Home / Browse / IPsec Tools / Mail / Archive

IPsec Tools

Email Archive: ipsec-tools-users (read-only)

Re: [Ipsec-tools-users] RoadWarrior configuration problem

From: George Borisov <george@dx...> - 2006-05-23 16:21

Zac Barton wrote:

> My local machines ip is 192.168.0.99
> Remote VPN gateway public ip 217.150.xxx.yyy
> Remote VPN private network 10.0.0.0 (255.255.255.0)
> My VPN client address 172.16.34.5 (If the VPN does connect a user with
> ip 10.0.0.110 can view my machine (192.168.0.99) thru this ip address)

and

> sainfo address 172.16.34.5 any address 10.0.0.0/24 any

and

> spdadd 10.0.0.0/24 172.16.34.5/32 any -P in ipsec
> esp/tunnel/217.150.xxx.yyy-192.168.0.99/require;
> spdadd 172.16.34.5/32 10.0.0.0/24 any -P out ipsec
> esp/tunnel/192.168.0.99-
> 217.150.xxx.yyy/require;

I think your problem is to do with the IPSec policies. I have had a look
at using racoon as a VPN client and it looks a little bit different to
the LAN-LAN setup I am using (in terms of generating the policies.)

Have a look here:
http://www.netbsd.org/Documentation/network/ipsec/rasvpn.html#client_conf=

Also, look at the files in your
"/usr/share/doc/racoon/examples/roadwarrior/client" folder.

Hope this helps,

--=20
George Borisov

DXSolutions Ltd

Thread View

Thread	Author	Date
[Ipsec-tools-users] RoadWarrior configuration problem	Zac Barton <zacbarton@gm...>

