Hi,<br><br>on both sides run pc based routers with slackware 12.1<br>on both sides firewall is down. iptables -F<br>I added leftsource and rightsource but same result.<br>here is the ipsec auto --status output:<br><br>root@vpn:/usr/src/linux# <i style="color: rgb(0, 102, 0);">ipsec auto --status<br>
000 using kernel interface: klips<br>000 interface ipsec0/eth0 82.79.77.xy<br>000 %myid = (none)<br>000 debug none<br>000<br>000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64, keysizemin=192, keysizemax=192<br>000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=128, keysizemin=128, keysizemax=256<br>
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128<br>000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160<br>000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128<br>
000<br>000 algorithm IKE encrypt: id=3, name=OAKLEY_BLOWFISH_CBC, blocksize=8, keydeflen=128<br>000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192<br>000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128<br>
000 algorithm IKE encrypt: id=65004, name=OAKLEY_SERPENT_CBC, blocksize=16, keydeflen=128<br>000 algorithm IKE encrypt: id=65005, name=OAKLEY_TWOFISH_CBC, blocksize=16, keydeflen=128<br>000 algorithm IKE encrypt: id=65289, name=OAKLEY_TWOFISH_CBC_SSH, blocksize=16, keydeflen=128<br>
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<br>000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<br>000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32<br>000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64<br>
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024<br>000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536<br>000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048<br>
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072<br>000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096<br>000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144<br>
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192<br>000<br>000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}<br>000<br>000 "baiamare-negresti": <a href="http://192.168.10.0/24===82.79.77.xy">192.168.10.0/24===82.79.77.xy</a><82.79.77.xy>[+S=C]---82.79.77.65...82.79.83.1---82.79.83.nm<82.79.83.nm>[+S=C]===<a href="http://192.168.23.0/24">192.168.23.0/24</a>; erouted; eroute owner: #4<br>
000 "baiamare-negresti": myip=192.168.10.254; hisip=192.168.23.1;<br>000 "baiamare-negresti": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3<br>000 "baiamare-negresti": policy: RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW; prio: 24,24; interface: eth0;<br>
000 "baiamare-negresti": newest ISAKMP SA: #3; newest IPsec SA: #4;<br>000 "baiamare-negresti": IKE algorithm newest: AES_CBC_128-SHA1-MODP2048<br>000<br>000 #4: "baiamare-negresti":500 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 28205s; newest IPSEC; eroute owner; isakmp#3; idle; import:not set<br>
000 #4: "baiamare-negresti" esp.572de5cb@82.79.83.nm esp.f718f73e@82.79.77.xy tun.1004@82.79.83.nm tun.1003@82.79.77.xy ref=13 refhim=9<br>000 #3: "baiamare-negresti":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 3005s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:not set<br>
000 #2: "baiamare-negresti":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27647s; isakmp#1; idle; import:admin initiate<br>000 #2: "baiamare-negresti" esp.f7140fdc@82.79.83.nm esp.f718f73d@82.79.77.xy tun.1001@82.79.83.nm tun.1002@82.79.77.xy ref=11 refhim=9<br>
000 #1: "baiamare-negresti":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2555s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate</i><br style="color: rgb(0, 102, 0);"><br><br><div class="gmail_quote">
On Wed, Jan 7, 2009 at 9:13 PM, Peter McGill <span dir="ltr"><<a href="mailto:petermcgill@goco.net">petermcgill@goco.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
This is not uncommon, -I doesn't always work, try adding the following to your conf.<br>
leftsourceip=192.168.10.254<br>
rightsourceip=192.168.23.1<br>
Also check that your firewall isn't blocking tunnel traffic.<br>
You need to allow communication between <a href="http://192.168.10.0/24" target="_blank">192.168.10.0/24</a> and <a href="http://192.168.23.0/24" target="_blank">192.168.23.0/24</a> on ipsec0.<br>
