<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=KOI8-U" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<meta content="text/html;charset=KOI8-U" http-equiv="Content-Type">
<title></title>
Hello, <br>
Own tunnel is blocked till extra tunnel is not deleted manyally... Is
it possible to <font size="-1">work arround(avoid)</font> it?<br>
<br>
<tt>[root@homedesk log]# ipsec eroute<br>
0 172.31.101.4/30 -> 172.31.101.16/30 =>
<a class="moz-txt-link-abbreviated" href="mailto:tun0x100a@195.xxx.xx.50:47">tun0x100a@195.xxx.xx.50:47</a><br>
<b>174 172.31.101.5/32 -> 172.31.101.17/32 => %hold:47</b></tt><br>
<br>
<tt>root# ipsec eroute --del --eraf inet --src 172.31.101.5/32 --dst
172.31.101.17/32 --transport-proto 47<br>
root# ipsec eroute<br>
2 172.31.101.4/30 -> 172.31.101.16/30 =>
<a class="moz-txt-link-abbreviated" href="mailto:tun0x100a@195.xxx.xx.xx:47">tun0x100a@195.xxx.xx.xx:47</a><br>
</tt><br>
<hr size="2" width="100%"><br>
Kernel: 2.6.17.7 (vanilla). No openswan patchs is used. <br>
openswan-2.4.6: KLIPS is used.<br>
GRE tunnel is started before ipsec.<br>
<br>
<tt> conn %default<br>
leftrsasigkey=%none<br>
rightrsasigkey=%none<br>
type=tunnel<br>
# ----------------<br>
compress=yes<br>
auth=esp<br>
esp=3des<br>
# ----------------<br>
authby=secret<br>
keyexchange=ike<br>
disablearrivalcheck=yes<br>
ikelifetime=3600<br>
keylife=3600<br>
pfs=no<br>
<br>
#Disable Opportunistic Encryption<br>
include /etc/ipsec.d/examples/no_oe.conf<br>
<br>
</tt>
<tt>conn mail101016gu<br>
#-----------------------------<br>
compress=yes<br>
#-----------------------------<br>
left=195.xxx.xx.50<br>
leftnexthop=195.xxx.xx.49<br>
leftsubnet=172.31.101.16/30<br>
leftprotoport=47<br>
#-----------------------------<br>
right=82.xxx.xxx.136<br>
rightnexthop=82.xxx.xxx.129<br>
rightsubnet=172.31.101.4/30<br>
rightprotoport=47<br>
#-----------------------------<br>
auto=start</tt><br>
<br>
There is tunnel GRE over ipsec:<br>
<br>
<tt>[root@homedesk log]# ifconfig gre101016<br>
gre101016 Link encap:UNSPEC HWaddr
AC-1F-65-05-05-08-38-9C-00-00-00-00-00-00-00-00<br>
inet addr:172.16.101.18 P-t-P:172.16.101.18
Mask:255.255.255.248<br>
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1392 Metric:1<br>
...</tt><br>
<br>
<tt>[root@homedesk log]# ip addr show gre101016<br>
8: gre101016@NONE: <POINTOPOINT,MULTICAST,NOARP,UP,10000> mtu
1392 qdisc noqueue<br>
link/gre 172.31.101.5 peer 172.31.101.17<br>
inet 172.16.101.18/29 brd 172.16.101.23 scope global gre101016<br>
</tt><br>
<br>
/var/log/security:<br>
-------------------<br>
Aug 6 14:51:28 homedesk pluto[7297]: | pending review: connection
"mail101016gu" checked<br>
Aug 6 14:51:28 homedesk pluto[7297]: | next event EVENT_SHUNT_SCAN in
1 seconds<br>
