Help!
I have an issue with my current hub-and-spoke VPN setup whereby it is not passing traffic in one direction from Racoon across the ESP tunnel to my Juniper SRX. My tunnel is up and and my setup has previously worked before.
If I do a
But the SRX reports zero input bytes from the Racoon side.
My racoon configuration is as follows:
My firewall rules are as follows, but I have also just tried stopping the ipfw service to rule out a miss-configured rule.
My rc.conf is as follows:
My message log generated provides the following:
My Racoon log looks like so:
My setup script looks like so:
I have an issue with my current hub-and-spoke VPN setup whereby it is not passing traffic in one direction from Racoon across the ESP tunnel to my Juniper SRX. My tunnel is up and and my setup has previously worked before.
If I do a
tcpdump -i gif0 I can see traffic from my SRX reaching the gif0 interface. (see below)
Code:
10:37:14.928187 IP 4.4.4.4 > ospf-all.mcast.net: OSPFv2, Hello, length 56My racoon configuration is as follows:
Code:
path include "/usr/local/etc/racoon";
path pre_shared_key "/usr/local/etc/racoon/psk.txt";
log debug2;
padding # options are not to be changed
{
maximum_length 20; # maximum padding length
randomize off; # enable randomize length
strict_check off; # enable strict check
exclusive_tail off; # extract last one octet
}
listen
{
isakmp 89.89.89.123 [500];
isakmp_natt 89.89.89.123 [4500];
strict_address;
}
remote anonymous [500]
{
exchange_mode main;
doi ipsec_doi;
my_identifier address xx.yy.zz.aa;
dpd_delay 20;
dpd_maxfail 2;
ike_frag force;
situation identity_only;
passive off;
proposal_check obey;
generate_policy on;
verify_identifier off;
initial_contact on;
lifetime time 8 hour;
script "/usr/local/etc/racoon/phase1_up_down.sh" phase1_up;
script "/usr/local/etc/racoon/phase1_up_down.sh" phase1_down;
script "/usr/local/etc/racoon/phase1_up_down.sh" phase1_dead;
proposal
{
encryption_algorithm aes256;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 1;
}
proposal
{
encryption_algorithm aes;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 1;
}
proposal
{
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 1;
}
}
sainfo address 172.16.4.0/24 any address 192.168.22.0/24 any
{
pfs_group 1;
lifetime time 1 hour;
encryption_algorithm des, 3des, aes, aes256;
authentication_algorithm hmac_md5, hmac_sha1, hmac_sha256, hmac_sha384, hmac_sha512;
compression_algorithm deflate;
}
sainfo anonymous
{
pfs_group 1;
lifetime time 1 hour;
encryption_algorithm des, 3des, aes, aes256;
authentication_algorithm hmac_md5, hmac_sha1, hmac_sha256, hmac_sha384, hmac_sha512;
compression_algorithm deflate;
}My firewall rules are as follows, but I have also just tried stopping the ipfw service to rule out a miss-configured rule.
