[Openswan Users]

Paul Overton paul at trusted-management.com
Wed Mar 16 12:53:28 CET 2005


This is a real limitation of NAT traversal with openswan, you can only have
one active tunnel per certificate/ip address.

In your case, you can overcome your issues with your LAN/DMZ by having a
single tunnel and then using your firewall code to protect the two adjacent
networks. In this case I would recommend having your LAN and DMZ IP address
ranges adjacent to each other. 

You probably don't actually need a tunnel to your external interface, as you
can probably have the identical services available from your DMZ. In this
case you should use the ipsec up script to give the desired functionality.

You could try using L2TP as over IPsec as an alternative, where you can
route multiple networks over the layer 2 tunnel.

Paul  

-----Original Message-----
From: users-bounces at openswan.org [mailto:users-bounces at openswan.org] On
Behalf Of lux
Sent: 16 March 2005 00:01
To: users at openswan.org
Subject: [Openswan Users]

I am trying to set up an IPSec access between Windows (road warrior) and a
Linux gateway with Openswan.

My setup (the public IP addresses were changed with IPs from the 10.0.0.0
and 172.16.0.0 private networks):

     192.168.1.254   10.0.0.2
                =======
===================
LAN-------------GATEWAY==================IPSec tunnel========Windows
roadwarrior
                =======
===================
                   | 192.168.100.254
                   |
                   |
                   |
                   |
                  DMZ


On the gateway I have Fedora Core 3 with Openswan 2.3.0, native IPSec.

As long as I use only one tunnel of the 3 defined (for example I ping the
gateway on 10.0.0.2), everything seems to work fine.
But when the second tunnel comes up (for example I ping 192.168.100.254),
the first tunnel is shut down. After a while (seconds) the second tunnel is
shut down, and the first returns up. After another while, the first goes
down and the second comes up and so on. After some of this transitions, the
second tunnel (the one to the dmz, for example) stays up and the first stays
down.
It seems that there can be only one tunnel at a time between the road
warrior pc and 10.0.0.2.
Is this a real limitation? Can I circumvent it?

The config is:

config setup
        nat_traversal=yes
       
virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192
.168.2.0/24,%v4:!192.168.15.128/25

conn %default
        keyingtries=1
        compress=no
        authby=rsasig
        leftrsasigkey=%cert
        rightrsasigkey=%cert

conn roadwarrior-net
        leftsubnet=192.168.1.0/255.255.255.0
        also=roadwarrior

conn roadwarrior-dmz
        leftsubnet=192.168.100.0/24
        also=roadwarrior

conn roadwarrior
        left=10.0.0.2
        leftcert=server.pem
        leftnexthop=10.0.0.1
        right=%any
        rightsubnet=vhost:%no,%priv
        rightcert=lux.pem
        auto=add
        pfs=yes

#Disable Opportunistic Encryption
include /etc/ipsec.d/examples/no_oe.conf



On the Windows machine I have Windows 2000 . I'm usign the ipsec.exe utility
from Marcus Mueller, with the following config:

conn roadwarrior
	left=%any
	right=10.0.0.2
	rightca="C=IT,S=XX,L=XXXXXX,O=Company inc.,CN=Company inc.
CA,Email=info at domain.com"
	network=auto
	auto=start
	pfs=yes

conn dmz
	left=%any
	right=10.0.0.2
	rightsubnet=192.168.100.0/255.255.255.0
	rightca="C=IT,S=XX,L=XXXXXX,O=Company inc.,CN=Company inc.
CA,Email=info at domain.com"
	network=auto
	auto=start
	pfs=yes

conn net
	left=%any
	right=10.0.0.2
	rightsubnet=192.168.1.0/255.255.255.0
	rightca="C=IT,S=XX,L=XXXXXX,O=Company inc.,CN=Company inc.
CA,Email=info at domain.com"
	network=auto
	auto=start
	pfs=yes

I also tried using Windows XP SP2 (updated ipseccmd.exe) with the same
results.

Here is the pluto log (notice the "deleting" and "SA established" lines):

