<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000066" bgcolor="#ffffff">
Hi Paul,<br>
<br>
No, it does not (note I am not using L2TP):<br>
<br>
root@ondar ~]# ip xfrm policy<br>
src 192.168.60.0/24 dst 193.86.86.100/32 proto tcp<br>
dir in priority 2088<br>
tmpl src 193.85.188.83 dst 193.86.86.100<br>
proto esp reqid 16389 mode tunnel<br>
src 193.86.86.100/32 dst 192.168.60.0/24 proto tcp<br>
dir out priority 2088<br>
tmpl src 193.86.86.100 dst 193.85.188.83<br>
proto esp reqid 16389 mode tunnel<br>
src 192.168.60.0/24 dst 193.86.86.100/32 proto tcp<br>
dir fwd priority 2088<br>
tmpl src 193.85.188.83 dst 193.86.86.100<br>
proto esp reqid 16389 mode tunnel<br>
src ::/0 dst ::/0<br>
dir in priority 0<br>
src 0.0.0.0/0 dst 0.0.0.0/0<br>
dir in priority 0<br>
src 0.0.0.0/0 dst 0.0.0.0/0<br>
dir in priority 0<br>
src 0.0.0.0/0 dst 0.0.0.0/0<br>
dir in priority 0<br>
src 0.0.0.0/0 dst 0.0.0.0/0<br>
dir in priority 0<br>
src ::/0 dst ::/0<br>
dir out priority 0<br>
src 0.0.0.0/0 dst 0.0.0.0/0<br>
dir out priority 0<br>
src 0.0.0.0/0 dst 0.0.0.0/0<br>
dir out priority 0<br>
src 0.0.0.0/0 dst 0.0.0.0/0<br>
dir out priority 0<br>
src 0.0.0.0/0 dst 0.0.0.0/0<br>
dir out priority 0<br>
[root@ondar ~]# ip xfrm state<br>
src 193.86.86.100 dst 193.85.188.83<br>
proto esp spi 0xd422f931 reqid 16389 mode tunnel<br>
replay-window 32<br>
auth hmac(sha1) 0x9e86e3a35aafa69877304694d0bed95836a96322<br>
enc cbc(des3_ede)
0x50ea5d294af956f623b66f3e4819640fb982c47b8fd9b631<br>
src 193.85.188.83 dst 193.86.86.100<br>
proto esp spi 0x8f17a537 reqid 16389 mode tunnel<br>
replay-window 32<br>
auth hmac(sha1) 0x4be8c3c3d199ab0981b8b6904c4d74f04997b982<br>
enc cbc(des3_ede)
0xbc53fad0ee86da3464e9b7717d8047302ed33c54559c0db7<br>
<br>
Regards,<br>
Ondrej<br>
<br>
<br>
On 17.12.2009 22:50, Paul Wouters wrote:
<blockquote
cite="mid:alpine.LFD.1.10.0912171649480.6874@newtla.xelerance.com"
type="cite">On Thu, 17 Dec 2009, Ondrej Valousek wrote:
<br>
<br>
<blockquote type="cite">I did not configure the policy properly on
the firewall. Now it works fine (always glad when I can answer
<br>
myself :-)
<br>
Funny thing is, that the *protoport option is completely ignored
(everything that belongs to the 192.168.60.x
<br>
subnet is being tunneled to the other side).
<br>
</blockquote>
<br>
Can you show "ip xfrm policy" and "ip xfrm state". Does it show the
1701 ports?
<br>
<br>
Paul
<br>
</blockquote>
<br>
</body>
</html>