Hi <br><br>I have fixed the routing table and I think I have progressed a little further. I have also turned off the plutodebug.<br><br>netstat -rn shows<br><br>root@zulu:~# netstat -rn<br>Kernel IP routing table<br>Destination Gateway Genmask Flags MSS Window irtt Iface
<br><a href="http://203.161.90.1">203.161.90.1</a> <a href="http://0.0.0.0">0.0.0.0</a> <a href="http://255.255.255.255">255.255.255.255</a> UH 0 0 0 ppp0<br><a href="http://10.3.0.0">10.3.0.0</a>
<a href="http://0.0.0.0">0.0.0.0</a> <a href="http://255.255.255.0">255.255.255.0</a> U 0 0 0 eth1<br><a href="http://192.168.10.0">192.168.10.0</a> <a href="http://203.161.90.1">203.161.90.1
</a> <a href="http://255.255.255.0">255.255.255.0</a> UG 0 0 0 ppp0<br><a href="http://0.0.0.0">0.0.0.0</a> <a href="http://0.0.0.0">0.0.0.0</a> <a href="http://0.0.0.0">0.0.0.0</a> U 0 0 0 ppp0
<br><br><br>Should I see an ipsec interface here?<br><br>I am still unsure if I am actually getting a valid connection. What I do know is that I can not ping through the vpn<br><br>running ipsec auto --status gives me:<br>
<br>root@bravo:/var/log# ipsec auto --status<br>000 interface lo/lo ::1<br>000 interface lo/lo <a href="http://127.0.0.1">127.0.0.1</a><br>000 interface eth0/eth0 <a href="http://192.168.10.2">192.168.10.2</a><br>000 interface eth1/eth1
<a href="http://202.72.167.27">202.72.167.27</a><br>000 interface eth1:1/eth1:1 <a href="http://202.72.167.29">202.72.167.29</a><br>000 %myid = (none)<br>000 debug none<br>000<br>000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64
<br>000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192<br>000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448<br>000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0
<br>000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256
<br>000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128<br>000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160<br>000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256
<br>000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128<br>000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0, keysizemax=0<br>000<br>000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192
<br>000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128<br>000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<br>000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<br>000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
<br>000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536<br>000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048<br>000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
<br>000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096<br>000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144<br>000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
<br>000<br>000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}<br>000<br>000 "bravo-zulu": <a href="http://192.168.10.0/24===202.72.167.27[@bravo.gastech.com.au]---202.72.167.25...203.161.90.1---203.161.71.190[@zulu]===10.3.0.0/24">
192.168.10.0/24===202.72.167.27[@bravo.gastech.com.au]---202.72.167.25...203.161.90.1---203.161.71.190[@zulu]===10.3.0.0/24</a>; erouted; eroute owner: #3<br>000 "bravo-zulu": srcip=unset; dstip=unset; srcup=ipsec _updown; dstup=ipsec _updown;
<br>000 "bravo-zulu": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0<br>000 "bravo-zulu": policy: RSASIG+ENCRYPT+TUNNEL+PFS+UP; prio: 24,24; interface: eth1;
<br>000 "bravo-zulu": newest ISAKMP SA: #1; newest IPsec SA: #3;<br>000 "bravo-zulu": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1536<br>000<br>000 #3: "bravo-zulu":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 28026s; newest IPSEC; eroute owner
<br>000 #3: "bravo-zulu" <a href="mailto:esp.2549d809@203.161.71.190">esp.2549d809@203.161.71.190</a> <a href="mailto:esp.f6c5b82a@202.72.167.27">esp.f6c5b82a@202.72.167.27</a> <a href="mailto:tun.0@203.161.71.190">
tun.0@203.161.71.190</a> <a href="mailto:tun.0@202.72.167.27">tun.0@202.72.167.27</a><br>000 #2: "bravo-zulu":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 26858s<br>000 #2: "bravo-zulu"
<a href="mailto:esp.b72ad41a@203.161.71.190">esp.b72ad41a@203.161.71.190</a> <a href="mailto:esp.e40902a@202.72.167.27">esp.e40902a@202.72.167.27</a> <a href="mailto:tun.0@203.161.71.190">tun.0@203.161.71.190</a> <a href="mailto:tun.0@202.72.167.27">
tun.0@202.72.167.27</a><br>000 #1: "bravo-zulu":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 1543s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0)<br>000<br><br><br>ifconfig -a does not show an ipsec0 interface, should I see an ipsec interface on the hosts?
<br><br>Cheers<br><br>Phil<br><br><div><span class="gmail_quote">On 27/11/2007, <b class="gmail_sendername">Paul Wouters</b> <<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On Mon, 26 Nov 2007, Phil Wild wrote:<br><br>> I posted the below to the list about a week ago and did not get any<br>> responses. Does anyone have any ideas what is going wrong with my<br>> configuration as I have not been able to get any further.
<br><br>> > Nov 20 14:25:15 bravo ipsec__plutorun: ...could not start conn "bravo-zulu"<br>> > netstat -rn on host zulu shows:<br>> ><br>> > Destination Gateway Genmask Flags MSS Window irtt Iface
<br>> > <a href="http://203.161.90.1">203.161.90.1</a> <a href="http://0.0.0.0">0.0.0.0</a> <a href="http://255.255.255.255">255.255.255.255</a> UH 0 0 0 ppp0<br>> > <a href="http://10.3.0.0">
10.3.0.0</a> <a href="http://0.0.0.0">0.0.0.0</a> <a href="http://255.255.255.0">255.255.255.0</a> U 0 0 0 eth1<br>> > <a href="http://192.168.10.0">192.168.10.0</a> <a href="http://203.161.90.1">
203.161.90.1</a> <a href="http://255.255.255.0">255.255.255.0</a> UG 0 0 0 ppp0<br>> > <a href="http://0.0.0.0">0.0.0.0</a> <a href="http://0.0.0.0">0.0.0.0</a> <a href="http://0.0.0.0">
0.0.0.0</a> U 0 0 0 ppp0<br><br>Blame your ISP if that is really the default route you got. Try changing to<br>something that might make sense. Run a traceroute and check what your real gateway<br>
is, then do a "route add -host ipofgw dev ppp0" and "route add default gw ipofgw"<br><br>Paul<br></blockquote></div><br><br clear="all"><br>-- <br>Tel: 0400 466 952<br>Fax: 0433 123 226<br>email: <a href="mailto:philwild@gmail.com">
philwild@gmail.com</a>