Mar 15 11:08:57 mail pluto[24382]: packet from 172.16.1.1:500: ignoring
Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004] Mar 15 11:08:57 mail
pluto[24382]: packet from 172.16.1.1:500: ignoring Vendor ID payload
[FRAGMENTATION] Mar 15 11:08:57 mail pluto[24382]: packet from
172.16.1.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
method set to=106 Mar 15 11:08:57 mail pluto[24382]: packet from
172.16.1.1:500: ignoring Vendor ID payload [Vid-Initial-Contact] Mar 15
11:08:57 mail pluto[24382]: "roadwarrior"[1] 172.16.1.1 #1: responding to
Main Mode from unknown peer 172.16.1.1 Mar 15 11:08:57 mail pluto[24382]:
"roadwarrior"[1] 172.16.1.1 #1: transition from state STATE_MAIN_R0 to state
STATE_MAIN_R1 Mar 15 11:08:57 mail pluto[24382]: "roadwarrior"[1] 172.16.1.1
#1:
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
Mar 15 11:08:57 mail pluto[24382]: "roadwarrior"[1] 172.16.1.1 #1:
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 Mar 15 11:08:58
mail pluto[24382]: "roadwarrior"[1] 172.16.1.1 #1: Main mode peer ID is
ID_DER_ASN1_DN: 'C=IT, ST=XX, L=XXXXXX, O=Company inc., CN=lux,
E=info at domain.com'
Mar 15 11:08:58 mail pluto[24382]: "roadwarrior"[1] 172.16.1.1 #1: I am
sending my cert Mar 15 11:08:58 mail pluto[24382]: "roadwarrior"[1]
172.16.1.1 #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Mar 15 11:08:58 mail pluto[24382]: | NAT-T: new mapping
172.16.1.1:500/33863) Mar 15 11:08:58 mail pluto[24382]: "roadwarrior"[1]
172.16.1.1:33863 #1: sent MR3, ISAKMP SA established Mar 15 11:08:58 mail
pluto[24382]: "roadwarrior"[1] 172.16.1.1:33863 #2:
responding to Quick Mode
Mar 15 11:08:58 mail pluto[24382]: "roadwarrior"[1] 172.16.1.1:33863 #2:
transition from state STATE_QUICK_R0 to state STATE_QUICK_R1 Mar 15 11:08:58
mail pluto[24382]: "roadwarrior"[1] 172.16.1.1:33863 #2:
transition from state STATE_QUICK_R1 to state STATE_QUICK_R2 Mar 15 11:08:58
mail pluto[24382]: "roadwarrior"[1] 172.16.1.1:33863 #2: IPsec SA
established {ESP/NAT=>0xf7cae962 <0x78e24bfd NATOA=0.0.0.0} Mar 15 11:09:30
mail pluto[24382]: packet from 172.16.1.1:500: ignoring Vendor ID payload
[MS NT5 ISAKMPOAKLEY 00000004] Mar 15 11:09:30 mail pluto[24382]: packet
from 172.16.1.1:500: ignoring Vendor ID payload [FRAGMENTATION] Mar 15
11:09:30 mail pluto[24382]: packet from 172.16.1.1:500: received Vendor ID
payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106 Mar 15 11:09:30
mail pluto[24382]: packet from 172.16.1.1:500: ignoring Vendor ID payload
[Vid-Initial-Contact] Mar 15 11:09:30 mail pluto[24382]: "roadwarrior"[2]
172.16.1.1 #3: responding to Main Mode from unknown peer 172.16.1.1 Mar 15
11:09:30 mail pluto[24382]: "roadwarrior"[2] 172.16.1.1 #3: transition from
state STATE_MAIN_R0 to state STATE_MAIN_R1 Mar 15 11:09:30 mail
pluto[24382]: "roadwarrior"[2] 172.16.1.1 #3:
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
Mar 15 11:09:30 mail pluto[24382]: "roadwarrior"[2] 172.16.1.1 #3:
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 Mar 15 11:09:31
mail pluto[24382]: "roadwarrior"[2] 172.16.1.1 #3: Main mode peer ID is
ID_DER_ASN1_DN: 'C=IT, ST=XX, L=XXXXXX, O=Company inc., CN=lux,
E=info at domain.com'
Mar 15 11:09:31 mail pluto[24382]: "roadwarrior"[2] 172.16.1.1 #3: I am
sending my cert Mar 15 11:09:31 mail pluto[24382]: "roadwarrior"[2]
172.16.1.1 #3: deleting connection "roadwarrior" instance with peer
172.16.1.1 {isakmp=#1/ipsec=#2} Mar 15 11:09:31 mail pluto[24382]:
"roadwarrior" #2: deleting state
(STATE_QUICK_R2)
Mar 15 11:09:31 mail pluto[24382]: "roadwarrior" #1: deleting state
(STATE_MAIN_R3)
Mar 15 11:09:31 mail pluto[24382]: "roadwarrior"[2] 172.16.1.1 #3:
transition from state STATE_MAIN_R2 to state STATE_MAIN_R3 Mar 15 11:09:31