[Ipsec-tools-users] Re: RoadWarrior configuration problem

From: Zac Barton <zacbarton@gm...> - 2006-05-21 21:20

Attachments: Message as HTML

It looks like my last email was truncated. Heres the rest of it

2006-05-21 18:51:06: NOTIFY: couldn't find the proper pskey, try to get one
by the peer's address.
2006-05-21 18:51:06: DEBUG: the psk found.
2006-05-21 18:51:06: DEBUG2: psk: 2006-05-21 18:51:06: DEBUG2:
31323334 35363737
2006-05-21 18:51:06: DEBUG: nonce 1: 2006-05-21 18:51:06: DEBUG:
c6ed793b 28b3e7c8 8bc3b0da b00d6027
2006-05-21 18:51:06: DEBUG: nonce 2: 2006-05-21 18:51:06: DEBUG:
ebf0aacb 08f7edcc 0289182a c9170c6c
2006-05-21 18:51:06: DEBUG: hmac(hmac_sha1)
2006-05-21 18:51:06: DEBUG: SKEYID computed:
2006-05-21 18:51:06: DEBUG:
32b3254b 0637ce2e 000139e5 b1ec903f 2456a196
2006-05-21 18:51:06: DEBUG: hmac(hmac_sha1)
2006-05-21 18:51:06: DEBUG: SKEYID_d computed:
2006-05-21 18:51:06: DEBUG:
ad1320db 652e1316 5b862c87 4a7f956b 6a7df75d
2006-05-21 18:51:06: DEBUG: hmac(hmac_sha1)
2006-05-21 18:51:06: DEBUG: SKEYID_a computed:
2006-05-21 18:51:06: DEBUG:
6883db6e 3bd59eaf 501c8607 3ad34993 f30ba030
2006-05-21 18:51:06: DEBUG: hmac(hmac_sha1)
2006-05-21 18:51:06: DEBUG: SKEYID_e computed:
2006-05-21 18:51:06: DEBUG:
98946cce 880b1910 b80d5ab9 068c6a44 31844b43
2006-05-21 18:51:06: DEBUG: encryption(3des)
2006-05-21 18:51:06: DEBUG: hash(sha1)
2006-05-21 18:51:06: DEBUG: len(SKEYID_e) < len(Ka) (20 < 24), generating
long key (Ka = K1 | K2 | ...)
2006-05-21 18:51:06: DEBUG: hmac(hmac_sha1)
2006-05-21 18:51:06: DEBUG: compute intermediate encryption key K1
2006-05-21 18:51:06: DEBUG:
00
2006-05-21 18:51:06: DEBUG:
8428e8d4 a9f0cee4 45216180 76b74c34 1f34ca8d
2006-05-21 18:51:06: DEBUG: hmac(hmac_sha1)
2006-05-21 18:51:06: DEBUG: compute intermediate encryption key K2
2006-05-21 18:51:06: DEBUG:
8428e8d4 a9f0cee4 45216180 76b74c34 1f34ca8d
2006-05-21 18:51:06: DEBUG:
d3bc84ca a59dc255 67f52b91 de135db9 ab93b671
2006-05-21 18:51:06: DEBUG: final encryption key computed:
2006-05-21 18:51:06: DEBUG:
8428e8d4 a9f0cee4 45216180 76b74c34 1f34ca8d d3bc84ca
2006-05-21 18:51:06: DEBUG: hash(sha1)
2006-05-21 18:51:06: DEBUG: encryption(3des)
2006-05-21 18:51:06: DEBUG: IV computed:
2006-05-21 18:51:06: DEBUG:
8b459569 a23a9dba
2006-05-21 18:51:06: DEBUG: HASH received:2006-05-21 18:51:06: DEBUG:
398e864e 079cc5ec f297f000 717ccacc 500187a5
2006-05-21 18:51:06: DEBUG: HASH with:
2006-05-21 18:51:06: DEBUG:
10b3287a dbaf16e2 da30358f eb6b5313 acdea449 8d8a8f61 2c9045f2 d521ddbc
6cdb8cfe 92e61d5e f078d285 1c4bd34b eb79e0f8 554401be b3830182 4ead77f4
eff7492a 58834cb4 0c096ac4 ec06d7b2 281cf138 dd0cea99 d1ed524d 516c235e
fd352ae2 4169e6cf bf868bdd 35527a9f 10137ae3 732be557 75e7dd9b b728b15e
7d973241 db039567 125f4234 deb4ef84 2b048ed9 e12bd73e dd2cf852 1b6b6827
7d4626d6 6498b737 01987001 952f9760 378af898 bf6663c6 a9cf9c79 241a8942
b5efdee8 6ddb279a 424ba859 61778b6b 32de227d b33ab0fb 76607508 b4b07e09
f1939123 31cca214 47b61ca4 4daedd8e c9c9754c 91aa1fcc 9ae8a918 8ac41a6d
0cfea5c1 de38986a f4131eeb 1bb06d21 00000001 00000001 00000028 01010001
00000020 01010000 800b0001 800c0258 80010005 80030001 80020002 80040002
011101f4 d9966b92
2006-05-21 18:51:06: DEBUG: hmac(hmac_sha1)
2006-05-21 18:51:06: DEBUG: HASH computed:
2006-05-21 18:51:06: DEBUG:
398e864e 079cc5ec f297f000 717ccacc 500187a5
2006-05-21 18:51:06: DEBUG: HASH for PSK validated.
2006-05-21 18:51:06: DEBUG: ===
2006-05-21 18:51:06: DEBUG: generate HASH_I
2006-05-21 18:51:06: DEBUG: HASH with:
2006-05-21 18:51:06: DEBUG:
7d973241 db039567 125f4234 deb4ef84 2b048ed9 e12bd73e dd2cf852 1b6b6827
