<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
Hello Kent.
<div>Result is as expected. </div>
<div>Regards<br>
<div>
<div>
<div style="orphans: 2; widows: 2; font-family: Calibri, sans-serif; margin: 0cm 0cm 0.0001pt; font-size: 11pt;">
<span lang="EN-US" style="font-size: 9pt; color: rgb(80, 80, 255); font-family: 'Lucida Sans Unicode', sans-serif;">Pascal Fuks<br>
Network & Security Architect,<br>
CEO / Administrateur délégué,<br>
<br>
</span></div>
<div style="orphans: 2; widows: 2; font-family: Calibri, sans-serif; margin: 0cm 0cm 0.0001pt; font-size: 11pt;">
<span lang="EN-US" style="font-size: 9pt; color: rgb(80, 80, 255); font-family: 'Lucida Sans Unicode', sans-serif;">Tel. : +32 2 387 08 00<br>
Fax : +32 2 387 07 06<br>
Email : <a href="mailto:pascal@financial-art.be" style="color: blue;">pascal@financial-art.be</a></span></div>
<div style="font-size: 16px; orphans: 2; widows: 2; margin: 0cm 0cm 0.0001pt; font-family: 'Times New Roman';">
<font class="Apple-style-span" color="#0000FF" face="Lucida Sans Unicode,sans-serif" size="3"><span class="Apple-style-span" style="font-size: 12px;">IM: pascal@financial-art (MSN)<br>
Free/Busy Time : <b><a href="http://www.financialart.be/pfukscal.html" style="color: blue;">http://www.financialart.be/pfukscal.html</a></b></span></font></div>
</div>
</div>
<br>
<div>
<div>On 16 Nov 2013, at 17:46, Ana <<a href="mailto:kentdavies@gmail.com">kentdavies@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div dir="ltr">Hi Pascal.
<div><br>
</div>
<div>Many many thanks.</div>
<div>I forgotten to manage my iptables rules. </div>
<div>For now I've flushed my iptables and now on got this:</div>
<div><span><image.png></span><br>
</div>
<div><br>
</div>
<div>So I believe it is working as expected. <b>Isn't it?</b></div>
<div><br>
</div>
<div>My next step is to accomplish the exact same thing but now using x509 certificates. I know I have to generate on CA, and then generate two certificates for each machine signed with my CA. Will try and If I bump in any obstacle will then use this list.</div>
<div><br>
</div>
<div>Once again, thanks for your help.</div>
<div><br>
</div>
<div>Kent</div>
<div><br>
</div>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Sat, Nov 16, 2013 at 2:23 PM, Pascal Fuks <span dir="ltr">
<<a href="mailto:Pascal@financial-art.be" target="_blank">Pascal@financial-art.be</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">Hello Kent,
<div>Could you lits your netfilters on both machines?</div>
<div>iptables-save</div>
<div>
<div class="im"><br>
<div>
<div>
<div style="font-family:Calibri,sans-serif;margin:0cm 0cm 0.0001pt;font-size:11pt">
<span lang="EN-US" style="font-size:9pt;color:rgb(80,80,255);font-family:'Lucida Sans Unicode',sans-serif">Pascal Fuks<br>
Network & Security Architect,<br>
CEO / Administrateur délégué,<br>
<br>
</span></div>
<div style="font-family:Calibri,sans-serif;margin:0cm 0cm 0.0001pt;font-size:11pt">
<span lang="EN-US" style="font-size:9pt;color:rgb(80,80,255);font-family:'Lucida Sans Unicode',sans-serif">Tel. :
<a href="tel:%2B32%202%20387%2008%2000" value="+3223870800" target="_blank">+32 2 387 08 00</a><br>
Fax : <a href="tel:%2B32%202%20387%2007%2006" value="+3223870706" target="_blank">
+32 2 387 07 06</a><br>
Email : <a href="mailto:pascal@financial-art.be" style="color:blue" target="_blank">pascal@financial-art.be</a></span></div>
<div style="font-size:16px;margin:0cm 0cm 0.0001pt;font-family:'Times New Roman'">
<font color="#0000FF" face="Lucida Sans Unicode,sans-serif" size="3"><span style="font-size:12px">IM: pascal@financial-art (MSN)<br>
Free/Busy Time : <b><a href="http://www.financialart.be/pfukscal.html" style="color:blue" target="_blank">http://www.financialart.be/pfukscal.html</a></b></span></font></div>
</div>
</div>
<br>
</div>
<div>
<div class="im">
<div>On 16 Nov 2013, at 13:37, Ana <<a href="mailto:kentdavies@gmail.com" target="_blank">kentdavies@gmail.com</a>> wrote:</div>
<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div class="im">Hello Pascal.
