(racoon 656) The tunnel is active and now?
Michele Bendazzoli <[email protected]>
| Newsgroups | gmane.network.ipv6.kame.racoon |
|---|---|
| Organization | Micky Mouse |
| Message-ID | <[email protected]> |
I'm here again hoping that someone can help me another time. I thought that setting up a vpn from two nodes was all I need to let the two nodes comunicate but that thought was made a big mistake! In fact if I check the log: Aug 23 10:12:07 localhost racoon: INFO: initiate new phase 1 negotiation: xxx.xxx.151.70[500]<=>xxx.xxx.37.118[500] Aug 23 10:12:07 localhost racoon: INFO: begin Identity Protection mode. Aug 23 10:12:08 localhost racoon: INFO: ISAKMP-SA established xxx.xxx.151.70[500]-xxx.xxx.37.118[500] spi:4e919c51385179ed:945be96bd926dc71 Aug 23 10:12:09 localhost racoon: INFO: initiate new phase 2 negotiation: xxx.xxx.151.70[0]<=>xxx.xxx.37.118[0] Aug 23 10:12:09 localhost racoon: ERROR: IPComp SPI size promoted from 16bit to 32bit Aug 23 10:12:11 localhost racoon: INFO: IPsec-SA established: ESP/Tunnel xxx.xxx.37.118->xxx.xxx.151.70 spi=183323770(0xaed4c7a) Aug 23 10:12:11 localhost racoon: INFO: IPsec-SA established: IPCOMP/Tunnel xxx.xxx.37.118->xxx.xxx.151.70 spi=19505(0x4c31) Aug 23 10:12:11 localhost racoon: INFO: IPsec-SA established: ESP/Tunnel xxx.xxx.151.70->xxx.xxx.37.118 spi=23602440(0x1682508) Aug 23 10:12:11 localhost racoon: INFO: IPsec-SA established: IPCOMP/Tunnel xxx.xxx.151.70->xxx.xxx.37.118 spi=31023(0x792f) The tunnel seems to be established (so is in the log of the other end of the tunnell). But if I try to ping from the gateway 1 (eth0=xxx.xxx.151.70 eth1=192.168.1.1) to the 192.168.100.1 of the gateway2 (eth0 =xxx.xxx.37.118, eth1=192.168.100.1) and watch with tcpdump to the eth0 traffic of the gateway2 do i see this this extract (there was active also a ssh section from a 192.168.1.27 node of the lan behind the gateway 1 and xxx.xxx.37.118 of the gateway2): 09:07:38.050057 IP ip-a1-37118.keycomm.it.ssh > host70-151.pool80183.interbusiness.it.33193: P 4202940343:4202940455(112) ack 3873785114 win 10336 <nop,nop,timestamp 308919757 9468220> 09:07:38.065408 IP ip-a1-37118.keycomm.it.1024 > ns1.keycomm.it.domain: 18510+% [1au] PTR? 118.37.xxx.xxx.in-addr.arpa. (55) 09:07:38.117524 IP ns1.keycomm.it.domain > ip-a1-37118.keycomm.it.1024: 18510* 1/2/3 (159) 09:07:38.118526 IP host70-151.poolxxxxxx.interbusiness.it.33193 > ip-a1-37118.keycomm.it.ssh: . ack 0 win 619 <nop,nop,timestamp 9468337 308919716> 09:07:38.118603 IP ip-a1-37118.keycomm.it.ssh > host70-151.poolxxxxxx.interbusiness.it.33193: P 112:224(112) ack 1 win 10336 <nop,nop,timestamp 308919826 9468337> 09:07:38.120217 IP ip-a1-37118.keycomm.it.1024 > ns1.keycomm.it.domain: 42023+% [1au] PTR? 7.33.xxx.xxx.in-addr.arpa. (53) 09:07:38.162374 IP host70-151.poolxxxxxx.interbusiness.it.33193 > ip-a1-37118.keycomm.it.ssh: . ack 112 win 619 <nop,nop,timestamp 9468379 308919757> 09:07:38.173371 IP ns1.keycomm.it.domain > ip-a1-37118.keycomm.it.1024: 42023* 1/2/3 PTR[|domain] 09:07:38.236493 IP host70-151.poolxxxxxx.interbusiness.it.33193 > ip-a1-37118.keycomm.it.ssh: . ack 224 win 619 <nop,nop,timestamp 9468448 308919826> 09:07:38.266800 IP host70-151.poolxxxxxx.interbusiness.it > ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x4b) 09:07:39.268999 IP host70-151.poolxxxxxx.interbusiness.it > ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x4c) 09:07:40.270145 IP host70-151.poolxxxxxx.interbusiness.it > ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x4d) 09:07:41.269208 IP host70-151.poolxxxxxx.interbusiness.it > ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x4e) 09:07:42.268273 IP host70-151.poolxxxxxx.interbusiness.it > ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x4f) 09:07:43.268376 IP host70-151.poolxxxxxx.interbusiness.it > ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x50) 09:07:44.267958 IP host70-151.poolxxxxxx.interbusiness.it > ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x51) 09:07:45.270674 IP host70-151.poolxxxxxx.interbusiness.it > ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x52) 09:07:46.268165 IP host70-151.poolxxxxxx.interbusiness.it > ip-a1-37118.keycomm.it: ESP(spi=0x01682508,seq=0x53) 09:07:47.222319 IP host70-151.poolxxxxxx.interbusiness.it.33193 > ip-a1-37118.keycomm.it.ssh: P 1:49(48) ack 224 win 619 <nop,nop,timestamp 9477437 308919826> I.e. It seems that the packets go to gateway2 via esp but that no response come back to gateway 1. Can the problem be related to the fact that there is also a ipcomp tunnel established (but i don't see any traffic go through it)? Can some one give me some hint where i can look to find an answer? Any help will be great appreciate. ciao, Michele