>ipsec.conf в студию... Ставлю vpn между cisco pix5E и freebsd 7...
Файл /etc/ipsec.conf
flush;
spdflush;
spdadd 192.168.2.0/24 192.168.3.0/30 any -P out ipsec esp/tunnel/A.B.C.D-E.F.G.H/require;
spdadd 192.168.3.0/30 192.168.2.0/24 any -P in ipsec esp/tunnel/E.F.G.H-A.B.C.D/require;
spdadd 192.168.2.0/24 192.168.0.0/22 any -P out ipsec esp/tunnel/A.B.C.D-E.F.G.H/require;
spdadd 192.168.0.0/22 192.168.2.0/24 any -P in ipsec esp/tunnel/E.F.G.H-A.B.C.D/require;
Файл /etc/rc.conf :
ipsec_enable="YES"
ipsec_file="/etc/ipsec.conf"
racoon_enable="YES"
racoon_flags="-l /var/log/racoon"
gif_interfaces="gif0"
ifconfig_gif0="inet 192.168.2.1 192.168.3.1 netmask 255.255.255.255"
gifconfig_gif0="A.B.C.D E.F.G.H"
static_routes="pix office"
route_pix="-net 192.168.3.0/30 192.168.3.1"
route_office="-net 192.168.0.0/22 192.168.3.254"
В /etc/rc.firewall добавлены следующие правила:
${fwcmd} add allow all from any to any ipsec
# IPSEC
${fwcmd} add pass udp from ${oip} to ${office} 500
${fwcmd} add pass udp from ${office} to ${oip} 500
${fwcmd} add allow esp from ${office} to ${oip}
${fwcmd} add allow esp from ${oip} to ${office}
${fwcmd} add allow ipencap from ${office} to ${oip}
${fwcmd} add allow ipencap from ${oip} to ${office}
${fwcmd} add allow tcp from ${office} to ${oip} 500 setup
Файл psk.txt заполнен правильно и права 0600
Файл racoon.conf
# $KAME: racoon.conf.in,v 1.18 2001/08/16 06:33:40 itojun Exp $
path include "/usr/local/etc/racoon";
path pre_shared_key "/usr/local/etc/racoon/psk.txt";
log debug;
# "padding" defines some padding parameters. You should not touch these.
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
# if no listen directive is specified, racoon will listen on all
# available interface addresses.
listen
{
isakmp 213.170.75.82 [500];
}
# Specify various default timers.
timer
{
# These value can be changed per remote node.
counter 5; # maximum trying count to send.
interval 20 sec; # maximum interval to resend.
persend 1; # the number of packets per send.
# maximum time to wait for completing each phase.
phase1 30 sec;
phase2 15 sec;
}
remote anonymous
{
exchange_mode main,aggressive;
lifetime time 60 min;
doi ipsec_doi;
situation identity_only;
my_identifier address;
nonce_size 16;
initial_contact on;
proposal_check obey; # obey, strict, or claim
proposal {
encryption_algorithm des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2;
}
}
sainfo anonymous
{
pfs_group 2;
lifetime time 60 min;
encryption_algorithm des;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
}
Я наблюдаю за траффиком между A.B.C.D и E.F.G.H следующим образом
tcpdump host E.F.G.H
результат такой:
12:19:44.320053 IP A.ru.isakmp > B.ru.isakmp: isakmp: phase 1 R ident
12:19:44.368317 IP B.ru.isakmp > A.ru.isakmp: isakmp: phase 1 I inf
12:20:04.370612 IP A.ru.isakmp > B.ru.isakmp: isakmp: phase 1 R ident
12:20:04.419768 IP B.ru.isakmp > A.ru.isakmp: isakmp: phase 1 I inf
12:20:23.896270 IP B.ru.isakmp > A.ru.isakmp: isakmp: phase 1 I ident
12:20:23.901271 IP A.ru.isakmp > B.ru.isakmp: isakmp: phase 1 R ident
12:20:23.996094 IP B.ru.isakmp > A.ru.isakmp: isakmp: phase 1 I ident
12:20:24.028240 IP A.ru.isakmp > B.ru.isakmp: isakmp: phase 1 R ident
12:20:24.028289 IP A.ru.isakmp > B.ru.isakmp: isakmp: phase 1 R ident
12:20:24.075924 IP B.ru.isakmp > A.ru.isakmp: isakmp: phase 1 I inf
12:20:24.122146 IP B.ru.isakmp > A.ru.isakmp: isakmp: phase 1 I ident[E]
12:20:32.124492 IP B.ru.isakmp > A.ru.isakmp: isakmp: phase 1 I ident[E]
12:20:40.122129 IP B.ru.isakmp > A.ru.isakmp: isakmp: phase 1 I ident[E]
12:20:44.124858 IP A.ru.isakmp > B.ru.isakmp: isakmp: phase 1 R ident
12:20:44.173378 IP B.ru.isakmp > A.ru.isakmp: isakmp: phase 1 I ident[E]
12:20:52.177502 IP B.ru.isakmp > A.ru.isakmp: isakmp: phase 2/others I in
А вот логи:
2008-08-20 12:23:10: DEBUG: invalid length of payload
2008-08-20 12:22:04: ERROR: phase1 negotiation failed due to time up.
2008-08-20 12:20:52: ERROR: ignore information because ISAKMP-SAhas not been established yet.
т.е. фактически есть контакт между cisco и freebsd но они не могут согласовать SA.
