(racoon 655) Re: [Solved]: Two simmetrical configuration but two different results

Il ven, 2004-08-20 alle 12:09, Satoshi Inoue ha scritto:

> Are you sure that "sainfo address ..." on this side is configured
> correctly? You may try on "anonymous" if it works or not.

Thank you for the hint. I try to set anonymous and while it doesn't
work, I'm able to find the error watching the log and then resume the
original racoon.conf (i.e. without the anonynous), modify it an running
succesfully racoon.

It was sufficient to modify the racoon-tool.conf file in order to add
the missing sainfo stanza: 

sainfo address xxx.xxx.37.118[any] any address 192.168.1.0/24[any] any 
...

sainfo address 192.168.1.0/24[any] any address xxx.xxx.37.118[any] any 
...

This let racoon-tool to generate also the missing spd entries i.e.

xxx.xxx.37.118[any] 192.168.1.0/24[any] any
	in ipsec
	ipcomp/tunnel/xxx.xxx.37.118-xxx.xxx.151.70/use
	esp/tunnel/xxx.xxx.37.118-xxx.xxx.151.70/unique#16385
192.168.100.0/24[any] xxx.xxx.151.70[any] any
	in ipsec
	ipcomp/tunnel/xxx.xxx.37.118-xxx.xxx.151.70/use
	esp/tunnel/xxx.xxx.37.118-xxx.xxx.151.70/unique#16387
xxx.xxx.151.70[any] 192.168.100.0/24[any] any
	in ipsec
	ipcomp/tunnel/xxx.xxx.37.118-xxx.xxx.151.70/use
	esp/tunnel/xxx.xxx.37.118-xxx.xxx.151.70/unique#16389
192.168.1.0/24[any] xxx.xxx.37.118[any] any
	in ipsec
	ipcomp/tunnel/xxx.xxx.37.118-xxx.xxx.151.70/use
	esp/tunnel/xxx.xxx.37.118-xxx.xxx.151.70/unique#16391
192.168.1.0/24[any] xxx.xxx.37.118[any] any
	out ipsec
	ipcomp/tunnel/xxx.xxx.151.70-xxx.xxx.37.118/use
	esp/tunnel/xxx.xxx.151.70-xxx.xxx.37.118/unique#16384
xxx.xxx.151.70[any] 192.168.100.0/24[any] any
	out ipsec
	ipcomp/tunnel/xxx.xxx.151.70-xxx.xxx.37.118/use
	esp/tunnel/xxx.xxx.151.70-xxx.xxx.37.118/unique#16386
192.168.100.0/24[any] xxx.xxx.151.70[any] any
	out ipsec
	ipcomp/tunnel/xxx.xxx.151.70-xxx.xxx.37.118/use
	esp/tunnel/xxx.xxx.151.70-xxx.xxx.37.118/unique#16388
xxx.xxx.37.118[any] 192.168.1.0/24[any] any
	out ipsec
	ipcomp/tunnel/xxx.xxx.151.70-xxx.xxx.37.118/use
	esp/tunnel/xxx.xxx.151.70-xxx.xxx.37.118/unique#16390

However this let me two other questions:
1) Is the ipcomp tunnel generated by the racoon tool appropriate (I have
never see it in the vpn's howtos and I don't know what it is)?
2) While in the log the ESP and IPCOMP tunnel appear to be established,
if I try to ping I don't receive any answer ... and also, if I stop the
racoon and flush all the spd and sad entries, the ping to 192.168.100.1
begin to work!

Thank you in advance for any advice

ciao, Michele