mail pluto[24382]: | NAT-T: new mapping 172.16.1.1:500/33863) Mar 15
11:09:31 mail pluto[24382]: "roadwarrior"[2] 172.16.1.1:33863 #3: sent MR3,
ISAKMP SA established Mar 15 11:09:31 mail pluto[24382]:
"roadwarrior-dmz"[1] 172.16.1.1:33863 #4:
responding to Quick Mode
Mar 15 11:09:31 mail pluto[24382]: "roadwarrior-dmz"[1] 172.16.1.1:33863 #4:
transition from state STATE_QUICK_R0 to state STATE_QUICK_R1 Mar 15 11:09:31
mail pluto[24382]: "roadwarrior-dmz"[1] 172.16.1.1:33863 #4:
transition from state STATE_QUICK_R1 to state STATE_QUICK_R2 Mar 15 11:09:31
mail pluto[24382]: "roadwarrior-dmz"[1] 172.16.1.1:33863 #4:
IPsec SA established {ESP/NAT=>0xeddfcd30 <0x421c2a0c NATOA=0.0.0.0} Mar 15
11:11:13 mail pluto[24382]: "roadwarrior"[2] 172.16.1.1:33863 #3:
received Delete SA payload: deleting ISAKMP State #3 Mar 15 11:11:13 mail
pluto[24382]: "roadwarrior"[2] 172.16.1.1:33863: deleting connection
"roadwarrior" instance with peer 172.16.1.1 {isakmp=#0/ipsec=#0} Mar 15
11:11:13 mail pluto[24382]: packet from 172.16.1.1:33863: received and
ignored informational message Mar 15 11:11:24 mail pluto[24382]: packet from
172.16.1.1:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
Mar 15 11:11:24 mail pluto[24382]: packet from 172.16.1.1:500: ignoring
Vendor ID payload [FRAGMENTATION] Mar 15 11:11:24 mail pluto[24382]: packet
from 172.16.1.1:500: received Vendor ID payload
[draft-ietf-ipsec-nat-t-ike-02_n] method set to=106 Mar 15 11:11:24 mail
pluto[24382]: packet from 172.16.1.1:500: ignoring Vendor ID payload
[Vid-Initial-Contact] Mar 15 11:11:24 mail pluto[24382]: "roadwarrior"[3]
172.16.1.1 #5: responding to Main Mode from unknown peer 172.16.1.1 Mar 15
11:11:24 mail pluto[24382]: "roadwarrior"[3] 172.16.1.1 #5: transition from
state STATE_MAIN_R0 to state STATE_MAIN_R1 Mar 15 11:11:24 mail
pluto[24382]: "roadwarrior"[3] 172.16.1.1 #5:
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
Mar 15 11:11:24 mail pluto[24382]: "roadwarrior"[3] 172.16.1.1 #5:
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 Mar 15 11:11:24
mail pluto[24382]: "roadwarrior"[3] 172.16.1.1 #5: Main mode peer ID is
ID_DER_ASN1_DN: 'C=IT, ST=XX, L=XXXXXX, O=Company inc., CN=lux,
E=info at domain.com'
Mar 15 11:11:24 mail pluto[24382]: "roadwarrior"[3] 172.16.1.1 #5: I am
sending my cert Mar 15 11:11:24 mail pluto[24382]: "roadwarrior"[3]
172.16.1.1 #5: deleting connection "roadwarrior-dmz" instance with peer
172.16.1.1 {isakmp=#0/ipsec=#4} Mar 15 11:11:24 mail pluto[24382]:
"roadwarrior-dmz" #4: deleting state
(STATE_QUICK_R2)
Mar 15 11:11:24 mail pluto[24382]: "roadwarrior"[3] 172.16.1.1 #5:
transition from state STATE_MAIN_R2 to state STATE_MAIN_R3 Mar 15 11:11:24
mail pluto[24382]: | NAT-T: new mapping 172.16.1.1:500/33863) Mar 15
11:11:24 mail pluto[24382]: "roadwarrior"[3] 172.16.1.1:33863 #5: sent MR3,
ISAKMP SA established Mar 15 11:11:25 mail pluto[24382]: "roadwarrior"[3]
172.16.1.1:33863 #6:
responding to Quick Mode
Mar 15 11:11:25 mail pluto[24382]: "roadwarrior"[3] 172.16.1.1:33863 #6:
transition from state STATE_QUICK_R0 to state STATE_QUICK_R1 Mar 15 11:11:26
mail pluto[24382]: "roadwarrior"[3] 172.16.1.1:33863 #6:
transition from state STATE_QUICK_R1 to state STATE_QUICK_R2 Mar 15 11:11:26
mail pluto[24382]: "roadwarrior"[3] 172.16.1.1:33863 #6: IPsec SA
established {ESP/NAT=>0xbe59a09f <0x25de535f NATOA=0.0.0.0}
_______________________________________________
Users mailing list
Users at openswan.org
http://lists.openswan.org/mailman/listinfo/users

--
This message has been scanned for viruses and dangerous content by
MailScanner, and is believed to be clean.
MailScanner thanks transtec Computers for their support.




More information about the Users mailing list