7d4626d6 6498b737 01987001 952f9760 378af898 bf6663c6 a9cf9c79 241a8942
b5efdee8 6ddb279a 424ba859 61778b6b 32de227d b33ab0fb 76607508 b4b07e09
f1939123 31cca214 47b61ca4 4daedd8e c9c9754c 91aa1fcc 9ae8a918 8ac41a6d
10b3287a dbaf16e2 da30358f eb6b5313 acdea449 8d8a8f61 2c9045f2 d521ddbc
6cdb8cfe 92e61d5e f078d285 1c4bd34b eb79e0f8 554401be b3830182 4ead77f4
eff7492a 58834cb4 0c096ac4 ec06d7b2 281cf138 dd0cea99 d1ed524d 516c235e
fd352ae2 4169e6cf bf868bdd 35527a9f 10137ae3 732be557 75e7dd9b b728b15e
f4131eeb 1bb06d21 0cfea5c1 de38986a 00000001 00000001 00000028 01010001
00000020 01010000 800b0001 800c0258 80010005 80030001 80020002 80040002
03000000 7a626172 746f6e40 61737365 74747275 73742e63 6f6d
2006-05-21 18:51:06: DEBUG: hmac(hmac_sha1)
2006-05-21 18:51:06: DEBUG: HASH computed:
2006-05-21 18:51:06: DEBUG:
001ee4ab 2f08b8f8 d9540412 c59b3afd 08e2f7a2
2006-05-21 18:51:06: DEBUG: add payload of len 20, next type 0
2006-05-21 18:51:06: DEBUG: 52 bytes from 192.168.0.99[500] to
217.150.xxx.yyy[500]
2006-05-21 18:51:06: DEBUG: sockname 192.168.0.99[500]
2006-05-21 18:51:06: DEBUG: send packet from 192.168.0.99[500]
2006-05-21 18:51:06: DEBUG: send packet to 217.150.xxx.yyy [500]
2006-05-21 18:51:06: DEBUG: src4 192.168.0.99[500]
2006-05-21 18:51:06: DEBUG: dst4 217.150.xxx.yyy[500]
2006-05-21 18:51:06: DEBUG: 1 times of 52 bytes message will be sent to
217.150.xxx.yyy[500]
2006-05-21 18:51:06: DEBUG:
f4131eeb 1bb06d21 0cfea5c1 de38986a 08100400 00000000 00000034 00000018
001ee4ab 2f08b8f8 d9540412 c59b3afd 08e2f7a2
2006-05-21 18:51:06: DEBUG: compute IV for phase2
2006-05-21 18:51:06: DEBUG: phase1 last IV:
2006-05-21 18:51:06: DEBUG:
8b459569 a23a9dba d8c73421
2006-05-21 18:51:06: DEBUG: hash(sha1)
2006-05-21 18:51:06: DEBUG: encryption(3des)
2006-05-21 18:51:06: DEBUG: phase2 IV computed:
2006-05-21 18:51:06: DEBUG:
541fd1a2 ff4ec05b
2006-05-21 18:51:06: DEBUG: HASH with:
2006-05-21 18:51:06: DEBUG:
d8c73421 0000001c 00000001 01106002 f4131eeb 1bb06d21 0cfea5c1 de38986a
2006-05-21 18:51:06: DEBUG: hmac(hmac_sha1)
2006-05-21 18:51:06: DEBUG: HASH computed:
2006-05-21 18:51:06: DEBUG:
f0c7545a bc30c424 92079000 8dc6f6b1 34d0e528
2006-05-21 18:51:06: DEBUG: begin encryption.
2006-05-21 18:51:06: DEBUG: encryption(3des)
2006-05-21 18:51:06: DEBUG: pad length = 4
2006-05-21 18:51:06: DEBUG:
0b000018 f0c7545a bc30c424 92079000 8dc6f6b1 34d0e528 0000001c 00000001
01106002 f4131eeb 1bb06d21 0cfea5c1 de38986a 00000004
2006-05-21 18:51:06: DEBUG: encryption(3des)
2006-05-21 18:51:06: DEBUG: with key:
2006-05-21 18:51:06: DEBUG:
8428e8d4 a9f0cee4 45216180 76b74c34 1f34ca8d d3bc84ca
2006-05-21 18:51:06: DEBUG: encrypted payload by IV:
2006-05-21 18:51:06: DEBUG:
541fd1a2 ff4ec05b
2006-05-21 18:51:06: DEBUG: save IV for next:
2006-05-21 18:51:06: DEBUG:
bdc29858 d333ec6e
2006-05-21 18:51:06: DEBUG: encrypted.
2006-05-21 18:51:06: DEBUG: 84 bytes from 192.168.0.99[500] to
217.150.xxx.yyy[500]
2006-05-21 18:51:06: DEBUG: sockname 192.168.0.99[500]
2006-05-21 18:51:06: DEBUG: send packet from 192.168.0.99[500]
2006-05-21 18:51:06: DEBUG: send packet to 217.150.xxx.yyy[500]
2006-05-21 18:51:06: DEBUG: src4 192.168.0.99[500]
2006-05-21 18:51:06: DEBUG: dst4 217.150.xxx.yyy[500]
2006-05-21 18:51:06: DEBUG: 1 times of 84 bytes message will be sent to
217.150.xxx.yyy[500]
2006-05-21 18:51:06: DEBUG:
f4131eeb 1bb06d21 0cfea5c1 de38986a 08100501 d8c73421 00000054 ef338bc8
173cf2f2 3df333e5 2d6af262 6eb083f6 d3618a2b 38ec4828 cb05f3d7 09889317
4aae656d 98bd8016 231ebcf8 bdc29858 d333ec6e
2006-05-21 18:51:06: DEBUG: sendto Information notify.
2006-05-21 18:51:06: INFO: ISAKMP-SA established 192.168.0.99[500]-
217.150.xxx.yyy[500]

