<br><font size=2 face="Courier">Hello, <br>
<br>
I want to realize a IPSEC tunnel between a linux station and a cisco router
1900. </font>
<br><font size=2 face="Courier">The initializations phases IKE and ESP
are now Ok, but the ping command doesn't work between the 2 private interfaces
(without response)</font>
<br>
<br><font size=2 face="Courier">my network configuration <br>
===================== <br>
10.0.0.1 <--> La.Lb.Lc.Ld <==========> Ra.Rb.Rc.Rd <-->
10.1.0.1 <br>
the linux station has 2 interfaces: 10.0.0.1 and La.Lb.Lc.Ld <br>
the cisco router has 2 interfaces: Ra.Rb.Rc.Rd and 11.0.0.1 <br>
</font>
<br><font size=2 face="Courier">ipsec.conf</font>
<br><font size=2 face="Courier">==========</font>
<br><font size=2 face="Courier New">version 2.0
# conforms to second version of ipsec.conf
specification</font>
<br><font size=2 face="Courier New">config setup</font>
<br><font size=2 face="Courier New"> nat_traversal=yes</font>
<br><font size=2 face="Courier New"> oe=off</font>
<br><font size=2 face="Courier New"> protostack=netkey</font>
<br><font size=2 face="Courier New"> nhelpers=0</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New">conn jsat</font>
<br><font size=2 face="Courier New"> left=La.Lb.Lc.Ld</font>
<br><font size=2 face="Courier New"> leftsubnet=10.0.0.0/24</font>
<br><font size=2 face="Courier New"> leftnexthop=Ra.Rb.Rc.Rd</font>
<br><font size=2 face="Courier New"> leftsourceip=10.0.0.1</font>
<br>
<br><font size=2 face="Courier New"> right=Ra.Rb.Rc.Rd</font>
<br><font size=2 face="Courier New"> rightsubnet=10.1.0.0/24</font>
<br><font size=2 face="Courier New"> rightsourceip=10.1.0.1</font>
<br><font size=2 face="Courier New"> rightnexthop=La.Lb.Lc.Ld</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New"> ike=aes128-sha1;modp1024</font>
<br><font size=2 face="Courier New"> phase2=esp</font>
<br><font size=2 face="Courier New"> phase2alg=aes128-sha1;modp1024</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New"> pfs=yes</font>
<br><font size=2 face="Courier New"> authby=secret</font>
<br><font size=2 face="Courier New"> auto=add</font>
<br>
<br>
<br><font size=2 face="Courier">cisco conf</font>
<br><font size=2 face="Courier">==========</font>
<br><font size=2 face="Courier">crypto isakmp policy 1</font>
<br><font size=2 face="Courier"> encr 3des</font>
<br><font size=2 face="Courier"> hash md5</font>
<br><font size=2 face="Courier"> authentication pre-share</font>
<br><font size=2 face="Courier"> group 2</font>
<br><font size=2 face="Courier">crypto isakmp key 123456789 address La.Lb.Lc.Ld</font>
<br>
<br><font size=2 face="Courier">crypto ipsec transform-set openswan esp-3des
esp-md5-hmac</font>
<br><font size=2 face="Courier">!</font>
<br><font size=2 face="Courier">crypto map openswan 10 ipsec-isakmp</font>
<br><font size=2 face="Courier"> set peer La.Lb.Lc.Ld</font>
<br><font size=2 face="Courier"> set transform-set openswan</font>
<br><font size=2 face="Courier"> match address 100</font>
<br>
<br><font size=2 face="Courier">interface GigabitEthernet0/0</font>
<br><font size=2 face="Courier"> description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE
0/0$</font>
<br><font size=2 face="Courier"> ip address 11.0.0.1 255.255.255.0</font>
<br><font size=2 face="Courier"> duplex auto</font>
<br><font size=2 face="Courier"> speed auto</font>
<br><font size=2 face="Courier"> !</font>
<br><font size=2 face="Courier">interface GigabitEthernet0/1</font>
<br><font size=2 face="Courier"> ip address Ra.Rb.Rc.Rd 255.255.255.0</font>
<br><font size=2 face="Courier"> duplex auto</font>
<br><font size=2 face="Courier"> speed auto</font>
<br><font size=2 face="Courier"> crypto map openswan</font>
<br><font size=2 face="Courier"> </font>
<br><font size=2 face="Courier">access-list 100 permit ip 10.0.0.0 0.0.0.255
10.1.0.0 0.0.0.255</font>
<br><font size=2 face="Courier">access-list 100 permit ip 10.1.0.0 0.0.0.255
10.0.0.0 0.0.0.255</font>
<br>
<br>
<br><font size=2 face="Courier">ipsec auto --verbose --up jsat</font>
<br><font size=2 face="Courier">==============================</font>
<br><font size=2 face="Courier New">root@sellin-HP-Compaq-dc7100-SFF-DX878AV:~#
ipsec auto --verbose --up jsat</font>
<br><font size=2 face="Courier New">002 "jsat" #1: initiating
Main Mode</font>
<br><font size=2 face="Courier New">104 "jsat" #1: STATE_MAIN_I1:
initiate</font>
<br><font size=2 face="Courier New">003 "jsat" #1: received Vendor
ID payload [RFC 3947] method set to=109 </font>
<br><font size=2 face="Courier New">002 "jsat" #1: enabling possible
NAT-traversal with method 4</font>
<br><font size=2 face="Courier New">002 "jsat" #1: transition
from state STATE_MAIN_I1 to state STATE_MAIN_I2</font>
<br><font size=2 face="Courier New">106 "jsat" #1: STATE_MAIN_I2:
sent MI2, expecting MR2</font>
<br><font size=2 face="Courier New">003 "jsat" #1: received Vendor