<div><br>
</div>
<div>Thanks.</div>
<div><br>
</div>
<div>From machine A I test like this:</div>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div>
<div><font face="courier new, monospace" size="1">[root@mainmachine etc]# ping -I 10.1.1.254 10.1.2.254</font></div>
</div>
<div><font face="courier new, monospace" size="1">PING 10.1.2.254 (10.1.2.254) from 10.1.1.254 : 56(84) bytes of data.</font></div>
<div><font face="courier new, monospace" size="1">^C</font></div>
<div><font face="courier new, monospace" size="1">--- 10.1.2.254 ping statistics ---</font></div>
<div>
<div><font face="courier new, monospace" size="1">4 packets transmitted, 0 received, 100% packet loss, time 3424ms</font></div>
</div>
<div><span style="font-family:'courier new',monospace;font-size:x-small">[root@mainmachine etc]# ping -I 10.1.1.254 10.1.2.2</span><br>
</div>
<div>
<div><font face="courier new, monospace" size="1">PING 10.1.2.2 (10.1.2.2) from 10.1.1.254 : 56(84) bytes of data.</font></div>
</div>
<div><font face="courier new, monospace" size="1">^C</font></div>
<div><font face="courier new, monospace" size="1">--- 10.1.2.2 ping statistics ---</font></div>
<div>
<div><font face="courier new, monospace" size="1">4 packets transmitted, 0 received, 100% packet loss, time 3727ms</font></div>
</div>
<div><span style="font-family:'courier new',monospace;font-size:x-small">[root@mainmachine etc]# </span><br>
</div>
</blockquote>
<div><br>
</div>
Listening on <b>eth6</b> of machine B with Wireshark I got this: </div>
<div><span><image.png></span>
<div class="im"><br>
<div><br>
</div>
<div>So now I believe it's encrypted but host is unreachable.</div>
<div><br>
</div>
<div>On machine A, If I do this instead:</div>
</div>
</div>
<div class="im">
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div><font size="1" face="courier new, monospace">[root@mainmachine etc]# ping -I 192.168.1.1 10.1.2.254</font></div>
<div>
<div><font size="1" face="courier new, monospace">PING 10.1.2.254 (10.1.2.254) from 192.168.1.1 : 56(84) bytes of data.</font></div>
</div>
<div>
<div><font size="1" face="courier new, monospace">64 bytes from <a href="http://10.1.2.254/" target="_blank">
10.1.2.254</a>: icmp_seq=1 ttl=64 time=0.411 ms</font></div>
</div>
<div><font size="1" face="courier new, monospace">64 bytes from <a href="http://10.1.2.254/" target="_blank">
10.1.2.254</a>: icmp_seq=2 ttl=64 time=1.22 ms</font></div>
<div>
<div><font size="1" face="courier new, monospace">64 bytes from <a href="http://10.1.2.254/" target="_blank">
10.1.2.254</a>: icmp_seq=3 ttl=64 time=0.442 ms</font></div>
</div>
<div><font size="1" face="courier new, monospace">^C</font></div>
<div><font size="1" face="courier new, monospace">--- 10.1.2.254 ping statistics ---</font></div>
<div>
<div><font size="1" face="courier new, monospace">3 packets transmitted, 3 received, 0% packet loss, time 3000ms</font></div>
</div>
<div>
<div><font size="1" face="courier new, monospace">rtt min/avg/max/mdev = 0.411/0.691/1.222/0.376 ms</font></div>
</div>
<div><font size="1" face="courier new, monospace">[root@mainmachine etc]# ping -I 192.168.1.1 10.1.2.2</font></div>
<div>
<div><font size="1" face="courier new, monospace">PING 10.1.2.2 (10.1.2.2) from 192.168.1.1 : 56(84) bytes of data.</font></div>
</div>
<div><font size="1" face="courier new, monospace">^C</font></div>
<div><font size="1" face="courier new, monospace">--- 10.1.2.2 ping statistics ---</font></div>
<div>
<div><font size="1" face="courier new, monospace">4 packets transmitted, 0 received, 100% packet loss, time 3351ms</font></div>
</div>
<div>
<div><font size="1" face="courier new, monospace">[root@mainmachine etc]#</font></div>
