Dotaz: IPSEC + debian kernel 2.6.33.3

[ubka7617]

Dobry den z dovodu update HW som musel prekompilovat jadro a odvtedy mi nadviaze tunelale nevie vez neho smerovat ziadne data.

May 7 15:05:39 s-1800-01 racoon: INFO: @(#)ipsec-tools 0.7.1 (http://ipsec-tools.sourceforge.net) May 7 15:05:39 s-1800-01 racoon: INFO: @(#)This product linked OpenSSL 0.9.8c 05 Sep 2006 (http://www.openssl.org/) May 7 15:05:39 s-1800-01 racoon: INFO: Reading configuration from "/etc/racoon/racoon.conf" May 7 15:05:39 s-1800-01 racoon: INFO: Resize address pool from 0 to 255 May 7 15:05:39 s-1800-01 racoon: WARNING: /etc/racoon/racoon.conf:16: "552" Your kernel does not support esp_frag May 7 15:05:39 s-1800-01 racoon: NOTIFY: NAT-T is enabled, autoconfiguring ports May 7 15:05:39 s-1800-01 racoon: INFO: 127.0.0.1[500] used as isakmp port (fd=7) May 7 15:05:39 s-1800-01 racoon: INFO: 127.0.0.1[500] used for NAT-T May 7 15:05:39 s-1800-01 racoon: INFO: 127.0.0.1[4500] used as isakmp port (fd=8) May 7 15:05:39 s-1800-01 racoon: INFO: 127.0.0.1[4500] used for NAT-T May 7 15:05:39 s-1800-01 racoon: INFO: 10.0.0.1[500] used as isakmp port (fd=9) May 7 15:05:39 s-1800-01 racoon: INFO: 10.0.0.1[500] used for NAT-T May 7 15:05:39 s-1800-01 racoon: INFO: 10.0.0.1[4500] used as isakmp port (fd=10) May 7 15:05:39 s-1800-01 racoon: INFO: 10.0.0.1[4500] used for NAT-T May 7 15:05:39 s-1800-01 racoon: INFO: 10.23.8.254[500] used as isakmp port (fd=11) May 7 15:05:39 s-1800-01 racoon: INFO: 10.23.8.254[500] used for NAT-T May 7 15:05:39 s-1800-01 racoon: INFO: 10.23.8.254[4500] used as isakmp port (fd=12) May 7 15:05:39 s-1800-01 racoon: INFO: 10.23.8.254[4500] used for NAT-T May 7 15:05:39 s-1800-01 racoon: INFO: 10.23.8.1[500] used as isakmp port (fd=13) May 7 15:05:39 s-1800-01 racoon: INFO: 10.23.8.1[500] used for NAT-T May 7 15:05:39 s-1800-01 racoon: INFO: 10.23.8.1[4500] used as isakmp port (fd=14) May 7 15:05:39 s-1800-01 racoon: INFO: 10.23.8.1[4500] used for NAT-T May 7 15:05:39 s-1800-01 racoon: INFO: ::1[500] used as isakmp port (fd=15) May 7 15:05:39 s-1800-01 racoon: INFO: ::1[4500] used as isakmp port (fd=16) May 7 15:05:39 s-1800-01 racoon: INFO: fe80::222:19ff:fe05:209b%eth0[500] used as isakmp port (fd=17) May 7 15:05:39 s-1800-01 racoon: INFO: fe80::222:19ff:fe05:209b%eth0[4500] used as isakmp port (fd=18) May 7 15:05:39 s-1800-01 racoon: INFO: fe80::8cf4:b4ff:fe57:6837%vpn[500] used as isakmp port (fd=19) May 7 15:05:39 s-1800-01 racoon: INFO: fe80::8cf4:b4ff:fe57:6837%vpn[4500] used as isakmp port (fd=20) May 7 15:05:39 s-1800-01 racoon: INFO: accept a request to establish IKE-SA: xxx.xxx.xxx.xxx May 7 15:05:39 s-1800-01 racoon: INFO: initiate new phase 1 negotiation: 10.0.0.1[500]<=>xxx.xxx.xxx.xxx[500] May 7 15:05:39 s-1800-01 racoon: INFO: begin Base mode. May 7 15:05:39 s-1800-01 racoon: INFO: received Vendor ID: RFC 3947 May 7 15:05:39 s-1800-01 racoon: INFO: received Vendor ID: DPD May 7 15:05:39 s-1800-01 racoon: INFO: received broken Microsoft ID: FRAGMENTATION May 7 15:05:39 s-1800-01 racoon: INFO: Selected NAT-T version: RFC 3947 May 7 15:05:39 s-1800-01 racoon: NOTIFY: couldn't find the proper pskey, try to get one by the peer's address. May 7 15:05:39 s-1800-01 racoon: INFO: Adding remote and local NAT-D payloads. May 7 15:05:39 s-1800-01 racoon: INFO: Hashing xxx.xxx.xxx.xxx[500] with algo #2 (NAT-T forced) May 7 15:05:39 s-1800-01 racoon: INFO: Hashing 10.0.0.1[500] with algo #2 (NAT-T forced) May 7 15:05:40 s-1800-01 racoon: INFO: received Vendor ID: IPSec-Tools May 7 15:05:40 s-1800-01 racoon: INFO: NAT-D payload #0 doesn't match May 7 15:05:40 s-1800-01 racoon: INFO: NAT-D payload #1 doesn't match May 7 15:05:40 s-1800-01 racoon: INFO: NAT detected: ME PEER May 7 15:05:40 s-1800-01 racoon: INFO: KA list add: 10.0.0.1[4500]->xxx.xxx.xxx.xxx[4500] May 7 15:05:40 s-1800-01 racoon: INFO: ISAKMP-SA established 10.0.0.1[4500]-xxx.xxx.xxx.xxx[4500] spi:9abd9eca1a1e6a4e:404e7c098a1e278d

