vpn trouble

[David DeSimone]

ralf at dzie-ciuch.pl <ralf at dzie-ciuch.pl> wrote:
>
> >> 78.x.x.x <--> 95.x.x.x <--> 10.10.1.90
> 
> I try to set VPN like I wrote earlier.
> 78.x is server and this is not NAT. He dont forward anything.
> 
> I try to set tunnel behing my server 78.x and gateway 95.x translating
> packets to 10.x.  I can only set 78.x side.

I think I understand now:

    Your IP is 78.x.x.x

    Your peer's IP is 95.x.x.x

    Your peer has a network 10.10.1.90 (with some netmask?) behind it.

> > The fact that you don't receive any reply to your IKE packets would
> > indicate something basic, like something is blocking traffic.
> 
> But how to check it?  Telnet to port 500 wont work.  But when I set
> SSH to listen on port 500 I can login, port is not blocked

Telnet and SSH use TCP.  IKE uses UDP, so you cannot use those sorts of
utilities to test it.  You could attempt to use netcat tool "nc -u" to
send packets through, but really, tcpdump is probably your best
troubleshooting tool.  You would still see the incoming IKE replies via
tcpdump, even if your firewall was blocking them.

> > Your IPSEC policy specifies "esp/tunnel" mode, but if you are not
> > actually encapsulating traffic originating from somewhere else, you
> > might do better to just use "transport" mode to encrypt without
> > encapsulation.
> 
> Hmmm, I don't understand it?  I set policy only for there IP's and
> connection for it is ESP encrypced

Now that I understand you are trying to reach a network behind your
peer, tunnel mode is appropriate, so forget about my transport mode
comments.

> > My first thought was that your IPSEC policy attempts to encrypt all
> > traffic between you and your peers, but the IKE traffic is also
> > traffic between you and your peers, so doesn't it lead to a policy
> > loop of some sort?  Will the IPSEC layer attempt to capture and
> > encrypt the IKE packets?
> 
> Can you explain how can I check it?  I new on it and I don't
> understand some things.

I'm sorry, due to my previous misunderstanding I didn't see that your
policy is set up the way it should be.  The IPSEC SA policy is set up
correctly, and your racoon configuration also looks correct.

Setting up VPN without cooperation from your peer is generally very
difficult.  I would suggest that your peer access his Cisco device logs
and tell you if he sees any error messages related to your IP.  He might
easily be blocking your IP by failing to enter it into an access list
somewhere, and you will not be able to tell, from your perspective.

-- 
David DeSimone == Network Admin == fox at verio.net
  "I don't like spinach, and I'm glad I don't, because if I
   liked it I'd eat it, and I just hate it." -- Clarence Darrow


This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio, Inc. makes no warranty that this email is error or virus free.  Thank you.