Code:
#!/bin/sh
ipfw -q flush
WAN="em0"
GIF0="gif0"
GIF1="gif1"
add="ipfw -q add"
ks="keep-state" # just too lazy to key this each time
$add 79 allow log icmp from any to any out via $WAN
$add 80 allow icmp from any to any in via $WAN
# Allow anything out
$add 81 allow ip from any to any out via $GIF0
$add 82 allow ip from any to any in via $GIF0
$add 83 allow ip from any to any out via $GIF1
$add 84 allow ip from any to any in via $GIF1
$add 90 allow tcp from any to any 53 out via $WAN setup $ks
$add 91 allow udp from any to any 53 out via $WAN $ks
$add 92 allow tcp from any to any 22,80,8080,443 out via $WAN setup $ks
$add 93 allow tcp from any to any 22,80,8080,443 in via ng0 setup $ks
# Rules for incomming traffic - deny everything that is not explicitely allowed
$add 100 allow tcp from any to any 22, 4, 80, 443, 548 via $WAN in setup limit src-addr 10
$add 184 allow log esp from any to any
$add 185 allow log ah from any to any
$add 186 allow log ipencap from any to any
$add 188 allow log udp from any 500 to any
$add 191 allow udp from any to any 500 via $WAN in keep-state
$add 192 allow udp from any to any 4500 via $WAN in keep-state
$add 200 allow tcp from any to any 1723 via $WAN in setup keep-state
$add 202 allow udp from any to any 1701 via $WAN in keep-state
# Catch spoofing from outside
$add 90 deny ip from any to any not antispoof in
$add 5100 nat 1 all from any to any via $WAN in
$add 5100 divert natd ip from any to any in via $WAN
$add 5101 check-state
# Catch tcp/udp packets, but don't touch gre, esp, icmp traffic
$add 9998 deny log tcp from any to any via $WAN
$add 9999 deny log udp from any to any via $WAN
$add 10000 nat 1 ip from any to any via $WAN out
$add 65534 deny ip from any to anyMy rc.conf is as follows:
Code:
hostname="myhost-freebsd"
ifconfig_em0="DHCP"
sshd_enable="YES"
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="NO"
gateway_enable="YES"
firewall_enable="YES"
firewall_script="YES"
firewall_logging="YES"
firewall_script="/usr/local/etc/ipfw.rules"
ipsec_enable="YES"
ipsec_program="/usr/local/sbin/setkey"
ipsec_file="/usr/local/etc/racoon/setkey.conf"
racoon_enable="YES"
racoon_flags="-l /var/log/racoon.log"My message log generated provides the following:
Code:
Feb 12 22:15:38 myhost-freebsd logger: Finished phase1_down
Feb 12 22:15:59 myhost-freebsd logger: Phase1-up: Remote ID 1.1.1.1 on 89.89.89.123<->31.31.31.2 Localport 500 Remoteport 500
Feb 12 22:15:59 myhost-freebsd logger: The next file is 1.1.1.1, and RemoteID = 1.1.1.1
Feb 12 22:15:59 myhost-freebsd logger: Endpoint 1.1.1.1 identified
Feb 12 22:15:59 myhost-freebsd logger: Found phase1_up match
Feb 12 22:15:59 myhost-freebsd logger: Phase_Up Data being passed gif0 , 192.168.22.0/24, 255.255.255.0, 192.168.22.1,172.16.4.0/24,255.255.255.0,172.16.4.1
Feb 12 22:15:59 myhost-freebsd logger: setkey cmd=setkey -c spdadd 0.0.0.0/0 any 192.168.22.0/24 any -P out ipsec esp/tunnel/89.89.89.123-31.31.31.2/require; spdadd 0.0.0.0/0 any 172.16.4.0/24 any -P in ipsec esp/tunnel/31.31.31.2-89.89.89.123/require;
