<DIV><BR> </DIV><PRE>on 2009-08-31，"Paul Wouters" <paul@xelerance.com> wrote：
>On Mon, 31 Aug 2009, weiruyao wrote:
>
>> Every thing is OK ,I see "IPsec SA established" from logs.And packets encapsulated with ESP are going up and down.But when I excute "ipsec setup --status " the result is:
>> /tmp/run/pluto $ /ipsec/sbin/ipsec setup --status
>> IPsec stopped
>> but...
>
>I believe there was a bug in that script false claiming so in the past. What
>version is this?</PRE><PRE>It's openswan-2.6.23dr1.I have checked the script file in _realsetup.The pseudocode is below :</PRE><PRE>if test "$hassublock" -a "$haslock" -a "$plutokind" = "normal" -a \( "$klips" = "yes" -o "$lk26sec" = "yes" \) -a "$hasinfo"</PRE><PRE>then</PRE><PRE> .....</PRE><PRE>else</PRE><PRE> echo "IPsec stopped"</PRE><PRE> if test ! "$hassublock" -a ! "$hasinfo" -a "$plutokind" = "no" -a "$eroutes" -eq 0</PRE><PRE> then</PRE><PRE> exit 3</PRE><PRE> fi</PRE><PRE> if test "$hassublock"</PRE><PRE> then </PRE><PRE> has subsystem lock</PRE><PRE> fi</PRE><PRE> if test "$hasinfo"</PRE><PRE> then</PRE><PRE> has info file</PRE><PRE> if</PRE><PRE> if test "$plutokind" != "no"</PRE><PRE> then</PRE><PRE> An ${plutokind} Pluto is active?</PRE><PRE> fi</PRE><PRE> if test "$eroutes" -gt 0</PRE><PRE> then</PRE><PRE> some (${eroutes}) eroutes exist!</PRE><PRE> fi</PRE><PRE>fi</PRE><PRE>I have check the variables in the script above ,"$hassublock" is false ,so it goes to "IPsec stopped".After IPsec SA established ,"/var/lock/subsys/ipsec" didn't exist,so the $hassublock is false.
>
>> has /var/run/pluto/ipsec.info file!
>> An normal Pluto is active?
>> some (1) eroutes exist!
>> I can give you more info:
>> "plutopid=/var/run/pluto/pluto.pid" exists;
>> "lock=/var/run/pluto/ipsec_setup.pid" exists;
>> "info=/var/run/pluto/ipsec.info" exists;
>> plutokind is normal,because "/proc/31282" (31282 is the pid of the pluto)exists
>> "/var/lock/subsys/ipsec" doesn't exists; I think this may be the reason.
>> Can any one help me?Thanks very much.
>
>You can get other information on whether it is running using: ipsec auto --status
>
>Paul</PRE><PRE>I confirm that it's running ,I excute ipsec auto --status :</PRE><PRE>/ipsec/conf $ /ipsec/sbin/ipsec auto --status<BR>000 using kernel interface: netkey<BR>000 interface lo/lo 127.0.0.1<BR>000 interface lo/lo 127.0.0.1<BR>000 interface eth0/eth0 192.168.1.3<BR>000 interface eth0/eth0 192.168.1.3<BR>000 interface ppp0/ppp0 200.1.1.1<BR>000 interface ppp0/ppp0 200.1.1.1<BR>000 %myid = (none)<BR>000 debug none<BR>000 <BR>000 virtual_private (%priv):<BR>000 - allowed 0 subnets: <BR>000 - disallowed 0 subnets: <BR>000 WARNING: Either virtual_private= was not specified, or there was a syntax <BR>000 error in that line. 'left/rightsubnet=%priv' will not work!<BR>000 <BR>000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64<BR>000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192<BR>000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448<BR>000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0<BR>000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256<BR>000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256<BR>000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256<BR>000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256<BR>000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=128, keysizemax=256<BR>000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=8, keysizemin=128, keysizemax=256<BR>000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=8, keysizemin=128, keysizemax=256<BR>000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8, keysizemin=128, keysizemax=256<BR>000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256<BR>000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256<BR>000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128<BR>000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160<BR>000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256<BR>000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128<BR>000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0, keysizemax=0<BR>000 <BR>000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131<BR>000 algorithm IKE encrypt: id=3, name=OAKLEY_BLOWFISH_CBC, blocksize=8, keydeflen=128<BR>000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192<BR>000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128<BR>000 algorithm IKE encrypt: id=65004, name=OAKLEY_SERPENT_CBC, blocksize=16, keydeflen=128<BR>000 algorithm IKE encrypt: id=65005, name=OAKLEY_TWOFISH_CBC, blocksize=16, keydeflen=128<BR>000 algorithm IKE encrypt: id=65289, name=OAKLEY_TWOFISH_CBC_SSH, blocksize=16, keydeflen=128<BR>000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<BR>000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<BR>000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32<BR>000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64<BR>000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024<BR>000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536<BR>000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048<BR>000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072<BR>000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096<BR>000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144<BR>000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192<BR>000 <BR>000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0} <BR>000 <BR>000 "tunnelipsec": 10.69.1.0/24===200.1.1.1<200.1.1.1>[+S=C]...200.1.1.2<200.1.1.2>[+S=C]===10.7.3.0/24; erouted; eroute owner: #4<BR>000 "tunnelipsec": myip=unset; hisip=unset;<BR>000 "tunnelipsec": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0<BR>000 "tunnelipsec": policy: PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+lKOD+rKOD; prio: 24,24; interface: ppp0; <BR>000 "tunnelipsec": newest ISAKMP SA: #1; newest IPsec SA: #4; <BR>000 "tunnelipsec": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024<BR>000 <BR>000 #4: "tunnelipsec":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 28121s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate<BR>000 #4: "tunnelipsec" <A href="mailto:esp.6ceb0cf1@200.1.1.2">esp.6ceb0cf1@200.1.1.2</A> <A href="mailto:esp.d2fe7bd9@200.1.1.1">esp.d2fe7bd9@200.1.1.1</A> <A href="mailto:tun.0@200.1.1.2">tun.0@200.1.1.2</A> <A href="mailto:tun.0@200.1.1.1">tun.0@200.1.1.1</A> ref=0 refhim=4294901761<BR>000 #1: "tunnelipsec":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2488s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate<BR>000 </PRE><PRE>Thank you Paul.</PRE><br><br><span title="neteasefooter"/><hr/>
<a href="http://www.yeah.net/?from=footer">没有广告的终身免费邮箱,www.yeah.net</a>
</span>