(racoon 670) Problem connecting freeswan to racoon using different source IPs

Hi,

	I'm trying to build two IPSec connections between a freeswan box and a
racoon one. These two connections will be between two different IPs in the
racoon box to the same IP in the freeswan box. And while doing this with
racoon in both sides works perfectly (or so it seems, at least :-)), I can't
get it working with freeswan in one side. And as replacing freeswan for racoon
in that box is not an option, for many reasons, I'm asking here to see if
someone can help me :-)

	What happens is that the first connection (using the first IP of the
racoon box) is built without problems; but the second one never completes
phase 1. I've been doing a little tcpdumping, and it seems that the racoon box
answers to freeswan's requests for phase 1 with its first IP, not the second
(when trying to stablish the second connection, which should be done using the
second IP).

	I'm using PSK for authentication, and the passphrase is the same in
both connections. Let me show you the configurations. I'm using racoon-tool,
and this is what I have in racoon-tool.conf (in the racoon box, obviously
:-)):

global:
        log: debug

connection(muk-orion):
        src_ip: 192.168.20.69
        dst_ip: 192.168.20.221
        admin_status: enabled
        authentication_algorithm: hmac_md5

connection(kum-orion):
        src_ip: 192.168.20.200
        dst_ip: 192.168.20.221
        admin_status: enabled
        authentication_algorithm: hmac_md5

peer(192.168.20.221):
        proposal_check: claim
        verify_identifier: off

	As you've surely guessed, "muk" is the name of the racoon box, and
"orion" is the freeswan one. muk's IPs are 192.168.20.69 and 192.168.20.200
("kum" is just meant to be a name for the second IP at muk), while orion's is
192.168.20.221. And the configuration in the freeswan side:

config setup
        interfaces="ipsec0=eth0"

conn %default
        rightrsasigkey=%cert
        leftrsasigkey=%cert

conn orion-muk
        left=192.168.20.221
        right=192.168.20.69
        authby=secret
        type=transport
        auto=start

conn orion-kum
        left=192.168.20.221
        right=192.168.20.200
        authby=secret
        type=transport
        auto=start

	Now, a bit of the logs. I used racoon in debug mode, and it "spat" out
a lot of messages. There are a few intriguing ones: racoon says it's using the
source IP 192.168.20.200 (the second IP), but tcpdump reveals no traffic from
that IP. Instead, I see traffic from 192.168.20.69, racoon's box's first IP.

	Here's the debug logs of racoon for one of this exchanges:

Aug 26 17:15:58 muk racoon: DEBUG: ===
Aug 26 17:15:58 muk racoon: DEBUG: 176 bytes message received from 192.168.20.221[500] to 192.168.20.200[500]
Aug 26 17:15:58 muk racoon: DEBUG:  dcda55c3 d788e989 00000000 00000000 01100200 00000000 000000b0 00000094 000 00001 00000001 00000088 00010004 03000020 00010000 800b0001 800c0e10 80010005 80020001 80030001 80040005 030000 20 01010000 800b0001 800c0e10 80010005 80020002 80030001 80040005 03000020 02010000 800b0001 800c0e10 80010005 80020001 80030001 80040002 00000020 03010000 800b0001 800c0e10 80010005 80020002 80030001 80040002
Aug 26 17:15:58 muk racoon: DEBUG: sockname 192.168.20.200[500]
Aug 26 17:15:58 muk racoon: DEBUG: send packet from 192.168.20.200[500]
Aug 26 17:15:58 muk racoon: DEBUG: send packet to 192.168.20.221[500]
Aug 26 17:15:58 muk racoon: DEBUG: src4 192.168.20.200[500]
Aug 26 17:15:58 muk racoon: DEBUG: dst4 192.168.20.221[500]
Aug 26 17:15:58 muk racoon: DEBUG: 1 times of 80 bytes message will be sent to 192.168.20.200[500]
Aug 26 17:15:58 muk racoon: DEBUG:  dcda55c3 d788e989 9fe79368 0824dc0c 01100200 00000000 00000050 00000034 000 00001 00000001 00000028 00010001 00000020 03010000 800b0001 800c0e10 80010005 80020002 80030001 80040002
Aug 26 17:15:58 muk racoon: NOTIFY: the packet is retransmitted by 192.168.20.221[500].

	(I'm not sure about the last line: I just picked all ocurrences at
17:15:58 :-))

	And now, here's what tcpdump saw on the line at that time:

17:15:58.922911 IP 192.168.20.221.500 > 192.168.20.200.500: isakmp: phase 1 I ident
17:15:58.924161 IP 192.168.20.69.500 > 192.168.20.221.500: isakmp: phase 1 ?  ident

	So, it seems that muk did answer with the wrong IP for the exchange.
Though racoon says otherwise :-m

	Any idea about what can be happening? Am I doing something wrong?

	If I can provide any other information to help debug this, just ask.
Thanks in advance :-)

-- 
Roberto Suarez Soto					Alfa21 Outsourcing
    [email protected]				     http://www.alfa21.com