(racoon 677) racoon & ppc2003 Again

Hello All, I'm try to configure IPSec/L2TP Tunnelling with RedHat AS3.0
and Racoon, my client is Pocket Pc 2003. I'v  followed the doc at:

http://www.funknet.org/doc/tunnel/l2tp.html

without success, after a while I'have:

with racoon 0.2.5-0.5 (rh version):

INFO: pfkey.c:1127:pk_recvupdate(): IPsec-SA established: ESP/Transport 
192.168.1.229->192.168.1.252 spi=186287602(0xb1a85f2)
INFO: pfkey.c:1348:pk_recvadd(): IPsec-SA established: ESP/Transport 
192.168.1.252->192.168.1.229 spi=13868768(0xd39ee0)
ERROR: pfkey.c:1941:pk_recvspdupdate(): such policy does not already 
exist: 192.168.1.229/32[1701] 192.168.1.252/32[1701] proto=udp dir=in
ERROR: pfkey.c:1941:pk_recvspdupdate(): such policy does not already 
exist: 192.168.1.252/32[1701] 192.168.1.229/32[1701] proto=udp dir=out

with racoon 0.3.3 (tar.gz):

INFO: respond new phase 2 negotiation: 192.168.1.252[0]<=>192.168.1.229[0]
INFO: IPsec-SA established: ESP/Transport 192.168.1.229->192.168.1.252 
spi=121098737(0x737d1f1)
INFO: IPsec-SA established: ESP/Transport 192.168.1.252->192.168.1.229 
spi=13883680(0xd3d920)

after 30 seconds:

INFO: purged IPsec-SA proto_id=ESP spi=13887024.
INFO: purged ISAKMP-SA proto_id=ISAKMP 
spi=8c855f33b2cd0808:e7153dbeccb01372.
INFO: ISAKMP-SA deleted 192.168.1.252[500]-192.168.1.229[500] 
spi:8c855f33b2cd0808:e7153dbeccb01372

my /etc/racoon/racoon.conf:

log notify;
path pre_shared_key "/etc/racoon/psk.txt";
 
listen {
        isakmp 192.168.1.252 [500];
}
 
padding
{
        maximum_length 20;      # maximum padding length.
        randomize off;          # enable randomize length.
        strict_check off;       # enable strict check.
        exclusive_tail off;     # extract last one octet.
}
 
remote anonymous {
        exchange_mode aggressive,main;
        doi ipsec_doi;
        situation identity_only;
        generate_policy on;
        proposal_check obey;
        passive on;
        proposal {
                encryption_algorithm 3des;
                hash_algorithm sha1;
                authentication_method pre_shared_key;
                dh_group modp1024;
        }
}
 
sainfo anonymous {
        pfs_group 2;
        lifetime time 28800 sec;
        encryption_algorithm 3des ;
        authentication_algorithm hmac_md5;
        compression_algorithm deflate ;
}

with racoon 0.2.2.5 I have:

INFO: pfkey.c:1127:pk_recvupdate(): IPsec-SA established: ESP/Transport 
192.168.1.229->192.168.1.252 spi=186287602(0xb1a85f2)
INFO: pfkey.c:1348:pk_recvadd(): IPsec-SA established: ESP/Transport 
192.168.1.252->192.168.1.229 spi=13868768(0xd39ee0)
ERROR: pfkey.c:1941:pk_recvspdupdate(): such policy does not already 
exist: 192.168.1.229/32[1701] 192.168.1.252/32[1701] proto=udp dir=in
ERROR: pfkey.c:1941:pk_recvspdupdate(): such policy does not already 
exist: 192.168.1.252/32[1701] 192.168.1.229/32[1701] proto=udp dir=out

with racoon 0.3.3:

INFO: respond new phase 2 negotiation: 192.168.1.252[0]<=>192.168.1.229[0]
INFO: IPsec-SA established: ESP/Transport 192.168.1.229->192.168.1.252 
spi=121098737(0x737d1f1)
INFO: IPsec-SA established: ESP/Transport 192.168.1.252->192.168.1.229 
spi=13883680(0xd3d920)

afeter 30 seconds:

INFO: purged IPsec-SA proto_id=ESP spi=13887024.
INFO: purged ISAKMP-SA proto_id=ISAKMP 
spi=8c855f33b2cd0808:e7153dbeccb01372.
INFO: ISAKMP-SA deleted 192.168.1.252[500]-192.168.1.229[500] 
spi:8c855f33b2cd0808:e7153dbeccb01372

my ipsec-policy:

#!/bin/sh
/sbin/setkey -FP
/sbin/setkey -F
/sbin/setkey -c << EOF
 
spdadd 192.168.1.252[1701] 0.0.0.0/0[0] any -P out ipsec 
esp/transport//require;
 
EOF

the tcpdump output:

15:20:08.118807 dhcp004.isakmp > 192.168.1.252.isakmp: isakmp: phase 1 I 
ident
15:20:08.119716 192.168.1.252.isakmp > dhcp004.isakmp: isakmp: phase 1 R 
ident (DF)
15:20:09.273779 dhcp004.isakmp > 192.168.1.252.isakmp: isakmp: phase 1 I 
ident
15:20:09.281007 192.168.1.252.isakmp > dhcp004.isakmp: isakmp: phase 1 R 
ident (DF)
15:20:09.575390 dhcp004.isakmp > 192.168.1.252.isakmp: isakmp: phase 1 I 
ident[E]
15:20:09.575744 192.168.1.252.isakmp > dhcp004.isakmp: isakmp: phase 1 R 
ident[E] (DF)
15:20:09.575851 192.168.1.252.isakmp > dhcp004.isakmp: isakmp: phase 
2/others R inf[E] (DF)
15:20:09.605865 dhcp004.it.isakmp > 192.168.1.252.isakmp: isakmp: phase 
2/others I oakley-quick[E]
15:20:09.606576 192.168.1.252.isakmp > dhcp004.isakmp: isakmp: phase 
2/others R oakley-quick[E] (DF)
15:20:09.640700 dhcp004.isakmp > 192.168.1.252.isakmp: isakmp: phase 
2/others I oakley-quick[E]
15:20:09.662503 dhcp004 > 192.168.1.252: ESP(spi=0x053ee035,seq=0x1)
15:20:10.676992 dhcp004 > 192.168.1.252: ESP(spi=0x053ee035,seq=0x2)
15:20:12.689765 dhcp004 > 192.168.1.252: ESP(spi=0x053ee035,seq=0x3)
15:20:16.704194 dhcp004 > 192.168.1.252: ESP(spi=0x053ee035,seq=0x4)
15:20:24.722037 dhcp004 > 192.168.1.252: ESP(spi=0x053ee035,seq=0x5)
15:20:34.735828 dhcp004 > 192.168.1.252: ESP(spi=0x053ee035,seq=0x6)
15:20:44.808742 dhcp004.isakmp > 192.168.1.252.isakmp: isakmp: phase 
2/others I inf[E]
15:20:44.814522 dhcp004.isakmp > 192.168.1.252.isakmp: isakmp: phase 
2/others I inf[E]

thnx, francesco.


    SysNet - via Dossi,8 27100 Pavia Tel: +390382573859 Fax: +390382476497