[Openswan Users] "IPsec SA established" but ESP onlt in one
paul at xelerance.com
Fri Aug 27 16:53:27 CEST 2004
On Fri, 27 Aug 2004, Jacco de Leeuw wrote:
>> The SPI number of ESP traffic coming from NAT'ted XP box
>> is ALWAYS 0x11941194.
> Hm. Odd.
>> Is it possible that such identifier does not match with the
>> onr ipec is waiting for?
> I guess you should see error messages rejecting these packets then.
Only with klipsdebug enabled. Otherwise it would be a trivial DOS.
>> I think the fu***** router mangles the ESP packets changing the ESP number.
>> So this is a router problem, not a configuration problem.
Looks like it. What router/device is this? Can you add this to the Wiki?
More information about the Users