(racoon 663) Re: dynamic tunneling

Il mar, 2004-08-24 alle 10:11, Juan Antonio Martínez Navarro ha scritto:

> I can set up dinamically ths spd and sad entries, but i work with
> preshared keys. What I wan to know is if I can add newest entries to the
> racoon.conf file like "remote ...." and "sainfo ..." for a new tunnel to
> another host without restarting racoon daemon.
> 
> Is it possible? thanks.

>From what i read in the howtos, the only possibility is to use the
anonymous target: it is not necessary to use the preshared keys however
if you set the peer_identifier and my_identifier with asn1dn, and the
certificate to authenticate. You don't need the exchange_mode aggressive
neither. In www.ipsec-howto.org there is a road-warrior paragraph that
explain this if I remember correctly.

However i have talk too much quickly, because the setup I use with ...
remote anonymous  and passive on and generate_policy on doesn't work for
me: sigh! I attach the log, maybe there is a kind samaritan that can
help me.

It try to generate the policy but at one time it fails: 

...
Aug 24 18:52:04 sargefire racoon: INFO: no policy found, try to generate
the policy : 80.183.151.70/32[0] 192.168.100.0/24[0] proto=any dir=in 
Aug 24 18:52:04 sargefire racoon: DEBUG: total SA len=82 
Aug 24 18:52:04 sargefire racoon: DEBUG:  00000001 00000001 02000028
01030401 030486e0 0000001c 01030000 80010001 800204b0 80040001 80050002
80030002 00000022 01040201 6ea10000 00180102 00008001 00018002 04b08004
00018003 0002 
Aug 24 18:52:04 sargefire racoon: DEBUG: begin. 
Aug 24 18:52:04 sargefire racoon: DEBUG: seen nptype=2(prop) 
Aug 24 18:52:04 sargefire racoon: DEBUG: seen nptype=2(prop) 
Aug 24 18:52:04 sargefire racoon: DEBUG: succeed. 
Aug 24 18:52:04 sargefire racoon: DEBUG: proposal #1 len=40 
Aug 24 18:52:04 sargefire racoon: DEBUG: begin. 
Aug 24 18:52:04 sargefire racoon: DEBUG: seen nptype=3(trns) 
Aug 24 18:52:04 sargefire racoon: DEBUG: succeed. 
Aug 24 18:52:04 sargefire racoon: DEBUG: transform #1 len=28 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=SA Life Type, flag=0x8000,
lorv=seconds 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=SA Life Duration,
flag=0x8000, lorv=1200 
Aug 24 18:52:04 sargefire racoon: DEBUG: life duration was in TLV. 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Encryption Mode,
flag=0x8000, lorv=Tunnel 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Authentication Algorithm,
flag=0x8000, lorv=hmac-sha 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Group Description,
flag=0x8000, lorv=2 
Aug 24 18:52:04 sargefire racoon: DEBUG: hmac(modp1024) 
Aug 24 18:52:04 sargefire racoon: DEBUG: proposal #1 len=34 
Aug 24 18:52:04 sargefire racoon: DEBUG: begin. 
Aug 24 18:52:04 sargefire racoon: DEBUG: seen nptype=3(trns) 
Aug 24 18:52:04 sargefire racoon: DEBUG: succeed. 
Aug 24 18:52:04 sargefire racoon: DEBUG: transform #1 len=24 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=1, flag=0x8000,
lorv=0x0001 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=2, flag=0x8000,
lorv=0x04b0 
Aug 24 18:52:04 sargefire racoon: DEBUG: life duration was in TLV. 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=4, flag=0x8000,
lorv=0x0001 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=3, flag=0x8000,
lorv=0x0002 
Aug 24 18:52:04 sargefire racoon: DEBUG: hmac(modp1024) 
Aug 24 18:52:04 sargefire racoon: DEBUG: pair 1: 
Aug 24 18:52:04 sargefire racoon: DEBUG:  0x80ace78: next=0x80ace90
tnext=(nil) 
Aug 24 18:52:04 sargefire racoon: DEBUG:   0x80ace90: next=(nil)
tnext=(nil) 
Aug 24 18:52:04 sargefire racoon: DEBUG: proposal #1: 2 transform 
Aug 24 18:52:04 sargefire racoon: DEBUG: prop#=1 prot-id=ESP spi-size=4
#trns=1 trns#=1 trns-id=3DES 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=SA Life Type, flag=0x8000,
lorv=seconds 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=SA Life Duration,
flag=0x8000, lorv=1200 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Encryption Mode,
flag=0x8000, lorv=Tunnel 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Authentication Algorithm,
flag=0x8000, lorv=hmac-sha 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Group Description,
flag=0x8000, lorv=2 
Aug 24 18:52:04 sargefire racoon: DEBUG: prop#=1 prot-id=IPCOMP
spi-size=2 #trns=1 trns#=1 trns-id=DEFLATE 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=SA Life Type, flag=0x8000,
lorv=seconds 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=SA Life Duration,
flag=0x8000, lorv=1200 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Encryption Mode,
flag=0x8000, lorv=Tunnel 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Group Description,
flag=0x8000, lorv=2 
Aug 24 18:52:04 sargefire racoon: DEBUG: make a proposal from peer's: 
Aug 24 18:52:04 sargefire racoon: DEBUG:  (proto_id=IPCOMP spisize=2
