Hi,
... problems with IPsec. Does anyone know what to do and what does this mean ? Have no idea where to search for 'error'. I used '//'//'//.ipsec-howto.org/x247.html to configure ipsec.
I'm trying to ping host behind other ipsec peer/gateway and this is what I get from racoon running in foreground :
...
2004-03-05 02:10:43: WARNING: pfkey.c:1422
k_recvexpire(): the expire message is received but the handler has not been established.
2004-03-05 02:10:43: ERROR: pfkey.c:741
fkey_timeover(): REMOTE.IP.ADDR give up to get IPsec-SA due to time up to wait.
2004-03-05 02:10:43: INFO: isakmp.c:939:isakmp_ph2begin_i(): initiate new phase 2 negotiation: MY.IP.ADDR[0]<=>REMOTE.IP.ADDR[0]
2004-03-05 02:10:43: ERROR: isakmp_inf.c:838:isakmp_info_recv_n(): unknown notify message, no phase2 handle found.
...
Another interesting thing is PING output :
PING 192.168.115.22 (192.168.115.22) 56(84) bytes of data.
ping: sendmsg: No such process
...
ping: sendmsg: No such process
-----
ipsec.conf :
#!/usr/sbin/setkey -f
flush;
spdflush;
# REMOTE.IP.BEHIND.PEER(LAN) = 192.168.115.22
# MY.IP = external / gateway ip adress
add MY.IP REMOTE.IP esp 0x201 -m tunnel -E 3des-cbc 0x7aeaca3f87d060a12f4a4487d5a5c3355920fae69a96c831 -A hm
add REMOTE.IP MY.IP esp 0x301 -m tunnel -E 3des-cbc 0xf6ddb555acfd9d77b03ea3843f2653255afe8eb5573965df -A hm
spdadd MY.IP REMOTE.IP.BEHIND.PEER(LAN) any -P out ipsec
esp/tunnel/MY.IP-REMOTE.IP/require;
spdadd REMOTE.IP.BEHIND.PEER(LAN) MY.IP any -P in ipsec
esp/tunnel/REMOTE.IP-MY.IP/require;
----
path pre_shared_key "/etc/psk.txt";
listen {
isakmp MY.IP;
}
remote anonymous {
exchange_mode main,aggressive,base;
lifetime time 24 hour;
proposal {
encryption_algorithm 3des;
hash_algorithm md5;
authentication_method pre_shared_key;
dh_group 1;
}
}
sainfo anonymous {
lifetime time 12 hour ;
encryption_algorithm 3des ;
authentication_algorithm hmac_md5 ;
compression_algorithm deflate ;
}
---
I need to establish IPsec connection with another peer and I only know that enc_algorithm is 3des, hash_alg md5, dh_grp 1 and IP adresses of (external) gateway and (internal) computer. I don't even know should I use tunnel or transport mode.
Well.. that's all
Thnx,
B