</div>
</blockquote>
</div>
<div>
<div class="im">
<div><br>
</div>
<div>Listening on <b>eth6</b> of machine B with Wireshark I got this:<br>
</div>
</div>
<div><span><image.png></span><br>
</div>
<div>
<div class="h5">
<div><br>
</div>
<div>Host now is reachable but conn is not encrypted.</div>
<div><br>
</div>
<div>I believe I have some kind of routing problem.</div>
<div><br>
</div>
<div>My routing table on Machine A is this:</div>
<div>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'">[root@mainmachine etc]# route -n</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'">Kernel IP routing table</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'">Destination Gateway Genmask Flags Metric Ref Use Iface</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'">192.168.1.0 0.0.0.0 255.255.255.0 U 1 0 0 eth2</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'">10.1.1.0 0.0.0.0 255.255.255.0 U 1 0 0 eth1</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'">10.1.2.0 192.168.1.2 255.255.255.0 UG 0 0 0 eth2</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'">0.0.0.0 10.1.1.254 0.0.0.0 UG 0 0 0 eth1</span></p>
</div>
<div><br>
</div>
<div>And on Machine B is this:</div>
<div>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'">[root@mainmachine etc]# route -n</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'">Kernel IP routing table</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'">Destination Gateway Genmask Flags Metric Ref Use Iface</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'">192.168.1.0 0.0.0.0 255.255.255.0 U 1 0 0 eth6</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'">10.1.1.0 192.168.1.1 255.255.255.0 UG 0 0 0 eth6</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'">10.1.2.0 0.0.0.0 255.255.255.0 U 1 0 0 eth5</span></p>
<div style="margin-bottom:0.0001pt"><br>
</div>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'">0.0.0.0 10.1.2.254 0.0.0.0 UG 0 0 0 eth5</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span lang="EN-US" style="font-size:8pt;font-family:'Courier New'"><br>
</span></p>
Aren't those routing tables correct?</div>
<div><br>
</div>
<div>Thanks,</div>
<div><br>
</div>
<div>Kent Davies</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
<div>
<div class="h5">
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Sat, Nov 16, 2013 at 12:12 PM, Pascal Fuks <span dir="ltr">
<<a href="mailto:Pascal@financial-art.be" target="_blank">Pascal@financial-art.be</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">Hello Ana,
<div>You should take care when pinging to make packets come from your "lan" IP.</div>
<div>So </div>
<div>From A:</div>
<div> ping -I 10.1.1.254 10.1.2.254</div>
<div>This should work.</div>
<div><br>
</div>
<div>This is because the IP stack always choose the interface that is the nearest to the destination as normal source for the packet, thus choosing your "public" IP as source. When using -I in ping, you force the source to be in the LeftSubnet...</div>
<div>Regards</div>
<div>
<div>
<div>
<div style="font-family:Calibri,sans-serif;margin:0cm 0cm 0.0001pt;font-size:11pt">
<span lang="EN-US" style="font-size:9pt;color:rgb(80,80,255);font-family:'Lucida Sans Unicode',sans-serif">Pascal Fuks<br>
Network & Security Architect,<br>
CEO / Administrateur délégué,<br>
<br>
</span></div>
<div style="font-family:Calibri,sans-serif;margin:0cm 0cm 0.0001pt;font-size:11pt">
<span lang="EN-US" style="font-size:9pt;color:rgb(80,80,255);font-family:'Lucida Sans Unicode',sans-serif">Tel. :
<a href="tel:%2B32%202%20387%2008%2000" value="+3223870800" target="_blank">+32 2 387 08 00</a><br>