Dakujem za pomoc.

Odpovědi

[Michal Kubeček]

Ten výpis (hint: element pre je váš kamarád) končí "SA established", takže tam problém asi nebude. Doporučuji začít porovnáním konfigurace původního a nového jádra.

[NN]

Ja tady vidim:

WARNING: /etc/racoon/racoon.conf:16: "552" Your kernel does not support esp_frag

NN

[ubka7617]

to esp_frag som nasiel ze treba nastavit aj podporu IPV6, ale ani to mi nepomohlo, zrejme bude treba neaky patch na kernel

[ubka7617]

Příloha:

• config (62642 bytů)

to esp_frag som nasiel ze treba nastavit aj podporu IPV6, ale ani to mi nepomohlo, zrejme bude treba neaky patch na kernel. Na starom jadre mi to slo v pohode ale nepoznal HW. Takze to bude najskor konfiguraciou. Posielam config kernelu.

[Michal Kubeček]

Spíš si místo posílání porovnejte ty dvě konfigurace mezi sebou, jak už jsem vám radil včera.

[ubka7617]

konfig je rovnaky, jedine co je naviac je podpora 3 sietovych kariet. Pretym som mal jadro 2.6.28.10

[vencour]

Souhlasím s ostatními, racoon má podle všeho chtít podporu IPv6. (V googlu jsem hledal "esp_frag linux kernel ipsec", byl to 4. odkaz.)

Jinak, ono to "čtení" programátorských hlášek je občas všelijaké, to že něco nevidí dobře, může znamenat i to, že to tam vůbec neni, nejen, že je to menší/větší.

[ubuntak]

ve tvem configu jadra sem nasel

# CONFIG_IPV6_TUNNEL is not set
# CONFIG_IPV6_MULTIPLE_TABLES is not set
# CONFIG_IPV6_MROUTE is not set

nevim racoon sem zatim nerozjizdel, ale dodal bych do jadra IPV6_TUNNEL treba to pomuze.

[ubka7617]

skusal som ale nepomohlo