spi=00000000 spi_p=00006ea1 encmode=Tunnel reqid=0:0) 
Aug 24 18:52:04 sargefire racoon: DEBUG:   (trns_id=DEFLATE) 
Aug 24 18:52:04 sargefire racoon: DEBUG: total SA len=82 
Aug 24 18:52:04 sargefire racoon: DEBUG:  00000001 00000001 02000028
01030401 030486e0 0000001c 01030000 80010001 800204b0 80040001 80050002
80030002 00000022 01040201 6ea10000 00180102 00008001 00018002 04b08004
00018003 0002 
Aug 24 18:52:04 sargefire racoon: DEBUG: begin. 
Aug 24 18:52:04 sargefire racoon: DEBUG: seen nptype=2(prop) 
Aug 24 18:52:04 sargefire racoon: DEBUG: seen nptype=2(prop) 
Aug 24 18:52:04 sargefire racoon: DEBUG: succeed. 
Aug 24 18:52:04 sargefire racoon: DEBUG: proposal #1 len=40 
Aug 24 18:52:04 sargefire racoon: DEBUG: begin. 
Aug 24 18:52:04 sargefire racoon: DEBUG: seen nptype=3(trns) 
Aug 24 18:52:04 sargefire racoon: DEBUG: succeed. 
Aug 24 18:52:04 sargefire racoon: DEBUG: transform #1 len=28 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=SA Life Type, flag=0x8000,
lorv=seconds 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=SA Life Duration,
flag=0x8000, lorv=1200 
Aug 24 18:52:04 sargefire racoon: DEBUG: life duration was in TLV. 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Encryption Mode,
flag=0x8000, lorv=Tunnel 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Authentication Algorithm,
flag=0x8000, lorv=hmac-sha 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Group Description,
flag=0x8000, lorv=2 
Aug 24 18:52:04 sargefire racoon: DEBUG: hmac(modp1024) 
Aug 24 18:52:04 sargefire racoon: DEBUG: proposal #1 len=34 
Aug 24 18:52:04 sargefire racoon: DEBUG: begin. 
Aug 24 18:52:04 sargefire racoon: DEBUG: seen nptype=3(trns) 
Aug 24 18:52:04 sargefire racoon: DEBUG: succeed. 
Aug 24 18:52:04 sargefire racoon: DEBUG: transform #1 len=24 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=1, flag=0x8000,
lorv=0x0001 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=2, flag=0x8000,
lorv=0x04b0 
Aug 24 18:52:04 sargefire racoon: DEBUG: life duration was in TLV. 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=4, flag=0x8000,
lorv=0x0001 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=3, flag=0x8000,
lorv=0x0002 
Aug 24 18:52:04 sargefire racoon: DEBUG: hmac(modp1024) 
Aug 24 18:52:04 sargefire racoon: DEBUG: pair 1: 
Aug 24 18:52:04 sargefire racoon: DEBUG:  0x80adae8: next=0x80a6898
tnext=(nil) 
Aug 24 18:52:04 sargefire racoon: DEBUG:   0x80a6898: next=(nil)
tnext=(nil) 
Aug 24 18:52:04 sargefire racoon: DEBUG: proposal #1: 2 transform 
Aug 24 18:52:04 sargefire racoon: DEBUG: begin compare proposals. 
Aug 24 18:52:04 sargefire racoon: DEBUG: pair[1]: 0x80adae8 
Aug 24 18:52:04 sargefire racoon: DEBUG:  0x80adae8: next=0x80a6898
tnext=(nil) 
Aug 24 18:52:04 sargefire racoon: DEBUG:   0x80a6898: next=(nil)
tnext=(nil) 
Aug 24 18:52:04 sargefire racoon: DEBUG: prop#=1 prot-id=ESP spi-size=4
#trns=1 trns#=1 trns-id=3DES 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=SA Life Type, flag=0x8000,
lorv=seconds 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=SA Life Duration,
flag=0x8000, lorv=1200 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Encryption Mode,
flag=0x8000, lorv=Tunnel 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Authentication Algorithm,
flag=0x8000, lorv=hmac-sha 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Group Description,
flag=0x8000, lorv=2 
Aug 24 18:52:04 sargefire racoon: DEBUG: prop#=1 prot-id=IPCOMP
spi-size=2 #trns=1 trns#=1 trns-id=DEFLATE 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=SA Life Type, flag=0x8000,
lorv=seconds 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=SA Life Duration,
flag=0x8000, lorv=1200 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Encryption Mode,
flag=0x8000, lorv=Tunnel 
Aug 24 18:52:04 sargefire racoon: DEBUG: type=Group Description,
flag=0x8000, lorv=2 
Aug 24 18:52:04 sargefire racoon: DEBUG: peer's single bundle: 
Aug 24 18:52:04 sargefire racoon: DEBUG:  (proto_id=ESP spisize=4
spi=030486e0 spi_p=00000000 encmode=Tunnel reqid=0:0) 
Aug 24 18:52:04 sargefire racoon: DEBUG:   (trns_id=3DES encklen=0
authtype=hmac-sha) 
Aug 24 18:52:04 sargefire racoon: DEBUG:  (proto_id=IPCOMP spisize=2
spi=00006ea1 spi_p=00000000 encmode=Tunnel reqid=0:0) 
Aug 24 18:52:04 sargefire racoon: DEBUG:   (trns_id=DEFLATE) 
Aug 24 18:52:04 sargefire racoon: DEBUG: my single bundle: 
Aug 24 18:52:04 sargefire racoon: DEBUG:  (proto_id=IPCOMP spisize=2
spi=00000000 spi_p=00006ea1 encmode=Tunnel reqid=0:0) 
Aug 24 18:52:04 sargefire racoon: DEBUG:   (trns_id=DEFLATE) 
Aug 24 18:52:04 sargefire racoon: ERROR: not matched 
Aug 24 18:52:04 sargefire racoon: ERROR: no suitable policy found. 
Aug 24 18:52:04 sargefire racoon: ERROR: failed to pre-process packet. 
Aug 24 18:52:04 sarg
...

ciao, Michele