out.
> This doesn't explain why initiating in the other direction doesn't
> work. But what kind of devices are in between these two hosts? What is
> doing NAT?
The two hosts are, as pointed out above. <sigh>. It might be some portmap
statements in ipnat, I'll double-check, and try again.
More information about the freebsd-net
mailing list