thank for the response Paul & Curu. I agree they are both old
versions but that's what Novell Suse officially supports on their
distribution 8 & 10 so to say (will update management :) )...I was able to get the IPSEC working in my lab environment between Suse 8 and Suse 10 with the exact same config as described below without firewall and natting/patting. <br>
<br>here is some more debugging...maybe it can benefit someone else.<br><br><u>//from SYSTEM1 authlog</u><br>//system1 is getting ready to send a packet to system2
<br>Apr 16 14:51:29 system1 pluto[21904]: "system1-system2" #162: initiating Main Mode
<br>Apr 16 14:51:29 system1 pluto[21904]: | **emit ISAKMP Message:
<br>Apr 16 14:51:29 system1 pluto[21904]: | initiator cookie:
<br>Apr 16 14:51:29 system1 pluto[21904]: | 2b 06 b2 30 c6 f3 5b c8 „³ system1 cookie id
<br>Apr 16 14:51:29 system1 pluto[21904]: | responder cookie:
<br>Apr 16 14:51:29 system1 pluto[21904]: | 00 00 00 00 00 00 00 00
<br><br><u>//from system2 pluto.log</u><br>received 176 bytes from 142.***.208.44:500 on bond0 (port=500)
<br>| 2b 06 b2 30 c6 f3 5b c8 00 00 00 00 00 00 00 00
<br>| 01 10 02 00 00 00 00 00 00 00 00 b0 00 00 00 94
<br>| 00 00 00 01 00 00 00 01 00 00 00 88 00 01 00 04
<br>| 03 00 00 20 00 01 00 00 80 0b 00 01 80 0c 0e 10
<br>| 80 01 00 05 80 02 00 02 80 03 00 03 80 04 00 05
<br>| 03 00 00 20 01 01 00 00 80 0b 00 01 80 0c 0e 10
<br>| 80 01 00 05 80 02 00 01 80 03 00 03 80 04 00 05
<br>| 03 00 00 20 02 01 00 00 80 0b 00 01 80 0c 0e 10
<br>| 80 01 00 05 80 02 00 02 80 03 00 03 80 04 00 02
<br>| 00 00 00 20 03 01 00 00 80 0b 00 01 80 0c 0e 10
<br>| 80 01 00 05 80 02 00 01 80 03 00 03 80 04 00 02
<br>| **parse ISAKMP Message:
<br><b>| initiator cookie:
<br>| 2b 06 b2 30 c6 f3 5b c8 --> system1 cookie ID
<br>| responder cookie:
<br>| 00 00 00 00 00 00 00 00
</b><br>| next payload type: ISAKMP_NEXT_SA
<br>| ISAKMP version: ISAKMP Version 1.0
<br>| exchange type: ISAKMP_XCHG_IDPROT
<br>| flags: none
<br>| message ID: 00 00 00 00
<br>| length: 176
<br>.<br>.<br>.<br>| processing connection system1-system2
<br>|<b> ICOOKIE: 2b 06 b2 30 c6 f3 5b c8
<br>| RCOOKIE: 48 e0 ec 0a 97 1e ce ef --> ipsec on system2 inserting its own cookie ID
</b><br>| peer: 8e cd d0 2c
<br>| state hash entry 16
<br>.<br>.<br>.<br>| sending reply packet to 142.***.208.44:500 (from port=500) //system2 is sending packet to system1
<br>| sending 116 bytes for STATE_MAIN_R0 through bond0:500 to 142.***.208.44:500:
<br>| <b>2b 06 b2 30 c6 f3 5b c8</b> 48 e0 ec 0a 97 1e ce ef
<br>| 01 10 02 00 00 00 00 00 00 00 00 74 0d 00 00 34
<br>| 00 00 00 01 00 00 00 01 00 00 00 28 00 01 00 01
<br>| 00 00 00 20 00 01 00 00 80 0b 00 01 80 0c 0e 10
<br>| 80 01 00 05 80 02 00 02 80 03 00 03 80 04 00 05
<br>| 0d 00 00 10 4f 45 7a 7d 46 46 46 66 67 72 5f 65
<br>| 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc
<br>| 77 57 01 00
<br><br>system1 doesn't see this reply packet; it is possible it could be network problem but look at the following tcpdump from ssytem1 it shows its getting packets from system2 <br><font size="1"><br></font><br>system1:~ # tcpdump -v -i eth0 host 49.***.29.12[system2 ip]<br>
tcpdump: listening on eth0<br>14:10:58.926246 system1.ike > system2.ike: isakmp 1.0 msgid : phase 1 I ident: [|sa] (DF) (ttl 64, id 37135, len 204)<br>14:10:58.928111 system2 > system1: icmp: system2 udp port ike unreachable [tos 0xc0] (ttl 64, id 27863, len 232) <b>--> ipsec was down on system2</b> (icmp is blocked by firewall)<br>