Fax : <a href="tel:%2B32%202%20387%2007%2006" value="+3223870706" target="_blank">
+32 2 387 07 06</a><br>
Email : <a href="mailto:pascal@financial-art.be" style="color:blue" target="_blank">pascal@financial-art.be</a></span></div>
<div style="font-size:16px;margin:0cm 0cm 0.0001pt;font-family:'Times New Roman'">
<font color="#0000FF" face="Lucida Sans Unicode,sans-serif" size="3"><span style="font-size:12px">IM: pascal@financial-art (MSN)<br>
Free/Busy Time : <b><a href="http://www.financialart.be/pfukscal.html" style="color:blue" target="_blank">http://www.financialart.be/pfukscal.html</a></b></span></font></div>
</div>
</div>
<br>
<div>
<div>On 16 Nov 2013, at 12:37, Bart Smink <<a href="mailto:bartsmink@gmail.com" target="_blank">bartsmink@gmail.com</a>> wrote:</div>
<br>
<blockquote type="cite">
<div dir="ltr">
<div>
<div>Hi Kent,<br>
<br>
</div>
Nice images, way better than the usual textart. I think that you need to change virtual private to virtual_private=%v4:<a href="http://0.0.0.0/0,%v6:fd00::/8,%v6:fe80::/10,%v4:!10.1.1.0/24" target="_blank">0.0.0.0/0,%v6:fd00::/8,%v6:fe80::/10,%v4:!10.1.1.0/24</a>
on left and virtual_private=%v4:<a href="http://0.0.0.0/0,%v6:fd00::/8,%v6:fe80::/10,%v4:!10.1.2.0/24" target="_blank">0.0.0.0/0,%v6:fd00::/8,%v6:fe80::/10,%v4:!10.1.2.0/24</a> on right. In ipsec.conf it is normal to have left as the local computer. So the
ipsec.conf on computer B would be left = 192.168.2.1 leftsubnet = <a href="http://10.1.2.0/24" target="_blank">
10.1.2.0/24</a> right = 192.168.1.1 rightsubnet = <a href="http://10.1.1.0/24" target="_blank">
10.1.1.0/24</a> . And I dont use leftnexthop and rightnexthop in my config, and I dont think you need it, it is the next hop to the ISP, so in the direction of the WAN network.<br>
<br>
</div>
Greetings,<br>
<br>
Bart<br>
<div> <br>
</div>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">2013/11/16 Ana <span dir="ltr"><<a href="mailto:kentdavies@gmail.com" target="_blank">kentdavies@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr">
<p class="MsoNormal"><span lang="EN-US">Hi everybody.</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US">I’m starting to learn <b>IPsec</b> and I'm having some problems.</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US">I’m running two virtual machines with CentOS that simulates the network depicted in the bellow picture.</span></p>
<p class="MsoNormal"><span lang="EN-US"><span><image.png></span><br>
</span></p>
<div><span lang="EN-US"><span style="margin-left:101px;margin-top:878px;width:595px;min-height:329px"></span></span><br>
</div>
<div><span lang="EN-US"><span style="margin-left:101px;margin-top:878px;width:595px;min-height:329px"></span></span><br>
</div>
<p class="MsoNormal"><br>
</p>
<p class="MsoNormal"><span lang="EN-US">I want to create an IPsec tunnel between machine A and machine B. The keys should be negotiated using IKE and the tunnel should enable total connectivity between the two machines. </span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US">My <b>ipsec.conf</b> file on both machines is this:</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">config setup</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US"> protostack=netkey</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US"> dumpdir=/var/run/pluto/</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US"> nat_traversal=yes</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US"> virtual_private=%v4:<a href="http://10.1.1.0/24,%v4:10.1.2.0/24" target="_blank">10.1.1.0/24,%v4:10.1.2.0/24</a></span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">conn