(racoon 669) Re: NetScreen 5xp and racoon on OS X

OK.

Using Racoon, racoon.conf, psk.txt, and a shell script I put together I 
can now connect to the NetScreenon the remote network.

I still can not get Pings, or browsing back to the Mac. I see the 
message arrive in the log on the netscreen, but nothing is (appears to 
be)  returned to the Mac. And this is where I am now stuck.

I am essentially doing HOST-to-NETWORK, so I have set up my policies as 
follows. I am trying to access any machine on the remote network.

MAC (192.168.0.39) <-----> External Router (67.1.1.1) <----- NET ----> 
Netscreen(63.2.2.2) <-----> Internal Network (199.9.23.0).

The first 2 lines I don't really understand. I assume they are setting 
up the routing. I'll read the guide for ifconfig tomorrow. But the 
first line which I have commented out gave a create error.

#ifconfig gif0 create
ifconfig gif0 tunnel 192.168.0.39 63.2.2.2

setkey -FP
setkey -F
# Add the policy
setkey -c <<EOF
spdadd 192.168.0.0/24 199.9.23.0/24 any -P out ipsec
  esp/tunnel/192.168.0.39-63.2.2.2/require;
spdadd 199.9.23.0/24 192.168.0.0/24 any -P in ipsec
  esp/tunnel/63.2.2.2-192.168.0.39/require;
EOF


Any ideas?

















I read somewhere that I needed to create the interfaces with something 
like this.. but it did not work I got an error,, ifconfig: 
SIOCIFCREATE: Invalid argument

ifconfig gif0 create
ifconfig gif0 tunnel   67.222.555.222    63.777.888.222




On Aug 25, 2004, at 8:16 AM, Waldemar Brodkorb wrote:

> Hi,
> ucs308 wrote,
>
>> I have tried using VPNTracker and IPSecuritas both based on Racoon. I
>> get the same results from both tools. I am using Mac OS X 10.3.4. I
>> have a couple of machines on the same network, 192.168.0.30 (PC) and
>> 192.168.0.40 (Mac). On the PC I am using NetScreen Secure Remote
>> Client,  and all works well.
>>
>> When I try and connect from the Mac to the NetScreen, I can see by
>> looking in the netscreen logs that the tunnel is established. I can
>> ping the remote network, and I see the pings arrive (again in the
>> netscreen logs). But I never  get those pings back to the Mac. The
>> complete log can be found below.
>>
>> My pre-shared key has been entered correctly, and the local identifier
>> is set to a domain name. I have the PC on the same network connected 
>> to
>> the same hub, and it works well over the vpn connection.
>>
>> Am I supposed to try and eliminate the warning/notify messages?
>> How does racoon ensure the routes are updated to ensure traffic will
>> return?
>>
>> Any other ideas?
>
> Try your own setkey and racoon.conf configuration and start it from
> your terminal with sudo. (racoon can be started in debug mode)
>
> If it still not work, show us your configs and the debug output.
>
> We are using some Apple scripts for racoon/setkey and it worked
> better than IPsecuritas or VPN-Tracker.
>
> bye
>     Waldemar
>
>