Feb 12 22:15:59 myhost-freebsd logger: Finished phase1_up
Feb 12 22:43:19 myhost-freebsd kernel: gif0: promiscuous mode enabled
Feb 12 22:45:57 myhost-freebsd kernel: gif0: promiscuous mode disabled
Feb 12 22:46:16 myhost-freebsd kernel: ipfw: limit 5 reached on entry 9998
Feb 12 22:47:00 myhost-freebsd kernel: ipfw: limit 5 reached on entry 184
Feb 12 22:47:00 myhost-freebsd kernel: ipfw: limit 5 reached on entry 186
Feb 12 23:36:04 myhost-freebsd kernel: ipfw: limit 5 reached on entry 188
Feb 13 06:15:59 myhost-freebsd logger: Phase1-up: Remote ID 1.1.1.1 on 89.89.89.123<->31.31.31.2 Localport 500 Remoteport 500
Feb 13 06:15:59 myhost-freebsd logger: The next file is 1.1.1.1, and RemoteID = 1.1.1.1
Feb 13 06:15:59 myhost-freebsd logger: Endpoint 1.1.1.1 identified
Feb 13 06:15:59 myhost-freebsd logger: Found phase1_down match
Feb 13 06:15:59 myhost-freebsd logger: Phase_Down Data being passed gif0 , 192.168.22.0/24, 255.255.255.0, 192.168.22.1,172.16.4.0/24, nternalMask,172.16.4.1
Feb 13 06:15:59 myhost-freebsd logger: PhaseII Down: setkey -c spddelete 0.0.0.0/0 192.168.22.0/24 any -P out; \ spddelete 0.0.0.0/0 172.16.4.0/24 any -P in;
Feb 13 06:15:59 myhost-freebsd logger: Finished phase1_down
Feb 13 07:02:10 myhost-freebsd logger: Phase1-up: Remote ID 1.1.1.1 on 89.89.89.123<->31.31.31.2 Localport 500 Remoteport 500
Feb 13 07:02:10 myhost-freebsd logger: The next file is 1.1.1.1, and RemoteID = 1.1.1.1
Feb 13 07:02:10 myhost-freebsd logger: Endpoint 1.1.1.1 identified
Feb 13 07:02:10 myhost-freebsd logger: Found phase1_up match
Feb 13 07:02:10 myhost-freebsd logger: Phase_Up Data being passed gif0 , 192.168.22.0/24, 255.255.255.0, 192.168.22.1,172.16.4.0/24,255.255.255.0,172.16.4.1
Feb 13 07:02:10 myhost-freebsd logger: setkey cmd=setkey -c spdadd 0.0.0.0/0 any 192.168.22.0/24 any -P out ipsec esp/tunnel/89.89.89.123-31.31.31.2/require; spdadd 0.0.0.0/0 any 172.16.4.0/24 any -P in ipsec esp/tunnel/31.31.31.2-89.89.89.123/require;
Feb 13 07:02:10 myhost-freebsd logger: Finished phase1_up
Feb 13 10:06:01 myhost-freebsd kernel: gif0: promiscuous mode enabled
Feb 13 10:07:17 myhost-freebsd kernel: em0: promiscuous mode enabled
Feb 13 10:09:37 myhost-freebsd logger: Phase1-up: Remote ID 1.1.1.1 on 89.89.89.123<->31.31.31.2 Localport 500 Remoteport 500
Feb 13 10:09:37 myhost-freebsd logger: The next file is 1.1.1.1, and RemoteID = 1.1.1.1
Feb 13 10:09:37 myhost-freebsd logger: Endpoint 1.1.1.1 identified
Feb 13 10:09:37 myhost-freebsd logger: Found phase1_down match
Feb 13 10:09:37 myhost-freebsd logger: Phase_Down Data being passed gif0 , 192.168.22.0/24, 255.255.255.0, 192.168.22.1,172.16.4.0/24, nternalMask,172.16.4.1
Feb 13 10:09:37 myhost-freebsd logger: PhaseII Down: setkey -c spddelete 0.0.0.0/0 192.168.22.0/24 any -P out; \ spddelete 0.0.0.0/0 172.16.4.0/24 any -P in;
Feb 13 10:09:37 myhost-freebsd logger: Finished phase1_down
Feb 13 10:09:37 myhost-freebsd kernel: gif0: promiscuous mode disabled
Feb 13 10:10:00 myhost-freebsd logger: Phase1-up: Remote ID 1.1.1.1 on 89.89.89.123<->31.31.31.2 Localport 500 Remoteport 500
