Administrace komentářů

ping -c1 -W1 -w1 -B -nr -v 192.168.1.21
PING 192.168.1.21 (192.168.1.21) from 192.168.1.20 : 56(84) bytes of data.

--- 192.168.1.21 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

Nov 19 20:22:27 x racoon: INFO: Reading configuration from "/etc/racoon/racoon.conf"
Nov 19 20:22:29 x racoon: INFO: Resize address pool from 0 to 255
Nov 19 20:22:29 x racoon: INFO: 127.0.0.1[500] used as isakmp port (fd=7)
Nov 19 20:22:29 x racoon: INFO: 127.0.0.1[500] used for NT-T
Nov 19 20:22:29 x racoon: INFO: 192.168.1.20[500] used as isakmp port (fd=8)
Nov 19 20:22:29 x racoon: INFO: 192.168.1.20[500] used for NAT-T
Nov 19 20:22:29 x racoon: INFO: ::1[500] used as isakmp port (fd=9)
Nov 19 20:22:29 x racoon: INFO: fe80::216:3eff:fe34:56fb%eth0[500] used as isakmp port (fd=10)
Nov 19 20:22:33 x racoon: INFO: IPsec-SA request for 192.168.1.21 queued due to no phase1 found.
Nov 19 20:22:33 x racoon: INFO: initiate new phase 1 negotiation: 192.168.1.20[500]<=>192.168.1.21[500]
Nov 19 20:22:33 x racoon: INFO: begin Identity Protection mode.
Nov 19 20:22:59 x racoon: ERROR: phase2 negotiation failed due to time up waiting for phase1. ESP 192.168.1.21[0]->192.168.1.20[0] 
Nov 19 20:22:59 x racoon: INFO: delete phase 2 handler.

spdadd 192.168.1.20 192.168.1.21 any -P out ipsec

  esp/transport//require

  ah/transport//require;

 

spdadd 192.168.1.21 192.168.1.20 any -P in ipsec

  esp/transport//require

  ah/transport//require;


racoon.conf:
remote 192.168.1.21 {
        exchange_mode main;
	certificate_type x509 "x.pem" "x.private.pem";
        my_identifier asn1dn;
        peers_identifier asn1dn;
        proposal_check obey;
        verify_cert on;
        generate_policy on;
	peers_certfile x509 "peer.pem";
        lifetime time 79 min;
        proposal {
                encryption_algorithm 3des;
                hash_algorithm sha1;
                authentication_method rsasig;
                dh_group modp1024;
        }
        generate_policy off;
}
 
sainfo address 192.168.1.20 any address 192.168.1.21 any {
        pfs_group modp768;
        lifetime time 85 min;
        encryption_algorithm 3des;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
}