Re: freeswan and ipsec

I should also mention, that the conection does get established.

I can also, view windows networking stuff.  However, I do not know why I am
getting the errors.  Also, I can not seem to do some other things over the
connection.  For example.  One site runs an internet app.  If I try to
connecect to it when the two cpn servers are redhat boxes, it works.  When I
use the BSD boxes, It does not.  I get the following in my /var/log/messages
file on my companies internal firewall

Oct 15 14:53:43 radium kernel: FORWARD REJECT IN=eth1 OUT=eth0
SRC=205.174.164.33 DST=192.168.201.22 LEN=56 TOS=0x00 PREC=0x00 TTL=254
ID=25774 PROTO=ICMP TYPE=3 CODE=4 [SRC=192.168.201.22 DST=10.0.0.2 LEN=1500
TOS=0x00 PREC=0x00 TTL=126 ID=18062 DF PROTO=TCP INCOMPLETE [8 bytes] ]
MTU=1444

My current setup has the vpn server on a routable IP address between two
firewalls (DMZ).  The webpage I am trying to reach from the remote site is
behind the internal firewall on a 192.168 number.  Please note, that this
works fine when I use two linux boxes as the vpn servers.

ipsec verify on the linux box gives this

[root@pmarshallx log]# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                         [OK]
Linux FreeS/WAN 2.06
Checking for IPsec kernel support: found KLIPS                          [OK]
Checking that pluto is running                                          [OK]
Two or more interfaces found, checking IP forwarding                    [OK]
Checking NAT and MASQUERADEing
Checking [email protected] from 10.0.0.0/24 to 192.168.200.0/21  [FAILED]
SNAT from 0.0.0.0/0 to 0.0.0.0/0 kills tunnel 10.0.0.0/24 ->
192.168.200.0/21


NATting could potentially kill some of your existing tunnels.
For more information, visit the following URL:
http://lists.freeswan.org/pipermail/users/2002-August/012918.html

Opportunistic Encryption DNS checks:
Looking for TXT in forward map: pmarshallx
[MISSING]
Does the machine have at least one non-private address?                 [OK]
Looking for TXT in reverse map: 102.195.195.69.in-addr.arpa.
[MISSING]


Thanks again.

Peter
----- Original Message ----- 
From: "Peter Marshall" <[email protected]>
To: <[email protected]>
Sent: Friday, October 15, 2004 2:41 PM
Subject: freeswan and ipsec


I am still having problems getting freeswan (on rh9) to work properly with
ipsec on openbsd.  It works perfect when I run it between 2 rh9 boxes ...
however, I need it to work between rh9 and openbsd .....

On the openbsd console after I try to connect the two I get these messages
(A.B.C.102 is a routable Internet IP addreses)
Oct 15 11:29:04 mailtestlx isakmpd[7395]: message_recv: invalid cookie(s)
19708ba516163430 5429d55714d51b23
Oct 15 11:29:04 mailtestlx isakmpd[7395]: dropped message from A.B.C.102
port 500 due to notification type INVALID_COOKIE
Oct 15 11:29:27 mailtestlx isakmpd[7395]: transport_send_messages: giving up
on message 0x3c05da00
Oct 15 11:31:27 mailtestlx isakmpd[7395]: transport_send_messages: giving up
on message 0x3c05da00
Oct 15 11:33:27 mailtestlx isakmpd[7395]: transport_send_messages: giving up
on message 0x3c05da00
Oct 15 11:43:27 mailtestlx last message repeated 5 times

On the Rh9 box, I get this in the /var/log/secure file   (A.B.C.? and
E.F.G.? are routable Internet IP addreses)
Oct 15 14:19:50 pmarshallx pluto[17009]: "bsdtest" #69: cannot respond to
IPsec SA request because no connection is known for
A.B.C.0/22===A.B.C.102...E.F.G.33===E.F.G.0/26
Oct 15 14:19:57 pmarshallx pluto[17009]: "bsdtest" #69: Quick Mode I1
message is unacceptable because it uses a previously used Message ID
0xf619efa3 (perhaps this is a duplicated packet)
Oct 15 14:20:06 pmarshallx pluto[17009]: "bsdtest" #69: Quick Mode I1
message is unacceptable because it uses a previously used Message ID
0xf619efa3 (perhaps this is a duplicated packet)

This is that I type on the linux box to start ipsec
[root@pmarshallx log]# /etc/init.d/ipsec start
ipsec_setup: Starting FreeS/WAN IPsec 2.06...
[root@pmarshallx log]# ipsec auto --up bsdtest
104 "bsdtest" #3: STATE_MAIN_I1: initiate
106 "bsdtest" #3: STATE_MAIN_I2: sent MI2, expecting MR2
108 "bsdtest" #3: STATE_MAIN_I3: sent MI3, expecting MR3
004 "bsdtest" #3: STATE_MAIN_I4: ISAKMP SA established
112 "bsdtest" #4: STATE_QUICK_I1: initiate
004 "bsdtest" #4: STATE_QUICK_I2: sent QI2, IPsec SA established
{ESP=>0xe8dfa4d8 <0xb4920120}
This is what I type on the bsdbox
# isakmpd
#

This is the ipsec.conf file on the linux box
# basic configuration
config setup
        interfaces="ipsec0=eth0"
        # Debug-logging controls:  "none" for (almost) none, "all" for lots.
        # klipsdebug=all
        # plutodebug=dns

conn bsdtest
        #auto=start
        auto=add
        type=tunnel
        keyexchange=ike
        left=E.F.G.33
        leftsubnet=192.168.200.0/21
        leftnexthop=E.F.G.3
        right=A.B.C.102
        rightsubnet=10.0.0.0/24
        rightnexthop=A.B.192.1
        authby=secret
        pfs=yes


This is the isakmpd.conf file on the openbsd box
[General]
Listen-on=E.F.G.33

[Phase 1]
A.B.C.102=     ISAKMP-peer-B

[Phase 2]
Connections=    IPsec-AB

[ISAKMP-peer-B]
Phase  =  1
Transport =  udp
Local-address = E.F.G.33
Address = A.B.C.102
Configuration = Default-main-mode
Authentication = mypassword

[IPsec-AB]
Phase = 2
ISAKMP-peer = ISAKMP-peer-B
Configuration = Default-quick-mode
Local-ID = Net-LOCAL
Remote-ID = Net-HOST2

[Default-main-mode]
DOI = IPSEC
EXCHANGE_TYPE = ID_PROT
Transforms = 3DES-SHA

[Default-quick-mode]
DOI = IPSEC
EXCHANGE_TYPE = QUICK_MODE
Suites = QM-ESP-AES-SHA-PFS-SUITE

[Net-LOCAL]
ID-type = IPV4_ADDR_SUBNET
Network = E.F.G.33
Netmask = 255.255.255.192

[Net-HOST2]
ID-type = IPV4_ADDR_SUBNET
Network = A.B.C.102
Netmask = 255.255.252.0
~


Any Help Would be greatly appriciated.

Thanks

Peter Marshall