IPSec connection troubles
vanhu at FreeBSD.org
Thu Feb 11 12:47:58 UTC 2010
On Thu, Feb 11, 2010 at 02:24:50PM +0300, Denis Antrushin wrote:
> I'm trying to establish IPSec connection between FreeBSD and
> Solaris boxes. I use FreeBSD 8-STABLE (don't recall exact checkout
> date, but it contains recent IPComp fixes for sure).
> Since I'm behind NAT, I compiled 0.8alpha snapshot of ipsec-tools
> from their site.
> When I try to connect to TCP port 2112 of solaris box,
> racoon successfully negotiates with remote peer, I see
> SA installed in kernel,
>From developer's view, that's a good news :-)
> but then nothing happens.
> I see encapsulated TCP SYN packets sent on enc0, but
> nothing else. TCP connection is not established, nothing
> in racoon logs (except KA), nothing on PF_KEY socket.
> The very same setup works on Linux and Mac.
> How can I further debug this problem?
You can check on responder that you have lots of TCP checksums errors,
which will confirm that you would need support for NAT-OA extension of
NAT-T RFC, as you want to do some Transport IPsec of TCP flows using
Unfortunately, actually, there is no support for NAT-OA extension,
there are just specifications on PFKey interface to send them to
More information about the freebsd-net