Feb 13 10:10:00 myhost-freebsd logger: The next file is 1.1.1.1, and RemoteID = 1.1.1.1
Feb 13 10:10:00 myhost-freebsd logger: Endpoint 1.1.1.1 identified
Feb 13 10:10:00 myhost-freebsd logger: Found phase1_up match
Feb 13 10:10:00 myhost-freebsd logger: Phase_Up Data being passed gif0 , 192.168.22.0/24, 255.255.255.0, 192.168.22.1,172.16.4.0/24,255.255.255.0,172.16.4.1
Feb 13 10:10:00 myhost-freebsd logger: setkey cmd=setkey -c spdadd 0.0.0.0/0 any 192.168.22.0/24 any -P out ipsec esp/tunnel/89.89.89.123-31.31.31.2/require; spdadd 0.0.0.0/0 any 172.16.4.0/24 any -P in ipsec esp/tunnel/31.31.31.2-89.89.89.123/require;
Feb 13 10:10:00 myhost-freebsd logger: Finished phase1_up
Feb 13 10:10:29 myhost-freebsd kernel: gif0: promiscuous mode enabled
Feb 13 10:10:32 myhost-freebsd kernel: gif0: promiscuous mode disabled
Feb 13 10:10:34 myhost-freebsd kernel: gif0: promiscuous mode enabled
Feb 13 10:12:28 myhost-freebsd kernel: gif0: promiscuous mode disabled
Feb 13 10:12:36 myhost-freebsd logger: Phase1-up: Remote ID 1.1.1.1 on 89.89.89.123<->31.31.31.2 Localport 500 Remoteport 500
Feb 13 10:12:36 myhost-freebsd logger: The next file is 1.1.1.1, and RemoteID = 1.1.1.1
Feb 13 10:12:36 myhost-freebsd logger: Endpoint 1.1.1.1 identified
Feb 13 10:12:36 myhost-freebsd logger: Found phase1_down match
Feb 13 10:12:36 myhost-freebsd logger: Phase_Down Data being passed gif0 , 192.168.22.0/24, 255.255.255.0, 192.168.22.1,172.16.4.0/24, nternalMask,172.16.4.1
Feb 13 10:12:36 myhost-freebsd logger: PhaseII Down: setkey -c spddelete 0.0.0.0/0 192.168.22.0/24 any -P out; \ spddelete 0.0.0.0/0 172.16.4.0/24 any -P in;
Feb 13 10:12:36 myhost-freebsd logger: Finished phase1_down
Feb 13 10:13:00 myhost-freebsd logger: Phase1-up: Remote ID 1.1.1.1 on 89.89.89.123<->31.31.31.2 Localport 500 Remoteport 500
Feb 13 10:13:00 myhost-freebsd logger: The next file is 1.1.1.1, and RemoteID = 1.1.1.1
Feb 13 10:13:00 myhost-freebsd logger: Endpoint 1.1.1.1 identified
Feb 13 10:13:00 myhost-freebsd logger: Found phase1_up match
Feb 13 10:13:00 myhost-freebsd logger: Phase_Up Data being passed gif0 , 192.168.22.0/24, 255.255.255.0, 192.168.22.1,172.16.4.0/24,255.255.255.0,172.16.4.1
Feb 13 10:13:00 myhost-freebsd logger: setkey cmd=setkey -c spdadd 0.0.0.0/0 any 192.168.22.0/24 any -P out ipsec esp/tunnel/89.89.89.123-31.31.31.2/require; spdadd 0.0.0.0/0 any 172.16.4.0/24 any -P in ipsec esp/tunnel/31.31.31.2-89.89.89.123/require;
Feb 13 10:13:00 myhost-freebsd logger: Finished phase1_up
Feb 13 10:13:00 myhost-freebsd kernel: ipsec_common_input: no key association found for SA 89.89.89.123/0be5b3da/50
Feb 13 10:13:19 myhost-freebsd kernel: gif0: promiscuous mode enabled
Feb 13 10:31:08 myhost-freebsd kernel: gif0: promiscuous mode disabled
Feb 13 10:31:11 myhost-freebsd logger: Phase1-up: Remote ID 1.1.1.1 on 89.89.89.123<->31.31.31.2 Localport 500 Remoteport 500
Feb 13 10:31:11 myhost-freebsd logger: The next file is 1.1.1.1, and RemoteID = 1.1.1.1
