Administrace komentářů

Dobry den,

snazim se propojit dve LAN site do VPN pomoci nativni implementace IPSEC v jadrech 2.6 - tedy pomoci setkey a racoon. Avsak nekde v konfiguraci nastala chyba, protoze pri pokusu o ping z jedne site do druhe se racoon ani nepokusi spojit.

Sit vypada takto: 172.16.2.xx/24 <--> brana 172.16.2.254 s verejnou IP [ip-1] <--> internet <--> brana 172.16.0.1 s verejnou IP [ip-2] <--> sit 172.16.0.xx/24

Setkey jsem nakonfiguroval na stroji s [ip-1] takto:

spdadd 172.16.0.0/24 172.16.2.0/24 any -P in ipsec
       esp/transport/[ip-2]-[ip-1]/require
       ah/transport/[ip-2]-[ip-1]/require;

spdadd 172.16.2.0/24 172.16.0.0/24 any -P out ipsec
       esp/transport/[ip-1]-[ip-2]/require
       ah/transport/[ip-1]-[ip-2]/require;

Na druhe brane je konfigurace obdobna, ale se zamenenim in za out a naopak.

A racoon je nakonfigurovan takto:

...

remote 217.11.242.73
{
        exchange_mode main;
        my_identifier address [ip-1];
        peers_identifier address [ip-2];
        generate_policy on;

        proposal {
                encryption_algorithm 3des;
                hash_algorithm sha1;
                authentication_method pre_shared_key;
                dh_group 5;
        }
}

...

Po spusteni racoon v debug-modu a po pokusu o ping z brany 1 na IP adresu 172.16.0.1 vsak dojde ke smerovani pozadavku nikoliv zasifrovane po VPN siti, ale do internetu. Vystum racoonu vypada takto:

2007-09-13 12:16:24: INFO: @(#)ipsec-tools 0.6.6 (http://ipsec-tools.sourceforge.net)
2007-09-13 12:16:24: INFO: @(#)This product linked OpenSSL 0.9.8e 23 Feb 2007 (http://www.openssl.org/)
2007-09-13 12:16:24: DEBUG: call pfkey_send_register for AH
2007-09-13 12:16:24: DEBUG: call pfkey_send_register for ESP
2007-09-13 12:16:24: DEBUG: call pfkey_send_register for IPCOMP
2007-09-13 12:16:24: DEBUG: reading config file /etc/racoon.conf
2007-09-13 12:16:24: DEBUG: compression algorithm can not be checked because sadb message doesn't support it.
2007-09-13 12:16:24: DEBUG: filename: /etc/racoon/belgicka-omnicon-vpn.conf
2007-09-13 12:16:24: DEBUG: reading config file /etc/racoon/belgicka-omnicon-vpn.conf
2007-09-13 12:16:24: INFO: 10.0.0.2[4500] used as isakmp port (fd=5)
2007-09-13 12:16:24: INFO: 10.0.0.2[4500] used for NAT-T
2007-09-13 12:16:24: INFO: 10.0.0.2[500] used as isakmp port (fd=7)
2007-09-13 12:16:24: INFO: 10.0.0.2[500] used for NAT-T
2007-09-13 12:16:24: DEBUG: get pfkey X_SPDDUMP message
2007-09-13 12:16:24: DEBUG: get pfkey X_SPDDUMP message
2007-09-13 12:16:24: DEBUG: sub:0x7fa2da70: 172.16.2.0/24[0] 172.16.0.0/24[0] proto=any dir=out
2007-09-13 12:16:24: DEBUG: db :0x4b1210: 172.16.0.0/24[0] 172.16.2.0/24[0] proto=any dir=in
2007-09-13 12:16:24: DEBUG: get pfkey X_SPDDUMP message
2007-09-13 12:16:24: DEBUG: sub:0x7fa2da70: 172.16.0.0/24[0] 172.16.2.0/24[0] proto=any dir=fwd
2007-09-13 12:16:24: DEBUG: db :0x4b1210: 172.16.0.0/24[0] 172.16.2.0/24[0] proto=any dir=in
2007-09-13 12:16:24: DEBUG: sub:0x7fa2da70: 172.16.0.0/24[0] 172.16.2.0/24[0] proto=any dir=fwd
2007-09-13 12:16:24: DEBUG: db :0x4b1a78: 172.16.2.0/24[0] 172.16.0.0/24[0] proto=any dir=out

Mohl by byt tedy problem v nastaveni smerovani nebo v konfiguraci setkey / racoonu. Za kazdou radu budu velmi rad a predem dekuji!

S pozdravem,

Marek Siller