Not sure what that Delete SA message is about, what ipsec device is on the other end of tunnel?<br>
<font color="#888888"><br>
Peter McGill<br>
IT Systems Analyst<br>
Gra Ham Energy Limited<br>
</font><div><div></div><div class="Wj3C7c"><br>
> -----Original Message-----<br>
> From: <a href="mailto:users-bounces@openswan.org">users-bounces@openswan.org</a><br>
> [mailto:<a href="mailto:users-bounces@openswan.org">users-bounces@openswan.org</a>] On Behalf Of TC<br>
> Sent: January 7, 2009 12:20 PM<br>
> To: <a href="mailto:users@openswan.org">users@openswan.org</a><br>
> Subject: [Openswan Users] net-to-net - openswan 2.6.18 on k.2.6.24.7<br>
><br>
> Hi all,<br>
><br>
> I have installed kernel 2.6.24.7 + klips patch + openswan 2.6.18<br>
> I have made a net-to-net config. The connection start but I cannot<br>
> ping the end of the tunnel.<br>
><br>
> ping 192.168.23.1 -I eth1 not working<br>
> ping 192.168.10.254 -I eth1 not working<br>
><br>
> ping 192.168.10.254 -I eth1<br>
> PING 192.168.10.254 (192.168.10.254) from 192.168.23.1 eth1:<br>
> 56(84) bytes of data.<br>
> From 192.168.23.1 icmp_seq=2 Destination Host Unreachable<br>
> >From 192.168.23.1 icmp_seq=3 Destination Host Unreachable<br>
> From 192.168.23.1 icmp_seq=4 Destination Host Unreachable<br>
><br>
><br>
> A config(and same config to B but different ipsec.secrets)<br>
><br>
> version 2.0<br>
><br>
> config setup<br>
> interfaces="ipsec0=eth0"<br>
> protostack=klips<br>
><br>
> conn block<br>
> auto=ignore<br>
><br>
> conn private<br>
> auto=ignore<br>
><br>
> conn private-or-clear<br>
> auto=ignore<br>
><br>
> conn clear-or-private<br>
> auto=ignore<br>
><br>
> conn clear<br>
> auto=ignore<br>
><br>
> conn packetdefault<br>
> auto=ignore<br>
><br>
> conn A-B<br>
> left=WAN_IP_FROM_A<br>
> leftnexthop=GATEWAY_FROM_A<br>
> leftsubnet=<a href="http://192.168.10.0/24" target="_blank">192.168.10.0/24</a><br>
> right=WAN_IP_FROM_B<br>
> rightnexthop=GATEWAY_FROM_B<br>
> rightsubnet=<a href="http://192.168.23.0/24" target="_blank">192.168.23.0/24</a><br>
> type=tunnel<br>
> auth=esp<br>
> leftrsasigkey=0sAQOY...<br>
> rightrsasigkey=0sAQNqB...<br>
> auto=start<br>
><br>
> in /var/log/syslog I have:<br>
> Jan 7 19:13:12 vpn ipsec_setup: Starting Openswan IPsec 2.6.18...<br>
> Jan 7 19:13:12 vpn ipsec__plutorun: 002 added connection<br>
> description "A-B"<br>
> Jan 7 19:13:12 vpn ipsec__plutorun: 104 "A-B" #1:<br>
> STATE_MAIN_I1: initiate<br>
><br>
> in /var/log.secure I have:<br>
> Jan 7 19:15:57 vpn pluto[10094]: "A-B" #1: STATE_MAIN_I2:<br>
> sent MI2, expecting MR2<br>
> Jan 7 19:15:57 vpn pluto[10094]: "A-B" #1: transition from<br>
> state STATE_MAIN_I2 to state STATE_MAIN_I3<br>
> Jan 7 19:15:57 vpn pluto[10094]: "A-B" #1: STATE_MAIN_I3:<br>
> sent MI3, expecting MR3<br>
> Jan 7 19:15:57 vpn pluto[10094]: "A-B" #1: received Vendor<br>
> ID payload [CAN-IKEv2]<br>
> Jan 7 19:15:57 vpn pluto[10094]: "A-B" #1: Main mode peer ID<br>
> is ID_IPV4_ADDR: '82.79.83.23'<br>
> Jan 7 19:15:57 vpn pluto[10094]: "A-B" #1: transition from<br>
> state STATE_MAIN_I3 to state STATE_MAIN_I4<br>
> Jan 7 19:15:57 vpn pluto[10094]: "A-B" #1: STATE_MAIN_I4:<br>
> ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=aes_128<br>
> prf=oakley_sha group=modp2048}<br>
> Jan 7 19:15:57 vpn pluto[10094]: "A-B" #2: initiating Quick<br>
> Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW {using isakmp#1<br>
> msgid:beed36ed proposal=defaults pfsgroup=OAKLEY_GROUP_MODP2048}<br>
> Jan 7 19:15:57 vpn pluto[10094]: "A-B" #2: transition from<br>
> state STATE_QUICK_I1 to state STATE_QUICK_I2<br>
> Jan 7 19:15:57 vpn pluto[10094]: "A-B" #2: STATE_QUICK_I2:<br>
> sent QI2, IPsec SA established tunnel mode {ESP=>0x45d84918<br>
> <0x892b2f5a xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}<br>
> Jan 7 19:16:16 vpn pluto[10094]: "A-B" #1: ignoring Delete<br>
> SA payload: PROTO_IPSEC_ESP SA(0x45d84917) not found (maybe expired)<br>
> Jan 7 19:16:16 vpn pluto[10094]: "A-B" #1: received and<br>
> ignored informational message<br>
><br>
><br>
> Thx for Help.<br>
><br>
> --<br>
> TC<br>
><br>
><br>
<br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>--<br>TC<br>