gw-to-gw</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US"> authby=secret</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US"> left=192.168.1.1</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US"> leftsubnet=<a href="http://10.1.1.0/24" target="_blank">10.1.1.0/24</a></span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US"> leftnexthop=192.168.1.2</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US"> right=192.168.1.2</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US"> rightsubnet=<a href="http://10.1.2.0/24" target="_blank">10.1.2.0/24</a></span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US"> rightnexthop=192.168.1.1</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US"> auto=start</span></p>
<div><br>
</div>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US"> type=tunnel</span></p>
</blockquote>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US">And <b>ipsec.secrets</b> on both machines is this:</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<p class="MsoNormal"><span lang="EN-US"><font face="courier new, monospace">192.168.1.1 192.168.1.2 : PSK "test"</font></span></p>
</blockquote>
<div><span lang="EN-US"> </span><br>
</div>
<p class="MsoNormal"><span lang="EN-US">I then do<b> service ipsec start</b> on machine A followed by the same command on machine B. Then, again on machine A, I do
<b>ipsec auto –up gw-to-gw</b> followed by the exact same command on machine B. </span>
</p>
<p class="MsoNormal"><span lang="EN-US">Machine A output:</span></p>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">[root@mainmachine etc]# service ipsec start</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">ipsec_setup: Starting Openswan IPsec U2.6.32/K2.6.32-358.23.2.el6.i686...</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">ipsec_setup: /usr/libexec/ipsec/addconn Non-fips mode set in /proc/sys/crypto/fips_enabled</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">[root@mainmachine etc]# ipsec auto --up gw-to-gw</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">117 "gw-to-gw" #5: STATE_QUICK_I1: initiate</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">004 "gw-to-gw" #5: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xc17e5cb7 <0xefd31319 xfrm=AES_128-HMAC_SHA1 NATOA=none
NATD=none DPD=none}</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">[root@mainmachine etc]#</span></p>
</blockquote>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><br>
</p>
<p class="MsoNormal"><span lang="EN-US">Machine B output:</span></p>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">[root@mainmachine etc]# service ipsec start</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">ipsec_setup: Starting Openswan IPsec U2.6.32/K2.6.32-358.23.2.el6.i686...</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">ipsec_setup: /usr/libexec/ipsec/addconn Non-fips mode set in /proc/sys/crypto/fips_enabled</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">[root@mainmachine etc]# ipsec auto --up gw-to-gw</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">117 "gw-to-gw" #6: STATE_QUICK_I1: initiate</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">004 "gw-to-gw" #6: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xf5fe7b43 <0x94c97925 xfrm=AES_128-HMAC_SHA1 NATOA=none
NATD=none DPD=none}</span></p>
<p class="MsoNormal" style="margin-bottom:0.0001pt"><span style="font-size:8pt;font-family:'Courier New'" lang="EN-US">[root@mainmachine etc]#</span></p>
</blockquote>
<div><span lang="EN-US"> </span><br>
</div>
<p class="MsoNormal"><span lang="EN-US">I’m now using Wireshark to see how the traffic goes through the network from machine A to machine B.