Feb 13 10:31:11 myhost-freebsd logger: Endpoint 1.1.1.1 identified
Feb 13 10:31:11 myhost-freebsd logger: Found phase1_down match
Feb 13 10:31:11 myhost-freebsd logger: Phase_Down Data being passed gif0 , 192.168.22.0/24, 255.255.255.0, 192.168.22.1,172.16.4.0/24, nternalMask,172.16.4.1
Feb 13 10:31:11 myhost-freebsd logger: PhaseII Down: setkey -c spddelete 0.0.0.0/0 192.168.22.0/24 any -P out; \ spddelete 0.0.0.0/0 172.16.4.0/24 any -P in;
Feb 13 10:31:11 myhost-freebsd logger: Finished phase1_down
Feb 13 10:32:00 myhost-freebsd logger: Phase1-up: Remote ID 1.1.1.1 on 89.89.89.123<->31.31.31.2 Localport 500 Remoteport 500
Feb 13 10:32:00 myhost-freebsd logger: The next file is 1.1.1.1, and RemoteID = 1.1.1.1
Feb 13 10:32:00 myhost-freebsd logger: Endpoint 1.1.1.1 identified
Feb 13 10:32:00 myhost-freebsd logger: Found phase1_up match
Feb 13 10:32:00 myhost-freebsd logger: Phase_Up Data being passed gif0 , 192.168.22.0/24, 255.255.255.0, 192.168.22.1,172.16.4.0/24,255.255.255.0,172.16.4.1
Feb 13 10:32:00 myhost-freebsd logger: setkey cmd=setkey -c spdadd 0.0.0.0/0 any 192.168.22.0/24 any -P out ipsec esp/tunnel/89.89.89.123-31.31.31.2/require; spdadd 0.0.0.0/0 any 172.16.4.0/24 any -P in ipsec esp/tunnel/31.31.31.2-89.89.89.123/require;
Feb 13 10:32:00 myhost-freebsd logger: Finished phase1_up
Feb 13 10:32:01 myhost-freebsd kernel: ipsec_common_input: no key association found for SA 89.89.89.123/0a4598da/50
Feb 13 10:32:05 myhost-freebsd kernel: em0: promiscuous mode disabled
Feb 13 10:32:23 myhost-freebsd kernel: em0: promiscuous mode enabled
Feb 13 10:32:53 myhost-freebsd kernel: gif0: promiscuous mode enabled
Feb 13 10:37:23 myhost-freebsd kernel: gif0: promiscuous mode disabled
Feb 13 10:43:13 myhost-freebsd kernel: em0: promiscuous mode disabledMy Racoon log looks like so:
Code:
2014-02-13 11:41:13: DEBUG: hmac(hmac_sha1)
2014-02-13 11:41:13: DEBUG: HASH computed:
2014-02-13 11:41:13: DEBUG:
ad70017b a7f281ce bea05279 d1f95270 b8822d9d
2014-02-13 11:41:13: DEBUG: hash validated.
2014-02-13 11:41:13: DEBUG: begin.
2014-02-13 11:41:13: DEBUG: seen nptype=8(hash)
2014-02-13 11:41:13: DEBUG: seen nptype=11(notify)
2014-02-13 11:41:13: DEBUG: succeed.
2014-02-13 11:41:13: [31.31.31.2] DEBUG: DPD R-U-There-Ack received
2014-02-13 11:41:13: DEBUG: received an R-U-THERE-ACK
2014-02-13 11:41:33: [31.31.31.2] DEBUG: DPD monitoring....
2014-02-13 11:41:33: DEBUG: compute IV for phase2
2014-02-13 11:41:33: DEBUG: phase1 last IV:
2014-02-13 11:41:33: DEBUG:
11617970 cd455aed d4b5ad33
2014-02-13 11:41:33: DEBUG: hash(sha1)
2014-02-13 11:41:33: DEBUG: encryption(3des)
2014-02-13 11:41:33: DEBUG: phase2 IV computed:
2014-02-13 11:41:33: DEBUG:
379bf71a 40353118
2014-02-13 11:41:33: DEBUG: HASH with:
2014-02-13 11:41:33: DEBUG:
d4b5ad33 00000020 00000001 01108d28 45942f67 13e5cdf4 38ea5adb 2ed25ea9
0000041d
2014-02-13 11:41:33: DEBUG: hmac(hmac_sha1)
2014-02-13 11:41:33: DEBUG: HASH computed:
2014-02-13 11:41:33: DEBUG:
7fb45868 f108c8ff 2ebd897f 22df3698 50a66720
2014-02-13 11:41:33: DEBUG: begin encryption.
