IPSec over gif interface

V

vodvorezlaya

Hello.

There is a simple network with two gateways, each gateway one interface connected to the Internet (em1 interfaces) to a local area network (em0 interfaces).

FreeBSD01:
Code: 
freebsd01# ifconfig 
em0: inet 192.168.192.151 netmask 0xffffff00 broadcast 192.168.192.255
em1: inet 10.0.0.1 netmask 0xff000000 broadcast 10.255.255.255
lo0: inet 127.0.0.1 netmask 0xff000000
gif0: tunnel inet 10.0.0.1 -> 10.10.10.1
       inet 192.168.192.151 -> 192.168.194.1 netmask 0xffffffff

Code: 
freebsd02# ifconfig
em0: inet 192.168.194.1 netmask 0xffffff00 broadcast 192.168.194.255
em1: inet 10.10.10.1 netmask 0xff000000 broadcast 10.255.255.255
lo0: inet 127.0.0.1 netmask 0xff000000
gif0: tunnel inet 10.10.10.1 -> 10.0.0.1
      inet 192.168.194.1 -> 192.168.192.151 netmask 0xffffffff

Installed tunnel (gif0) between two external interfaces.
Installed and configured racoon, properly configured IPSec.

When I run on freebsd01 command:
ping -S 192.168.192.151 192.168.194.1

in another terminal at
Code: 
freebsd01 # tcpdump-pni gif0
IP192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 14, length 64
IP 10.10.10.1> 10.0.0.1: IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 14, length 64 (ipip-proto-4)

At
Code: 
freebsd02 # tcpdump-pni gif0
IP 10.0.0.1> 10.10.10.1: IP 192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 150, length 64 (ipip-proto-4)
IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 150, length 64
Incoming packets are not encapsulated in strange ways.
If disable IPSec example command [CMD=]setkey -PF[/CMD]all works well.

If you disable IPSec for example the command setkey-PF all works well.

That is not in freebsd 6, but it appeared to freebsd 7 and 8 versions.
Perhaps there is a solution?

Thank you.
 
Can you post the output of # netstat -rn on both machines with gif running?
 
(please use proper
Code: 
 and [cmd] tags: [url]http://forums.freebsd.org/showthread.php?t=8816[/url])
 
Ok:

Code: 
freebsd01# netstat -rn
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.192.1      UGS         0        0    em0
10.0.0.0/8         link#2             U           1       91    em1
10.0.0.1           link#2             UHS         0        0    lo0
127.0.0.1          link#3             UH          0       26    lo0
192.168.192.0/24   link#1             U           2      245    em0
192.168.192.151    link#1             UHS         0        0    lo0
192.168.194.0/24   192.168.194.1      UGS         0        0   gif0
192.168.194.1      link#4             UH          0       27   gif0

Code: 
freebsd02# netstat -rn
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
10.0.0.0/8         link#2             U           1      690    em1
10.10.10.1         link#2             UHS         0        0    lo0
127.0.0.1          link#3             UH          0        0    lo0
192.168.192.0/24   192.168.192.151    UGS         0      225   gif0
192.168.192.151    link#4             UH          0       12   gif0
192.168.194.0/24   link#1             U           0        0    em0
192.168.194.1      link#1             UHS         0        0    lo0
 
You must log in or register to reply here.
Back
Top