Исходное сообщение
"ipsec ZYWALL и RACOON (Centos 6.3)" Отправлено AleR, 13-Фев-13 19:42
Да, все верно. С подсети 192.168.5.0/24 пинги в подсеть 172.16.0.0/24 не идут. В обратную сторону с 172.16.0.0/24 в 192.168.5.0/24 пинги идут. # setkey -D 77.233.X.X 109.172.Y.Y         esp mode=tunnel spi=1374467382(0x51ecb536) reqid=0(0x00000000)         E: des-cbc  fcf0f034 ce49a5f2         A: hmac-sha1  02e6d408 59629bca de6f865e b37c6bb1 91db89f0         seq=0x00000000 replay=4 flags=0x00000000 state=dying         created: Feb 13 18:52:40 2013   current: Feb 13 19:44:21 2013         diff: 3101(s)   hard: 3600(s)   soft: 2880(s)         last: Feb 13 19:08:38 2013      hard: 0(s)      soft: 0(s)         current: 1077627(bytes) hard: 0(bytes)  soft: 0(bytes)         allocated: 1622 hard: 0 soft: 0         sadb_seq=1 pid=24841 refcnt=0 109.172.Y.Y 77.233.X.X         esp mode=tunnel spi=169212330(0x0a15f9aa) reqid=0(0x00000000)         E: des-cbc  587f7d54 a789e400         A: hmac-sha1  f10cc2fb 79f82122 b8cbac55 7ac56d85 7ed3ff2f         seq=0x00000000 replay=4 flags=0x00000000 state=dying         created: Feb 13 18:52:40 2013   current: Feb 13 19:44:21 2013         diff: 3101(s)   hard: 3600(s)   soft: 2880(s)         last: Feb 13 19:08:38 2013      hard: 0(s)      soft: 0(s)         current: 87367(bytes)   hard: 0(bytes)  soft: 0(bytes)         allocated: 1165 hard: 0 soft: 0         sadb_seq=0 pid=24841 refcnt=0 ]# setkey -DP 192.168.5.0/24[any] 172.16.0.0/24[any] 255         out prio def ipsec         esp/tunnel/77.233.X.X-109.172.Y.Y/require         created: Feb 13 18:52:40 2013  lastused: Feb 13 19:13:44 2013         lifetime: 3600(s) validtime: 0(s)         spid=81 seq=1 pid=24844         refcnt=2 172.16.0.0/24[any] 192.168.5.0/24[any] 255         fwd prio def ipsec         esp/tunnel/109.172.Y.Y-77.233.X.X/require         created: Feb 13 18:52:40 2013  lastused: Feb 13 19:13:44 2013         lifetime: 3600(s) validtime: 0(s)         spid=74 seq=2 pid=24844         refcnt=2 172.16.0.0/24[any] 192.168.5.0/24[any] 255         in prio def ipsec         esp/tunnel/109.172.Y.Y-77.233.X.X/require         created: Feb 13 18:52:40 2013  lastused:         lifetime: 3600(s) validtime: 0(s)         spid=64 seq=3 pid=24844         refcnt=2 (per-socket policy)         out(socket) none         created: Feb  7 15:01:50 2013  lastused: Feb 13 18:52:39 2013         lifetime: 0(s) validtime: 0(s)         spid=12 seq=4 pid=24844         refcnt=1 (per-socket policy)         in(socket) none         created: Feb  7 15:01:50 2013  lastused: Feb 13 18:52:42 2013         lifetime: 0(s) validtime: 0(s)         spid=3 seq=0 pid=24844         refcnt=1