Vigor 2600 <-> FreeS/WAN esp bug

(sent to design@ as well, since I think this is an interop problem that
 should be documented)

I've also send this to Vigor, but it seems to me that Draytek has
a bug in their Vigor firmware.

Does anyone have an example of a working configuration?

Paul

---------- Forwarded message ----------
Date: Wed, 17 Dec 2003 01:20:51 +0100 (MET)
From: Paul Wouters <[email protected]>
Cc: Sam Sgro <[email protected]>, Ken Bantoft <[email protected]>
To: [email protected]
Subject: Vigor 2600 <-> FreeS/WAN esp bug


Hi,

I seem to have stumbled on an IPsec with the Vigor2600 Annex A.

In short, the IPsec tunnel establishes, and sends ESP packets from HostA
to HostB, and receives replies from HostB to HostA, but packets originating
from HostB to HostA are considered invalid ESP by FreeS/WAN.

I have put all the relevant configuration and logfiles up at
http://www.freeswan.org/draytek/

Below follows some more detailed information explaining the problem. Hopefully,
someone in your technical department can have a look at it to determine if this is
indeed a bug in the Vigor.

Regards,

Paul Wouters
FreeS/WAN Project.


#  Model
	: Vigor2600 annex A
# Firmware Version
	: v2.5_H
# Build Date/Time
	: Sat Aug 30 11:45:6.91 2003

I have setup an IPsec tunnel from the Vigor to freeswan (superfreeswan-1.99.8).
This is the network as used for which I've made logs, though we have tested this
to other networks as well.

LAN1            Vigor-eth       ivgor-adsl        internet   freeswan-adsl    freeswan-eth     LAN2
10.10.20.0/24 - 10.10.20.1 --- 194.109.161.130  -----[]----- 80.126.230.84 --- 10.20.30.1 --- 10.20.30.0/24 

The FreeS/WAN configuration is:

conn vigor-freeswan
	left=80.126.230.84
	leftnexthop=195.190.244.80
	leftsubnet=10.20.30.0/24
        right=194.109.161.130
        rightsubnet=10.10.20.0/24
        auto=start
        authby=secret
	pfs=no
	#pfs=yes
        auth=esp
        #esp=3des-sha-96
        keyingtries=1
        #ike=3des-sha-96
        #pfsgroup=modp1536

(comments are options we've tried which dont seem to matter)

On the vigor we configured:

VPN and Remote Access Setup ->    VPN IKE / IPSec General Setup
	 Pre-Shared Key 	
	 Medium AH (tried with and without)
	 High (ESP) 3DES only 

VPN and Remote Access Setup ->  LAN-to-LAN Profile Setup
	connection-name

COMMON SETTINGS

		Enable profile
	Call Direction 	Both Dial-Out Dial-In 
(we tried them all. The only difference seems to be that if dial-out is selected and
the  freeswan box starts the IPsec tunnel, it will get deleted (inclusive delete-notify)
as soon as it gets established. We mostly kept it in "both")
	Always on was lfet off, it always seems to break th connection like above
	idle timeout (3600)
	Enable ping left disabled

Dial-Out Settings
	Only enable IPsec tunnel. (Server IP/Host Name for VPN. 80.126.230.84)
	IPSec Security Method: High (ESP) 3DES with Authentication
	Advanced:
		Main mode
		PFS (yes and no tried)
		KE phase 1 proposal 3DES_SHA1_G1

Dail-in settings:
	IPSec Tunnel ( Specify Remote VPN Gateway Peer VPN Server IP 80.126.230.84)
	Medium (AH) tried with and without
	High (ESP) 3DES only

 TCP/IP Network Settings
	 My WAN IP 	0.0.0.0
  Remote Gateway IP 	0.0.0.0
  Remote Network IP 	10.20.30.0
  Remote Network Mask	255.255.25.0
RIP disabled.
For NAT operation, treat remote sub-net as private (tried both)
 Change default route to this VPN tunnel (not used)


This works almost perfectly. The machines setup an ISAKMP, and then an IPsec SA.
I can then ping from 10.20.30.2 to 10.10.20.2 and I receive a reply. I can see the ESP
packets when sniffing the ppp0 interface, and I can see the icmp packets when sniffing
the ipsec0 interface.
But then the odd thing. I ssh from 10.20.30.2 to 10.10.20.2 over the IPsec tunnel, and
then ping from 10.10.20.2 to 10.20.30.2. ESP packets go out (I've also seen udp packetrs,
indicating nat-traversal, even though that isn't neccessary here, both IP's are public,
and I'm not sure why the vigor is sending from port 4500 (nat-t). perhaps this is the private
or public subnet setting?). But freeswan is dropping these ESP packets. Turning on KLIPS
debuggin in freeswan shows:

Dec 16 09:51:58 nsavax kernel: klips_debug:   IP: ihl:20 ver:4 tos:0 tlen:104 id:11369 frag_off:0 ttl:57 proto:50 chk:47697 saddr:194.109.161.130 daddr:80.126.230.84
Dec 16 09:51:58 nsavax kernel: klips_debug:   @000: 2e cf 75 04 00 00 15 a9 9b 02 53 83 f0 39 00 f8
Dec 16 09:51:58 nsavax kernel: klips_debug:   @010: bc af a5 24 99 00 1b 73 0f 08 e7 6a e4 bc 0d 2f
Dec 16 09:51:58 nsavax kernel: klips_debug:   @020: 1c 14 61 24 ea be 70 1a 3e fd 6b 06 02 bc 07 e8
Dec 16 09:51:58 nsavax kernel: klips_debug:   @030: a3 c9 96 57 c0 86 5f 89 0d 88 ff 71 3b 5d bb 44
Dec 16 09:51:58 nsavax kernel: klips_debug:   @040: a6 11 72 dc f3 e3 10 e1 5c 19 5b fb 65 14 3d de
Dec 16 09:51:58 nsavax kernel: klips_debug:   @050: d3 98 0f 5c
Dec 16 09:51:58 nsavax kernel: klips_debug:gettdb: linked entry in tdb table for hash=102 of SA:[email protected] requested.
Dec 16 09:51:58 nsavax kernel: klips_debug:gettdb: no entries in tdb table for hash=102 of SA:[email protected].
Dec 16 09:51:58 nsavax kernel: klips_debug:ipsec_rcv: no Tunnel Descriptor Block for SA:[email protected]: incoming packet with no SA dropped

So it seems the packet that Vigor sends out somehow isnt matched with one of our known tunnels. Note that the IPsec SA at
this point is still up, and I'm still sending and receiving packets over my ssh session over those same tunnels! Only
packets generated from the vigor's LAN itself seem to die.Reply packets to our own packets sem to travel through the
tunnel fine.

Freeswan state and logs, and vigor config and syslog files are located at
http://www.freeswan.org/draytek/