14:11:06.528892 system2.ike > system1.ike: isakmp 1.0 msgid : phase 1 I ident: [|sa] (DF) (ttl 64, id 0, len 240) <b>--> system1 didnt respond since i didnt see this come in</b><br>14:11:08.597133 system1.ike > <span style="color: rgb(255, 0, 0);">system2.ike: isakmp 1.0 msgid : phase 1 I ident</span>: [|sa] (DF) (ttl 64, id 37404, len 204) <b>--> Initial packet from system1</b><br>
14:11:08.598345 system2.ike > <span style="color: rgb(255, 0, 0);">system1.ike: isakmp 1.0 msgid : phase 1 R ident</span>: [|sa] (DF) (ttl 64, id 0, len 144)<b> --> response back from system2</b><u style="color: rgb(255, 0, 0);"> <span style="color: rgb(0, 0, 153);">(now why is ipsec not responding back to this, the Response packet is actually getting to system1 ) </span></u><br>
14:11:16.597915 system2.ike > system1.ike: isakmp 1.0 msgid : phase 1 I ident: [|sa] (DF) (ttl 64, id 0, len 240) --> <b>response back from system2 ??? 2nd packet</b><br>14:11:18.597854 system2.ike > system1.ike: isakmp 1.0 msgid : phase 1 R ident: [|sa] (DF) (ttl 64, id 0, len 144)<br>
14:11:28.742482 system1.ike > system2.ike: isakmp 1.0 msgid : phase 1 I ident: [|sa] (DF) (ttl 64, id 37696, len 204)<br>14:11:28.744684 system2.ike > system1.ike: isakmp 1.0 msgid : phase 1 R ident: [|sa] (DF) (ttl 64, id 0, len 144)<br>
14:11:36.745618 system2.ike > system1.ike: isakmp 1.0 msgid : phase 1 I ident: [|sa] (DF) (ttl 64, id 0, len 240)<br>14:11:38.745504 system2.ike > system1.ike: isakmp 1.0 msgid : phase 1 R ident: [|sa] (DF) (ttl 64, id 0, len 144)<br>
14:11:38.745599 system2.ike > system1.ike: isakmp 1.0 msgid : phase 1 R ident: [|sa] (DF) (ttl 64, id 0, len 144) <br><br>thanks <br>aasim<br><br><br><div class="gmail_quote">On Thu, Apr 16, 2009 at 10:31 PM, Paul Wouters <span dir="ltr"><<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="im">On Wed, 15 Apr 2009, Aasim Ajaz wrote:<br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
I am trying to create IPSEC tunnel between two linux system Suse 8 running freeswan 1.98 & Suse 10 running<br>
openswan 2.4 and so far no success. I have verified network setting few times and they all look good.<br>
</blockquote>
<br></div>
Those versions are VERY ancient. All bets are off, and you have known DoS<br>
attacks that are possible against those systems. Plus many bugsfixes<br>
you are missing from the last 5+ years.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
this is traffic flow from right to left side...<br>
86: 23:38:48.479208 49.***.29.12.500 > 142.***.208.44.500: udp 212<br>
</blockquote>
<br></div>
There is no point loggin udp packets. The first thing IPsec does is<br>
initiate crypto.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
System2:~ # rpm -qa | grep openswan<br>
openswan-2.4.4-18.9<br>
</blockquote>
<br></div>
Should upgrade to 2.4.14 really.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
System2:~ # rpm -qa | grep ipsec<br>
ipsec-tools-0.6.5-10.10<br>
</blockquote>
<br></div>
which does not ipsec-tools<br>
<br>
your config looks fine.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
system02:~ # ipsec auto --verbose --up system1-system2<br>
002 "system01-system02" #3: initiating Main Mode<br>
104 "system01-system02" #3: STATE_MAIN_I1: initiate<br>
010 "system01-system02" #3: STATE_MAIN_I1: retransmission; will wait 20s for response<br>
010 "system01-system02" #3: STATE_MAIN_I1: retransmission; will wait 20s for response<br>
010 "system01-system02" #3: STATE_MAIN_I1: retransmission; will wait 40s for response<br>
</blockquote>
<br></div>
You are not getting an answer to your first packet. This usually means<br>
a firewall is blocking things somewhere.<br><font color="#888888">
<br>
Paul<br>
</font></blockquote></div><br>