spi:f4131eeb1bb06d21:0cfea5c1de
38986a2006-05-21 18:51:06: DEBUG: ===




**** setkey -DP ****
10.0.0.0/24[any] 172.16.34.5[any] any
        in prio def ipsec
        esp/tunnel/217.150.xxx.yyy-192.168.0.99/require
        created: May 21 17:33:21 2006  lastused:
        lifetime: 0(s) validtime: 0(s)
        spid=128 seq=10 pid=10058
        refcnt=1
172.16.34.5[any] 10.0.0.0/24[any] any
        out prio def ipsec
        esp/tunnel/192.168.0.99-217.150.xxx.yyy/require
        created: May 21 17:33:21 2006  lastused:
        lifetime: 0(s) validtime: 0(s)
        spid=145 seq=9 pid=10058
        refcnt=1
10.0.0.0/24[any] 172.16.34.5[any] any
        fwd prio def ipsec
        esp/tunnel/217.150.xxx.yyy-192.168.0.99/require
        created: May 21 17:33:21 2006  lastused:
        lifetime: 0(s) validtime: 0(s)
        spid=138 seq=8 pid=10058
        refcnt=1



*** tcpdump output ****
18:51:06.327492 IP 192.168.0.99.isakmp > 217.150.xxx.yyy.isakmp: isakmp:
phase 1 I agg
18:51:06.693106 IP 217.150.xxx.yyy.isakmp > 192.168.0.99.isakmp: isakmp:
phase 1 R agg
18:51:06.756583 IP 192.168.0.99.isakmp > 217.150.xxx.yyy.isakmp: isakmp:
phase 1 I agg
18:51:06.772338 IP 192.168.0.99.isakmp > 217.150.xxx.yyy.isakmp: isakmp:
phase 2/others I inf[E]
18:51:37.964262 IP 217.150.xxx.yyy.isakmp > 192.168.0.99.isakmp: isakmp:
phase 2/others R inf[E]
18:51:37.984078 IP 192.168.0.99.isakmp > 217.150.xxx.yyy.isakmp: isakmp:
phase 2/others I inf[E]
18:52:08.749316 IP 217.150.xxx.yyy.isakmp > 192.168.0.99.isakmp: isakmp:
phase 2/others R inf[E]
18:52:08.775236 IP 192.168.0.99.isakmp > 217.150.xxx.yyy.isakmp: isakmp:
phase 2/others I inf[E]



**** ping 10.0.0.4 ****
PING 10.0.0.4 (10.0.0.4) 56(84) bytes of data.
From 192.168.0.99 icmp_seq=1 Destination Host Unreachable
From 192.168.0.99 icmp_seq=2 Destination Host Unreachable
From 192.168.0.99 icmp_seq=3 Destination Host Unreachable
From 192.168.0.99 icmp_seq=4 Destination Host Unreachable
From 192.168.0.99 icmp_seq=5 Destination Host Unreachable

Re: [Ipsec-tools-users] RoadWarrior configuration problem

From: George Borisov <george@dx...> - 2006-05-22 13:55

Attachments: signature.asc

Zac Barton wrote:
>=20
> After running the above I dont seem to be able to ping a computer on th=
e
> remote side of the network (which I can thru Windows and OS X). Do I
> need to setup any special tunnel interfaces (ip tunnel add ....) or
> routing rules?

You need to add special routes to ping from end-point to end-point.

Quick example:

LOCAL_IP=3D'192.168.1.1'
REMOTE_LAN=3D'10.0.0.0/24'
EXTERNAL_IF=3D'eth0'

/bin/ip route add $REMOTE_LAN dev $EXTERNAL_IF src $LOCAL_IP

More detail (although this is for a LAN - LAN setup) here:
http://www.littleyojik.co.uk/computers/debian_vpn.html


Hope this helps,

--=20
George Borisov

DXSolutions Ltd

Re: [Ipsec-tools-users] RoadWarrior configuration problem

From: Zac Barton <zacbarton@gm...> - 2006-05-22 21:33

Attachments: Message as HTML

Hi George

Thanks for looking over my problem. I tried you suggestion below but still
no luck.

My pings still show "Destination Host Unreachable".

sudo ip route show now has
10.0.0.0/24 dev eth0 scope link src 192.168.0.99

and tcpdump still shows
07:24:55.210810 IP 217.150.xxx.yyy.isakmp > 192.168.0.99.isakmp: isakmp:
phase 2/others R inf[E]
07:24:55.247233 IP 192.168.0.99.isakmp > 217.150.xxx.yyy.isakmp: isakmp:
phase 2/others I inf[E]
07:25:24.781823 IP 217.150.xxx.yyy.isakmp > 192.168.0.99.isakmp: isakmp:
phase 2/others R inf[E]
07:25:24.843464 IP 192.168.0.99.isakmp > 217.150.xxx.yyy.isakmp: isakmp:
phase 2/others I inf[E]


Anymore suggestions/examples?

