(racoon 656) The tunnel is active and now?

Michele Bendazzoli <[email protected]>
Newsgroups gmane.network.ipv6.kame.racoon
Organization Micky Mouse
Message-ID <[email protected]>
I'm here again hoping that someone can help me another time.

I thought that setting up a vpn from two nodes was all I need to let the
two nodes comunicate but that thought was made a big mistake!

In fact if I check the log:

Aug 23 10:12:07 localhost racoon: INFO: initiate new phase 1
negotiation: xxx.xxx.151.70[500]<=>xxx.xxx.37.118[500] 
Aug 23 10:12:07 localhost racoon: INFO: begin Identity Protection mode. 
Aug 23 10:12:08 localhost racoon: INFO: ISAKMP-SA established
xxx.xxx.151.70[500]-xxx.xxx.37.118[500]
spi:4e919c51385179ed:945be96bd926dc71 
Aug 23 10:12:09 localhost racoon: INFO: initiate new phase 2
negotiation: xxx.xxx.151.70[0]<=>xxx.xxx.37.118[0] 
Aug 23 10:12:09 localhost racoon: ERROR: IPComp SPI size promoted from
16bit to 32bit 
Aug 23 10:12:11 localhost racoon: INFO: IPsec-SA established: ESP/Tunnel
xxx.xxx.37.118->xxx.xxx.151.70 spi=183323770(0xaed4c7a) 
Aug 23 10:12:11 localhost racoon: INFO: IPsec-SA established:
IPCOMP/Tunnel xxx.xxx.37.118->xxx.xxx.151.70 spi=19505(0x4c31) 
Aug 23 10:12:11 localhost racoon: INFO: IPsec-SA established: ESP/Tunnel
xxx.xxx.151.70->xxx.xxx.37.118 spi=23602440(0x1682508) 
Aug 23 10:12:11 localhost racoon: INFO: IPsec-SA established:
IPCOMP/Tunnel xxx.xxx.151.70->xxx.xxx.37.118 spi=31023(0x792f) 

The tunnel seems to be established (so is in the log of the other end of
the tunnell).

But if I try to ping from the gateway 1 (eth0=xxx.xxx.151.70
eth1=192.168.1.1) to the 192.168.100.1 of the gateway2 (eth0
=xxx.xxx.37.118, eth1=192.168.100.1) and watch with tcpdump to the eth0
traffic of the gateway2 do i see this this extract (there was active
also a ssh section from a 192.168.1.27 node of the lan behind the
gateway 1 and xxx.xxx.37.118 of the gateway2):

09:07:38.050057 IP ip-a1-37118.keycomm.it.ssh >
host70-151.pool80183.interbusiness.it.33193: P
4202940343:4202940455(112) ack 3873785114 win 10336 <nop,nop,timestamp
308919757 9468220>
09:07:38.065408 IP ip-a1-37118.keycomm.it.1024 > ns1.keycomm.it.domain: 
18510+% [1au] PTR? 118.37.xxx.xxx.in-addr.arpa. (55)
09:07:38.117524 IP ns1.keycomm.it.domain > ip-a1-37118.keycomm.it.1024: 
18510* 1/2/3 (159)
09:07:38.118526 IP host70-151.poolxxxxxx.interbusiness.it.33193 >
ip-a1-37118.keycomm.it.ssh: . ack 0 win 619 <nop,nop,timestamp 9468337
308919716>
09:07:38.118603 IP ip-a1-37118.keycomm.it.ssh >
host70-151.poolxxxxxx.interbusiness.it.33193: P 112:224(112) ack 1 win
10336 <nop,nop,timestamp 308919826 9468337>
09:07:38.120217 IP ip-a1-37118.keycomm.it.1024 > ns1.keycomm.it.domain: 
42023+% [1au] PTR? 7.33.xxx.xxx.in-addr.arpa. (53)
09:07:38.162374 IP host70-151.poolxxxxxx.interbusiness.it.33193 >
ip-a1-37118.keycomm.it.ssh: . ack 112 win 619 <nop,nop,timestamp 9468379
308919757>
09:07:38.173371 IP ns1.keycomm.it.domain > ip-a1-37118.keycomm.it.1024: 
42023* 1/2/3 PTR[|domain]
09:07:38.236493 IP host70-151.poolxxxxxx.interbusiness.it.33193 >
ip-a1-37118.keycomm.it.ssh: . ack 224 win 619 <nop,nop,timestamp 9468448
308919826>
09:07:38.266800 IP host70-151.poolxxxxxx.interbusiness.it >
ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x4b)
09:07:39.268999 IP host70-151.poolxxxxxx.interbusiness.it >
ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x4c)
09:07:40.270145 IP host70-151.poolxxxxxx.interbusiness.it >
ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x4d)
09:07:41.269208 IP host70-151.poolxxxxxx.interbusiness.it >
ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x4e)
09:07:42.268273 IP host70-151.poolxxxxxx.interbusiness.it >
ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x4f)
09:07:43.268376 IP host70-151.poolxxxxxx.interbusiness.it >
ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x50)
09:07:44.267958 IP host70-151.poolxxxxxx.interbusiness.it >
ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x51)
09:07:45.270674 IP host70-151.poolxxxxxx.interbusiness.it >
ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x52)
09:07:46.268165 IP host70-151.poolxxxxxx.interbusiness.it >
ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x53)
09:07:47.222319 IP host70-151.poolxxxxxx.interbusiness.it.33193 >
ip-a1-37118.keycomm.it.ssh: P 1:49(48) ack 224 win 619
<nop,nop,timestamp 9477437 308919826>

I.e. It seems that the packets go to gateway2 via esp but that no
response come back to gateway 1. Can the problem be related to the fact
that there is also a ipcomp tunnel established (but i don't see any
traffic go through it)? 

Can some one give me some hint where i can look to find an answer?
Any help will be great appreciate.

ciao, Michele
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.