<div dir="ltr"><div><div><div>Hi All,<br><br></div>I am trying to set up simplest IPSec on my linux box, which has kernel 2.6.21.<br></div>I have configured kernel for IPSec.<br><br></div>I use iproute2 for setting SA and SP for the IPSec using:<br>
<br><br><p><b>#HOST A:192.168.77.24</b><br>
ip xfrm state add src 192.168.77.23 dst 192.168.77.24 proto esp spi
0x53fa0fdd mode transport reqid 16386 replay-window 32 auth “hmac(sha1)”
0x55f01ac07e15e437115dde0aedd18a822ba9f81e enc “cbc(aes)”
0x6aed4975adf006d65c76f63923a6265b sel src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></p>
<p>ip xfrm state add src 192.168.77.24 dst 192.168.77.23 proto esp spi
0x53fa0fdd mode transport reqid 16386 replay-window 32 auth “hmac(sha1)”
0x55f01ac07e15e437115dde0aedd18a822ba9f81e enc “cbc(aes)”
0x6aed4975adf006d65c76f63923a6265b sel src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> </p>
<p>ip xfrm policy add dir out src 192.168.77.23 dst 192.168.77.24 ptype
main action allow priority 2080 tmpl src 192.168.77.23 dst 192.168.77.24
proto esp reqid 16385 mode transport</p>
<p>ip xfrm policy add dir in src 192.168.77.24 dst 192.168.77.23 ptype
main action allow priority 2080 tmpl src 192.168.77.24 dst 192.168.77.23
proto esp reqid 16385 mode transport</p><p><br></p><p><b>#HOST B:192.168.77.23</b><br>
ip xfrm state add src 192.168.77.24 dst 192.168.77.23 proto esp spi
0x53fa0fdd mode transport reqid 16386 replay-window 32 auth “hmac(sha1)”
0x55f01ac07e15e437115dde0aedd18a822ba9f81e enc “cbc(aes)”
0x6aed4975adf006d65c76f63923a6265b sel src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></p>
<p>ip xfrm state add src 192.168.77.23 dst 192.168.77.24 proto esp spi
0x53fa0fdd mode transport reqid 16386 replay-window 32 auth “hmac(sha1)”
0x55f01ac07e15e437115dde0aedd18a822ba9f81e enc “cbc(aes)”
0x6aed4975adf006d65c76f63923a6265b sel src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> </p>
<p>ip xfrm policy add dir out src 192.168.77.24 dst 192.168.77.23 ptype
main action allow priority 2080 tmpl src 192.168.77.24 dst 192.168.77.23
proto esp reqid 16385 mode transport</p>
<p>ip xfrm policy add dir in src 192.168.77.23 dst 192.168.77.24 ptype
main action allow priority 2080 tmpl src 192.168.77.23 dst 192.168.77.24
proto esp reqid 16385 mode transport</p><p><br></p><p>here HOST A is my linux box.</p><p>I can check set values of SA and SP using</p><p><br></p><p><b>#ip x s</b></p><p><b>#ip xfrm policy show</b></p><p>and it shows correct values which i have set.<br>
</p><p>With this setting i expect IPSec should work and i should see ESP protocol packet on wireshark at host A when i ping host B.</p><p><br></p><p>But it shows simple icmp packet, instead of ESP. Ping work as usual without ESP.</p>
<p><br></p><p><b>I have checked same setting on my laptop with ubantu 12.04LTS with kernel 3.2 but shows the same result. On laptop i have checked configuration of kernel using #ipsec verify and it say all OK.<br></b></p>
<p></p><p><br></p><p>i do not know what else setting is missing. Any clue will be helpful.</p><p><br></p><p>Thanks in Advance.<br></p><div><div><div><div><br><br><br><br><br><br><br></div></div></div></div></div>