Ta

Zac


BTW was you example a client to LAN or LAN to LAN route? (I dont know how to
tell the difference)


On 5/22/06, George Borisov <george@...> wrote:
>
> Zac Barton wrote:
> >
> > After running the above I dont seem to be able to ping a computer on the
> > remote side of the network (which I can thru Windows and OS X). Do I
> > need to setup any special tunnel interfaces (ip tunnel add ....) or
> > routing rules?
>
> You need to add special routes to ping from end-point to end-point.
>
> Quick example:
>
> LOCAL_IP='192.168.1.1'
> REMOTE_LAN='10.0.0.0/24'
> EXTERNAL_IF='eth0'
>
> /bin/ip route add $REMOTE_LAN dev $EXTERNAL_IF src $LOCAL_IP
>
> More detail (although this is for a LAN - LAN setup) here:
> http://www.littleyojik.co.uk/computers/debian_vpn.html
>
>
> Hope this helps,
>
> --
> George Borisov
>
> DXSolutions Ltd
>
>
>
>

Re: [Ipsec-tools-users] RoadWarrior configuration problem

From: George Borisov <george@dx...> - 2006-05-23 16:21

Attachments: signature.asc

Zac Barton wrote:

> My local machines ip is 192.168.0.99
> Remote VPN gateway public ip 217.150.xxx.yyy
> Remote VPN private network 10.0.0.0 (255.255.255.0)
> My VPN client address 172.16.34.5 (If the VPN does connect a user with
> ip 10.0.0.110 can view my machine (192.168.0.99) thru this ip address)

and

> sainfo address 172.16.34.5 any address 10.0.0.0/24 any

and

> spdadd 10.0.0.0/24 172.16.34.5/32 any -P in ipsec
> esp/tunnel/217.150.xxx.yyy-192.168.0.99/require;
> spdadd 172.16.34.5/32 10.0.0.0/24 any -P out ipsec
> esp/tunnel/192.168.0.99-
> 217.150.xxx.yyy/require;

I think your problem is to do with the IPSec policies. I have had a look
at using racoon as a VPN client and it looks a little bit different to
the LAN-LAN setup I am using (in terms of generating the policies.)

Have a look here:
http://www.netbsd.org/Documentation/network/ipsec/rasvpn.html#client_conf=

Also, look at the files in your
"/usr/share/doc/racoon/examples/roadwarrior/client" folder.

Hope this helps,

--=20
George Borisov

DXSolutions Ltd

Re: [Ipsec-tools-users] RoadWarrior configuration problem

From: Zac Barton <zacbarton@gm...> - 2006-06-12 10:37

Attachments: Message as HTML

Thanks George

The link you suggested gave me the clues I needed to get the VPN up and
running which has been running stable for over 2 weeks now :-)

After looking at the phase1-up.sh script things got a lot easier

Thanks again everyone for your help

Zac





On 5/24/06, George Borisov <george@...> wrote:
>
> Zac Barton wrote:
>
> > My local machines ip is 192.168.0.99
> > Remote VPN gateway public ip 217.150.xxx.yyy
> > Remote VPN private network 10.0.0.0 (255.255.255.0)
> > My VPN client address 172.16.34.5 (If the VPN does connect a user with
> > ip 10.0.0.110 can view my machine (192.168.0.99) thru this ip address)
>
> and
>
> > sainfo address 172.16.34.5 any address 10.0.0.0/24 any
>
> and
>
> > spdadd 10.0.0.0/24 172.16.34.5/32 any -P in ipsec
> > esp/tunnel/217.150.xxx.yyy-192.168.0.99/require;
> > spdadd 172.16.34.5/32 10.0.0.0/24 any -P out ipsec
> > esp/tunnel/192.168.0.99-
> > 217.150.xxx.yyy/require;
>
> I think your problem is to do with the IPSec policies. I have had a look
> at using racoon as a VPN client and it looks a little bit different to
> the LAN-LAN setup I am using (in terms of generating the policies.)
>
> Have a look here:
> http://www.netbsd.org/Documentation/network/ipsec/rasvpn.html#client_conf
>
> Also, look at the files in your
> "/usr/share/doc/racoon/examples/roadwarrior/client" folder.
>
>
> Hope this helps,
>
> --
> George Borisov
>
> DXSolutions Ltd
>
>
>
>