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US">Listening on interface <b>eth5 </b>of machine B and pinging<b> 10.1.2.254</b> or
<b>10.1.2.2</b> from machine A, Wireshark does not capture any packet. If I do the exact same procedure but not listening on interface
<b>eth6</b> Wireshark captures the following image.</span></p>
<p class="MsoNormal"><span lang="EN-US"><span><33en.jpg></span><br>
</span></p>
<div><span lang="EN-US"> </span><br>
</div>
<p class="MsoNormal"><span lang="EN-US">I believe that the packet should somehow be encrypted but Wireshark is telling me that it is not, so probably I have some kind of error on my
<b>ipsec.conf</b> configuration.</span></p>
<div><span lang="EN-US"> </span><br>
</div>
<p class="MsoNormal"><span lang="EN-US">Can someone point me in some direction?</span></p>
<div><span lang="EN-US"> </span><br>
</div>
<p class="MsoNormal"><span lang="EN-US">Thanks, </span></p>
<div><span lang="EN-US"> </span><br>
</div>
<div><span lang="EN-US"></span><br>
</div>
<p class="MsoNormal"><span lang="EN-US">Kent Davies</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
<p class="MsoNormal"><span lang="EN-US"><br>
</span></p>
</div>
<br>
_______________________________________________<br>
<a href="mailto:Users@lists.openswan.org" target="_blank">Users@lists.openswan.org</a><br>
<a href="https://lists.openswan.org/mailman/listinfo/users" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a><br>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank">
https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
<br>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
<span style="font-family:Calibri,sans-serif;font-size:14px;border-collapse:collapse">**** DISCLAIMER ****<br>
<br>
"This e-mail and any attachment thereto may contain information which is confidential and/or protected by intellectual property rights and are intended for the sole use of the recipient(s) named above. <br>
Any use of the information contained herein (including, but not limited to, total or partial reproduction, communication or distribution in any form) by other persons than the designated recipient(s) is prohibited. <br>
If you have received this e-mail in error, please notify the sender either by telephone or by e-mail and delete the material from any computer".<br>
<br>
Thank you for your cooperation.</span> </div>
_______________________________________________<br>
<a href="mailto:Users@lists.openswan.org" target="_blank">Users@lists.openswan.org</a><br>
<a href="https://lists.openswan.org/mailman/listinfo/users" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a><br>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank">
https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
</blockquote>
</div>
<br>
</div>
<br>
**** DISCLAIMER ****<br>
<br>
"This e-mail and any attachment thereto may contain information which is confidential and/or protected by intellectual property rights and are intended for the sole use of the recipient(s) named above.
<br>
Any use of the information contained herein (including, but not limited to, total or partial reproduction, communication or distribution in any form) by other persons than the designated recipient(s) is prohibited.
<br>
If you have received this e-mail in error, please notify the sender either by telephone or by e-mail and delete the material from any computer".<br>
<br>
Thank you for your cooperation.<br>
<br>
* This e-mail was scanned against known viruses by MDaemon-DKAV</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
<div>
<div class="h5"><br>
**** DISCLAIMER ****<br>
<br>
"This e-mail and any attachment thereto may contain information which is confidential and/or protected by intellectual property rights and are intended for the sole use of the recipient(s) named above.
<br>
Any use of the information contained herein (including, but not limited to, total or partial reproduction, communication or distribution in any form) by other persons than the designated recipient(s) is prohibited.
<br>
If you have received this e-mail in error, please notify the sender either by telephone or by e-mail and delete the material from any computer".<br>
<br>
Thank you for your cooperation.<br>
<br>
* This e-mail was scanned against known viruses by MDaemon-DKAV</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</blockquote>
</div>
<br>
</div>
<br>**** DISCLAIMER ****<br>
<br>
"This e-mail and any attachment thereto may contain information which is confidential and/or protected by intellectual property rights and are intended for the sole use of the recipient(s) named above. <br>
Any use of the information contained herein (including, but not limited to, total or partial reproduction, communication or distribution in any form) by other persons than the designated recipient(s) is prohibited. <br>
If you have received this e-mail in error, please notify the sender either by telephone or by e-mail and delete the material from any computer".<br>
<br>
Thank you for your cooperation.<br>
<br>
* This e-mail was scanned against known viruses by MDaemon-DKAV</body>
</html>