2014-02-13 11:41:33: DEBUG: encryption(3des)
2014-02-13 11:41:33: DEBUG: pad length = 8
2014-02-13 11:41:33: DEBUG:
0b000018 7fb45868 f108c8ff 2ebd897f 22df3698 50a66720 00000020 00000001
01108d28 45942f67 13e5cdf4 38ea5adb 2ed25ea9 0000041d 00000000 00000008
2014-02-13 11:41:33: DEBUG: encryption(3des)
2014-02-13 11:41:33: DEBUG: with key:
2014-02-13 11:41:33: DEBUG:
2e821daa 872617fd f47d0969 038e4683 5ec99057 dc491d77
2014-02-13 11:41:33: DEBUG: encrypted payload by IV:
2014-02-13 11:41:33: DEBUG:
379bf71a 40353118
2014-02-13 11:41:33: DEBUG: save IV for next:
2014-02-13 11:41:33: DEBUG:
6fc74822 cb8e329b
2014-02-13 11:41:33: DEBUG: encrypted.
2014-02-13 11:41:33: DEBUG: 92 bytes from 89.89.89.123[500] to 31.31.31.2[500]
2014-02-13 11:41:33: DEBUG: sockname 89.89.89.123[500]
2014-02-13 11:41:33: DEBUG: send packet from 89.89.89.123[500]
2014-02-13 11:41:33: DEBUG: send packet to 31.31.31.2[500]
2014-02-13 11:41:33: DEBUG: 1 times of 92 bytes message will be sent to 31.31.31.2[500]
2014-02-13 11:41:33: DEBUG:
45942f67 13e5cdf4 38ea5adb 2ed25ea9 08100501 d4b5ad33 0000005c 8e0743f5
5d8eecec 5bfc7548 49d9dd15 bf1664e2 6b5bdf48 458f3dbc 6c23c3a3 bea834b6
20c413bd 5ad96bd6 edb7639f 75e3ac79 b044c864 6fc74822 cb8e329b
2014-02-13 11:41:33: DEBUG: sendto Information notify.
2014-02-13 11:41:33: DEBUG: IV freed
2014-02-13 11:41:33: [31.31.31.2] DEBUG: DPD R-U-There sent (0)
2014-02-13 11:41:33: [31.31.31.2] DEBUG: rescheduling send_r_u (5).
2014-02-13 11:41:33: DEBUG: ===
2014-02-13 11:41:33: DEBUG: 84 bytes message received from 31.31.31.2[500] to 89.89.89.123[500]
2014-02-13 11:41:33: DEBUG:
45942f67 13e5cdf4 38ea5adb 2ed25ea9 08100501 f2b8b50f 00000054 1e017b80
7f642d30 5e3bfde9 d369827f 5aee5256 b63e53ee d75095f4 2a57091a 68fc76ad
2828a547 3fb77e93 4d7eb291 bc01834b 51453f96
2014-02-13 11:41:33: DEBUG: receive Information.
2014-02-13 11:41:33: DEBUG: compute IV for phase2
2014-02-13 11:41:33: DEBUG: phase1 last IV:
2014-02-13 11:41:33: DEBUG:
11617970 cd455aed f2b8b50f
2014-02-13 11:41:33: DEBUG: hash(sha1)
2014-02-13 11:41:33: DEBUG: encryption(3des)
2014-02-13 11:41:33: DEBUG: phase2 IV computed:
2014-02-13 11:41:33: DEBUG:
2a08372c 0ff42fc6
2014-02-13 11:41:33: DEBUG: begin decryption.