Aug 6 14:51:29 homedesk pluto[7297]: |<br>
Aug 6 14:51:29 homedesk pluto[7297]: | *time to handle event<br>
Aug 6 14:51:29 homedesk pluto[7297]: | handling event EVENT_SHUNT_SCAN<br>
Aug 6 14:51:29 homedesk pluto[7297]: | event after this is
EVENT_PENDING_PHASE2 in 119 seconds<br>
Aug 6 14:51:29 homedesk pluto[7297]: | inserting event
EVENT_SHUNT_SCAN, timeout in 120 seconds<br>
Aug 6 14:51:29 homedesk pluto[7297]: | scanning for shunt eroutes<br>
Aug 6 14:51:29 homedesk pluto[7297]: | add orphaned shunt
172.31.101.5/32:0 -> 172.31.101.17/32:0 => %hold:47<br>
Aug 6 14:51:29 homedesk pluto[7297]: | next event EVENT_PENDING_PHASE2
in 119 seconds<br>
Aug 6 14:51:29 homedesk pluto[7297]: | add bare shunt 0x80f4e10
172.31.101.5/32:0 -47-> 172.31.101.17/32:0 => %hold 0 %hold
found-pfkey<br>
Aug 6 14:51:29 homedesk pluto[7297]: | initiate on demand from
172.31.101.5:0 to 172.31.101.17:0 proto=0 state: fos_start because:
acquire<br>
Aug 6 14:51:29 homedesk pluto[7297]: | find_connection: looking for
policy for connection: 172.31.101.5:0/0 -> 172.31.101.17:0/0<br>
Aug 6 14:51:29 homedesk pluto[7297]: | find_connection: concluding
with empty<br>
Aug 6 14:51:29 homedesk pluto[7297]: Can not opportunistically
initiate for 172.31.101.5 to 172.31.101.17: no routed template covers
this pair<br>
Aug 6 14:51:29 homedesk pluto[7297]: | no explicit failure shunt for
172.31.101.5 to 172.31.101.17; installing %pass<br>
Aug 6 14:51:29 homedesk pluto[7297]: | no routed template covers this
pair eroute 172.31.101.5/32:0 --0-> 172.31.101.17/32:0 =>
<a class="moz-txt-link-abbreviated" href="mailto:int.0@0.0.0.0">int.0@0.0.0.0</a>
(raw_eroute)<br>
...<br>
Aug 6 14:51:30 homedesk pluto[7297]: | finish_pfkey_msg:
SADB_X_DELFLOW message 14 for flow <a class="moz-txt-link-abbreviated"
href="mailto:int.0@0.0.0.0">int.0@0.0.0.0</a><br>
Aug 6 14:51:30 homedesk pluto[7297]: | 02 0f 00 0b 0e 00 00 00 0e
00 00 00 81 1c 00 00<br>
Aug 6 14:51:30 homedesk pluto[7297]: | 03 00 15 00 00 00 00 00 02
00 00 00 ac 1f 65 05<br>
Aug 6 14:51:30 homedesk pluto[7297]: | 00 00 00 00 00 00 00 00 03
00 16 00 00 00 00 00<br>
Aug 6 14:51:30 homedesk pluto[7297]: | 02 00 00 00 ac 1f 65 11 00
00 00 00 00 00 00 00<br>
Aug 6 14:51:30 homedesk pluto[7297]: | 03 00 17 00 00 00 00 00 02
00 00 00 ff ff ff ff<br>
Aug 6 14:51:30 homedesk pluto[7297]: | 4c 6e ee bf 49 6d ee bf 03
00 18 00 00 00 00 00<br>
Aug 6 14:51:30 homedesk pluto[7297]: | 02 00 00 00 ff ff ff ff 31
37 00 00 01 31 37 32<br>
Aug 6 14:51:30 homedesk pluto[7297]: ERROR: pfkey write() of
SADB_X_DELFLOW message 14 for flow <a class="moz-txt-link-abbreviated"
href="mailto:int.0@0.0.0.0">int.0@0.0.0.0</a> failed. Errno 14: Bad
address<br>
...<br>
<br>
<br>
<br>
</body>
</html>