Dotaz: ipsec na ppp0

[Igor]

Zdravim

Mam adsl modem v rezimu bridge a centos 4.4, ktery dostane verejnou ip na ppp0. Vse funguje, jak ma, ale ne tak ipsec. V logu stroje s ppp0 je videt, ze si mysli, ze ma ipsec svazat s interfacem eth, ke kteremu je pripojen adsl modem (neverejna ip adresa) a ne s ppp0.

Protejsek je taky centos 4.4 s verejnou ip primo na eth a s jinym strojem s verejnou ip na eth zridi funkcni ipsec bez problemu.

Setkal se nekdo s necim takovym ? Nemuzu nikde nic najit. Jak z toho ven ?

Diky

Dec 20 01:04:21 gate1 racoon: INFO: IPsec-SA request for A.B.C.D queued due to no phase1 found.
Dec 20 01:04:21 gate1 racoon: INFO: initiate new phase 1 negotiation: 192.168.57.45[500]<=>A.B.C.D[500]
Dec 20 01:04:21 gate1 racoon: INFO: begin Aggressive mode.
Dec 20 01:04:23 gate1 racoon: NOTIFY: couldn't find the proper pskey, try to get one by the peer's address.
Dec 20 01:04:23 gate1 racoon: INFO: ISAKMP-SA established 192.168.57.45[500]-A.B.C.D[500] spi:cosi:kdesi
Dec 20 01:04:24 gate1 racoon: INFO: initiate new phase 2 negotiation: 192.168.57.45[0]<=>A.B.C.D[0]
Dec 20 01:04:27 gate1 racoon: INFO: IPsec-SA established: AH/Tunnel A.B.C.D->192.168.57.45 spi=....
Dec 20 01:04:27 gate1 racoon: INFO: IPsec-SA established: ESP/Tunnel A.B.C.D->192.168.57.45 spi=....
Dec 20 01:04:27 gate1 racoon: INFO: IPsec-SA established: AH/Tunnel 192.168.57.45->A.B.C.D spi=....
Dec 20 01:04:27 gate1 racoon: INFO: IPsec-SA established: ESP/Tunnel 192.168.57.45->A.B.C.D spi=....

Odpovědi

[Michal Kubeček]

Co vám ukáže 'ip route get A.B.C.D'? Jak nastavujete SPD?

[Michal Kubeček]

Možná by pomohlo nechat racoon poslouchat jen na správné adrese:

  listen {
    isakmp E.F.G.H [500];
    strict_address;
  }

[Igor]

Dekuji za odezvu. Ja jsem tam nakonec dal half-bridge adsl modem a mam verejnou ip na eth. Po vanocich se na to podivam a zkusim to odreportovat.

[Igor]

Tak problem se nedari reprodukovat. Konstatuji, ze ipsec na ppp0 chodi pod Centosem 4.4 bez problemu. Asi tedy PEBKAC :)