I've set up two security associations(in and out) on two hosts, and then set up two policies per host that should filter traffic to those SA's. Yet when I try to ping one host from the other I get no response, meaning that the filters on one side work and drop unprotected packets, but both hosts are configured to communicate using ipsec.
Can anyone point me in the right direction?
Code:
ip xfrm state add src 192.168.77.23 dst 192.168.77.24 proto esp spi 0x53fa0fdd mode transport reqid 16386 replay-window 32 auth "hmac(sha1)" 0x55f01ac07e15e437115dde0aedd18a822ba9f81e enc "cbc(aes)" 0x6aed4975adf006d65c76f63923a6265b sel src 0.0.0.0/0 dst 0.0.0.0/0
ip xfrm state add src 192.168.77.24 dst 192.168.77.23 proto esp spi 0x53fa0fdd mode transport reqid 16386 replay-window 32 auth "hmac(sha1)" 0x55f01ac07e15e437115dde0aedd18a822ba9f81e enc "cbc(aes)" 0x6aed4975adf006d65c76f63923a6265b sel src 0.0.0.0/0 dst 0.0.0.0/0
ip xfrm policy add dir out src 192.168.77.23 dst 192.168.77.24 ptype main action allow priority 2080 tmpl src 192.168.77.23 dst 192.168.77.24 proto esp reqid 16385 mode transport
ip xfrm policy add dir in src 192.168.77.24 dst 192.168.77.23 ptype main action allow priority 2080 tmpl src 192.168.77.24 dst 192.168.77.23 proto esp reqid 16385 mode transport
Code:
ip xfrm state add src 192.168.77.24 dst 192.168.77.23 proto esp spi 0x53fa0fdd mode transport reqid 16386 replay-window 32 auth "hmac(sha1)" 0x55f01ac07e15e437115dde0aedd18a822ba9f81e enc "cbc(aes)" 0x6aed4975adf006d65c76f63923a6265b sel src 0.0.0.0/0 dst 0.0.0.0/0
ip xfrm state add src 192.168.77.23 dst 192.168.77.24 proto esp spi 0x53fa0fdd mode transport reqid 16386 replay-window 32 auth "hmac(sha1)" 0x55f01ac07e15e437115dde0aedd18a822ba9f81e enc "cbc(aes)" 0x6aed4975adf006d65c76f63923a6265b sel src 0.0.0.0/0 dst 0.0.0.0/0
ip xfrm policy add dir out src 192.168.77.24 dst 192.168.77.23 ptype main action allow priority 2080 tmpl src 192.168.77.24 dst 192.168.77.23 proto esp reqid 16385 mode transport
ip xfrm policy add dir in src 192.168.77.23 dst 192.168.77.24 ptype main action allow priority 2080 tmpl src 192.168.77.23 dst 192.168.77.24 proto esp reqid 16385 mode transport