ID payload [Cisco-Unity]</font>
<br><font size=2 face="Courier New">003 "jsat" #1: received Vendor
ID payload [Dead Peer Detection]</font>
<br><font size=2 face="Courier New">003 "jsat" #1: ignoring unknown
Vendor ID payload [05af61d0311e7d9005da93d0c40f6a6e]</font>
<br><font size=2 face="Courier New">003 "jsat" #1: received Vendor
ID payload [XAUTH]</font>
<br><font size=2 face="Courier New">003 "jsat" #1: NAT-Traversal:
Result using RFC 3947 (NAT-Traversal): no NAT detected</font>
<br><font size=2 face="Courier New">002 "jsat" #1: transition
from state STATE_MAIN_I2 to state STATE_MAIN_I3</font>
<br><font size=2 face="Courier New">108 "jsat" #1: STATE_MAIN_I3:
sent MI3, expecting MR3</font>
<br><font size=2 face="Courier New">002 "jsat" #1: Main mode
peer ID is ID_IPV4_ADDR: 'Ra.Rb.Rc.Rd'</font>
<br><font size=2 face="Courier New">002 "jsat" #1: transition
from state STATE_MAIN_I3 to state STATE_MAIN_I4</font>
<br><font size=2 face="Courier New">004 "jsat" #1: STATE_MAIN_I4:
ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha
group=modp1024}</font>
<br><font size=2 face="Courier New">002 "jsat" #2: initiating
Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW {using isakmp#1 msgid:f5688a1e
proposal=AES(12)_128-SHA1(2)_160 pfsgroup=OAKLEY_GROUP_MODP1024}</font>
<br><font size=2 face="Courier New">117 "jsat" #2: STATE_QUICK_I1:
initiate</font>
<br><font size=2 face="Courier New">003 "jsat" #2: ignoring informational
payload, type IPSEC_RESPONDER_LIFETIME msgid=f5688a1e</font>
<br><font size=2 face="Courier New">002 "jsat" #2: transition
from state STATE_QUICK_I1 to state STATE_QUICK_I2</font>
<br><font size=2 face="Courier New">004 "jsat" #2: STATE_QUICK_I2:
sent QI2, IPsec SA established tunnel mode {ESP=>0xd693fe78 <0x411d2446
xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}</font>
<br>
<br>
<br><font size=2 face="Courier">on linux station</font>
<br><font size=2 face="Courier">================</font>
<br><font size=2 face="Courier">ping -I 10.0.0.1 10.1.0.1</font>
<br><font size=2 face="Courier">I can see the ESP protocol message from
La.Lb.Lc.Ld to Ra.Rb.Rc.Rd but not the response Ra.Rb.Rc.Rd to La.Lb.Lc.Ld</font>
<br>
<br><font size=2 face="Courier">routing on CISCO</font>
<br><font size=2 face="Courier">================</font>
<br><font size=2 face="Courier">I think that the link (route ?) between
Ra.Rb.Rc.Rd and 10.1.0.1 in not configured.</font>
<br><font size=2 face="Courier">How can I do it on the CISCO.</font>
<br>
<br><font size=2 face="Courier">Help me please !</font>
<br>
<br><font size=2 face="Courier">Maurice</font>
<br><PRE><PRE>
<font face="sans-serif">
<table border=0 width=100%>
<tr><td><p lang="fr" style="color:green;font-size:x-small">Pensez à l'environnement : avez-vous besoin d'imprimer ce message ?</p></td></tr>
<tr><td><p lang-"en" style="color:green;font-size:x-small">Think environment : Do you need to print message ?</p></td></tr>
<tr><td><p lang="en" style="color:white;font-size:x-small">.</p></td></tr>
<tr><td><p lang="fr" style="font-size:x-small">Ce courrier électronique, et éventuellement ses pièces jointes, peuvent contenir des informations confidentielles et/ou personnelles et a été envoyé uniquement à l'usage de la personne ou de l'entité citée ci-dessus. Si vous receviez ce courrier électronique par erreur, merci de bien vouloir en avertir l'expéditeur immédiatement par la réponse en retour à ce courrier et effacer l'original et détruire toute copie enregistrée dans un ordinateur, ou imprimée ou encore sauvegardée sur un disque . Toute revue, retransmission ou toute autre forme d'utilisation de ce courrier électronique par toute autre personne que le destinataire prévue est strictement interdite.</p></td></tr>
<tr><td><p lang="fr" style="font-size:x-small">L'internet ne permettant pas d'assurer l'intégrité de ce message, l'expéditeur décline toute responsabilité au cas où il aurait été intercepté ou modifié par quiconque.</p></td></tr>
<tr><td><p lang="en" style="font-size:x-small">This e-mail and possibly any attachment may contain confidential and/or privileged information and is intended only for the use of the individual or entity named above. If you have received it in error, please advise the sender immediately by reply e-mail and delete and destroy all copies including all copies stored in the recipient's computer, printed or saved to disk. . Any review , retransmission, or further use of this e-mail by persons or entities other than the intended recipient is strictly prohibited.</p></td></tr>
<tr><td><p lang="en" style="font-size:x-small">Because of the nature of the Internet the sender is not in a position to ensure the integrity of this message, therefore the sender disclaims any liability whatsoever, in the event of this message having been intercepted and/or altered.</p></td></tr>
</table>
</font>
</PRE>
</PRE>