[Openswan Users] Openswan+NetScreen - Phase1+Phase2 Ok - No route - Traffic filtered in ISP
Alejandro Alfonso
alejandro.alfonso at telecyl.com
Wed Jan 30 05:32:01 EST 2008
Hello!
I'm new in OpenSwan, and i'm trying to get connection a Linux Box (pppoe
as leftid) and Netscreen on the other side
Phase 1 and Phase 2 seems to be allright
wells ~ # ipsec auto --up myconn
112 "myconn" #1: STATE_AGGR_I1: initiate
003 "myconn" #1: ignoring unknown Vendor ID payload
[85f41d68c72215a39fdc9358a3a3fbfae48d09690000000e00000500]
003 "myconn" #1: ignoring Vendor ID payload [HeartBeat Notify 386b0100]
004 "myconn" #1: STATE_AGGR_I2: sent AI2, ISAKMP SA established
{auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha
group=modp1024}
117 "myconn" #2: STATE_QUICK_I1: initiate
003 "myconn" #2: ignoring informational payload, type
IPSEC_RESPONDER_LIFETIME
004 "myconn" #2: STATE_QUICK_I2: sent QI2, IPsec SA established
{ESP=>0x7d72da83 <0x304bd4a9 xfrm=3DES_0-HMAC_SHA1 NATD=none DPD=none}
Here is my configuration:
conn myconn
auto=add
left=88.YYY.YYY.95
leftid=88.YYY.YYY.95
leftsubnet=192.168.1.0/24
right=XXX.143.XXX.XXX
rightid=XXX.143.XXX.XXX
rightsubnet=192.168.8.4/32
type=tunnel
# phase1
authby=secret
ike=3des-sha1-modp1024
# phase2
esp=3des-sha1
rekey=yes
pfs=yes
aggrmode=yes
compress=no
When i do "ping" to rightid: 192.168.8.4/32
wells ~ # ping 192.168.8.4
PING 192.168.8.4 (192.168.8.4) 56(84) bytes of data.
>From 192.168.153.1 icmp_seq=1 Packet filtered
>From 192.168.153.1 icmp_seq=2 Packet filtered
As you see... its no using IPSec tunnel, and ISP drop ClassB traffic
Do I have forgotten any step? As there's no ipsec0 device (linux 2.6
kernel, netkey)... how to get routing traffic throw IPSec? Routes are
managed from "route" / "ip route" or i should use "ipsec eroute"? In
config setup i have an "interfaces="ipsec0=ppp0"" line
Thanks in advance
Best Regards!
Pd.
==========
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use
Iface
172.XXX.8.XXX 192.168.79.1 255.255.255.255 UGH 0 0 0 eth1
172.XXX.6.XXX 192.168.79.1 255.255.255.255 UGH 0 0 0 eth1
192.168.8.4 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0
172.XXX.6.XXX 192.168.79.1 255.255.255.255 UGH 0 0 0 eth1
192.168.71.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
192.168.79.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.218.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
191.100.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 88.YYY.YYY.95 0.0.0.0 UG 0 0 0 ppp0
==========
wells ~ # ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.4.9/K2.6.22-Wells04 (netkey)
Checking for IPsec support in kernel [OK]
NETKEY detected, testing for disabled ICMP send_redirects [OK]
NETKEY detected, testing for disabled ICMP accept_redirects [OK]
Checking for RSA private key (/etc/ipsec/ipsec.secrets) [DISABLED]
ipsec showhostkey: no default key in "/etc/ipsec/ipsec.secrets"
Checking that pluto is running [OK]
Two or more interfaces found, checking IP forwarding [OK]
Checking NAT and MASQUERADEing
Checking for 'ip' command [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.openswan.org/pipermail/users/attachments/20080130/abf6aa3f/attachment-0001.html
More information about the Users
mailing list