2014-02-13 11:41:33: DEBUG: encryption(3des)
2014-02-13 11:41:33: DEBUG: IV was saved for next processing:
2014-02-13 11:41:33: DEBUG:
bc01834b 51453f96
2014-02-13 11:41:33: DEBUG: encryption(3des)
2014-02-13 11:41:33: DEBUG: with key:
2014-02-13 11:41:33: DEBUG:
2e821daa 872617fd f47d0969 038e4683 5ec99057 dc491d77
2014-02-13 11:41:33: DEBUG: decrypted payload by IV:
2014-02-13 11:41:33: DEBUG:
2a08372c 0ff42fc6
2014-02-13 11:41:33: DEBUG: decrypted payload, but not trimed.
2014-02-13 11:41:33: DEBUG:
0b000018 046c11fe 06271544 70fe974c 0f99efa9 46d2a60f 00000020 00000001
01108d29 45942f67 13e5cdf4 38ea5adb 2ed25ea9 0000041d
2014-02-13 11:41:33: DEBUG: padding len=29
2014-02-13 11:41:33: DEBUG: skip to trim padding.
2014-02-13 11:41:33: DEBUG: decrypted.
2014-02-13 11:41:33: DEBUG:
45942f67 13e5cdf4 38ea5adb 2ed25ea9 08100501 f2b8b50f 00000054 0b000018
046c11fe 06271544 70fe974c 0f99efa9 46d2a60f 00000020 00000001 01108d29
45942f67 13e5cdf4 38ea5adb 2ed25ea9 0000041d
2014-02-13 11:41:33: DEBUG: IV freed
2014-02-13 11:41:33: DEBUG: HASH with:
2014-02-13 11:41:33: DEBUG:
f2b8b50f 00000020 00000001 01108d29 45942f67 13e5cdf4 38ea5adb 2ed25ea9
0000041d
2014-02-13 11:41:33: DEBUG: hmac(hmac_sha1)
2014-02-13 11:41:33: DEBUG: HASH computed:
2014-02-13 11:41:33: DEBUG:
046c11fe 06271544 70fe974c 0f99efa9 46d2a60f
2014-02-13 11:41:33: DEBUG: hash validated.
2014-02-13 11:41:33: DEBUG: begin.
2014-02-13 11:41:33: DEBUG: seen nptype=8(hash)
2014-02-13 11:41:33: DEBUG: seen nptype=11(notify)
2014-02-13 11:41:33: DEBUG: succeed.
2014-02-13 11:41:33: [31.31.31.2] DEBUG: DPD R-U-There-Ack received
2014-02-13 11:41:33: DEBUG: received an R-U-THERE-ACKMy setup script looks like so:
Code:
#!/usr/bin/bash
# Setup and tear down script for Racoon / Setkey ESP tunnesls
#
# LOCAL_ADDR
# The local address of the phase 1 SA.
# LOCAL_PORT
# The local port used for IKE for the phase 1 SA.
# REMOTE_ADDR
# The remote address of the phase 1 SA.
# REMOTE_PORT
# The remote port used for IKE for the phase 1 SA.
# REMOTE_ID
# The remote identity received in IKE for the phase
# 1 SA.
#
OUTPUT="logger"
#OUTPUT="echo"
ExternalSubNets=(192.168.22.0/24 192.168.4.0/24 )
ExternalGateways=(192.168.22.1 192.168.4.254 )
ExternalMasks=(255.255.255.0 255.255.255.0 )
InternalSubNets=(172.16.4.0/24 172.16.6.0/24 )
InternalGateways=(172.16.4.1 172.16.6.1 )
InternalMasks=(255.255.255.0 255.255.255.0 )
ExternalIDs="1.1.1.1 1.1.1.3 "
IPSec_Ifaces=(gif0 gif1)
ANY_SRC="0.0.0.0/0"
GIFCONFIG="/sbin/ifconfig"
HOSTNAME=`/bin/hostname`
NETMASK="255.255.255.0"
# Bring up the required interface and tunnel
#
vpnUp ()
{
IPSec_Iface=$1
ExternalSubNet=$2
ExternalMask=$3
ExternalGateway=$4
InternalSubNet=$5
InternalMask=$6
InternalGateway=$7
$OUTPUT "Phase_Up Data being passed $IPSec_Iface , $ExternalSubNet, $ExternalMask, $ExternalGateway,$InternalSubNet,$InternalMask,$InternalGateway "
# Take down / clear the interface first
$GIFCONFIG $IPSec_Iface destroy
# Bring up interface and create tunnel
$GIFCONFIG $IPSec_Iface create
$GIFCONFIG $IPSec_Iface tunnel $LOCAL_ADDR $REMOTE_ADDR MTU 1380
$GIFCONFIG $IPSec_Iface inet $InternalGateway $ExternalGateway netmask $ExternalMask
SETKEYCMD="setkey -c spdadd $ANY_SRC any $ExternalSubNet any -P out ipsec \
esp/tunnel/${LOCAL_ADDR}-${REMOTE_ADDR}/require; \
spdadd $ANY_SRC any $InternalSubNet any -P in ipsec \
esp/tunnel/${REMOTE_ADDR}-${LOCAL_ADDR}/require;"
$OUTPUT "setkey cmd=$SETKEYCMD"
$SETKEYCMD
/sbin/route add $ExternalSubNet $InternalGateway
}
# Bring down the required interface and tunnel
#
vpnDown ()
{
IPSec_Iface=$1
ExternalSubNet=$2
ExternalMask=$3
ExternalGateway=$4
InternalSubNet=$5
InternalMask=$6
InternalGateway=$7
$OUTPUT "Phase_Down Data being passed $IPSec_Iface , $ExternalSubNet, $ExternalMask, $ExternalGateway,$InternalSubNet,$I
nternalMask,$InternalGateway "
# Take down interface and create tunnel
SETKEYCMD="setkey -c spddelete $ANY_SRC $ExternalSubNet any -P out; \
spddelete $ANY_SRC $InternalSubNet any -P in;"
$OUTPUT "PhaseII Down: $SETKEYCMD"
$SETKEYCMD
/sbin/route del $ExternalSubNet $InternalGateway
# Take down / clear the interface
$GIFCONFIG $IPSec_Iface destroy
}
$OUTPUT "Phase1-up: Remote ID ${REMOTE_ID} on ${LOCAL_ADDR}<->${REMOTE_ADDR} Localport $LOCAL_PORT Remoteport $REMOTE_PORT "
MODE=$1 # Get the mode
Ref=0
for fn in $ExternalIDs; do
$OUTPUT "The next file is $fn, and RemoteID = $REMOTE_ID"
if [ "$REMOTE_ID" == "$fn" ]; then
$OUTPUT "Endpoint $REMOTE_ID identified"
if [ "phase1_up" == "$MODE" ]; then
$OUTPUT "Found phase1_up match"
vpnUp ${IPSec_Ifaces[$Ref]} ${ExternalSubNets[$Ref]} ${ExternalMasks[$Ref]} ${ExternalGateways[$Ref]} ${InternalSubNets[$Ref]} ${InternalMasks[$Ref]} ${InternalGateways[$Ref]}
$OUTPUT "Finished phase1_up"
exit 1
else {
$OUTPUT "Found phase1_down match"
vpnDown ${IPSec_Ifaces[$Ref]} ${ExternalSubNets[$Ref]} ${ExternalMasks[$Ref]} ${ExternalGateways[$Ref]} ${InternalSubNets[$Ref]} ${InternalMasks[$Ref]} ${InternalGateways[$Ref]}
$OUTPUT "Finished phase1_down"
exit 1
}
fi
fi
Ref=`expr $Ref + 1`
done
$OUTPUT "No remote ID mactched!!"