(racoon 872) BOUNCE [email protected]: Non-member submission from [[email protected]]
[email protected] Thu, 23 Dec 2004 03:36:37 +0900 (JST)
| Newsgroups | gmane.network.ipv6.kame.racoon |
|---|---|
| Message-ID | <[email protected]> |
>From [email protected] Thu Dec 23 03:36:37 2004 Return-Path: <[email protected]> X-Original-To: [email protected] Delivered-To: [email protected] Received: from sardine.kame.net (sardine.kame.net [2001:200:0:8002:210:f3ff:fe03:4d0]) by orange.kame.net (Postfix) with ESMTP id 13D0335672C for <[email protected]>; Thu, 23 Dec 2004 03:36:37 +0900 (JST) Received: from proxy2.ipk-gatersleben.de (proxy2.ipk-gatersleben.de [194.94.136.68]) by sardine.kame.net (Postfix) with ESMTP id 10C5487E for <[email protected]>; Thu, 23 Dec 2004 03:34:42 +0900 (JST) Received: from localhost (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with ESMTP id 379BFF0012 for <[email protected]>; Wed, 22 Dec 2004 17:28:10 +0100 (CET) Received: from proxy2.ipk-gatersleben.de ([127.0.0.1]) by localhost (proxy2.ipk-gatersleben.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 30167-10 for <[email protected]>; Wed, 22 Dec 2004 17:28:08 +0100 (CET) Received: from webmail.ipk-gatersleben.de (webmail.ipk-gatersleben.de [194.94.136.82]) by proxy2.ipk-gatersleben.de (Postfix) with ESMTP id 3C550F000A for <[email protected]>; Wed, 22 Dec 2004 17:28:08 +0100 (CET) Received: from router-sub.ipb-halle.DE (router-sub.ipb-halle.DE [192.124.243.161]) by webmail.ipk-gatersleben.de (IMP) with HTTP for <[email protected]>; Wed, 22 Dec 2004 17:29:43 +0100 Message-ID: <[email protected]> Date: Wed, 22 Dec 2004 17:29:43 +0100 From: [email protected] To: [email protected] Subject: Racoon behind NAT, SA established, but no Traffic MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: Internet Messaging Program (IMP) 3.2.3 X-Originating-IP: 192.124.243.161 Hi, I have a working IPSec Road Warrior Setup from a Linux (Debian, Kernel 2..6.8) Box on a public IP into the coorporate LAN behind a CheckPoint FW-1. I now moved into a different network behind a Linux (Mandrake) FireWall with NAT. I have UDP 500 and UDP 2764 opened, as well as IP Protocols ESP,AH and SPIKE (50,51,57) to the FW-1 adress 194.94.AAA.BBB I have successfully connected with the Windows client, and an extract of the network dump is attached. I can successfully create an SA with the FW-1, but no actual traffic goes through. I enabled nat_traversal in racoon.conf without making difference. When comparing the Net Dumps I see several differences: 1) Under Windows the CP Client is not using ESP packets 2) Under Windows the corporate DNS is queried for the mail server 3) Under Linux verifying the checksum of some UDP packet fails, marked with => in the dump below. The SA is established nevertheless. So any clues how to continue debugging ? What other requisite is neccessary when doing IPSec behind NAT ? Anything obvious we missed ? Unfortunately our local admin does not know IPSec, the Firewall admin doesn't know Linux/Racoon and I am not a wizard in both. But we're all willing to try hard ;-) Yours, Steffen ---------------------------------------------------------------------- Successfully established SA: ============================ 194.94.AAA.BBB 192.168.1.65 esp mode=tunnel spi=34760875(0x021268ab) reqid=0(0x00000000) E: 3des-cbc 96dd0454 0e62ed79 0dd30b43 f39b1dca ef97f27f 7b98ef99 A: hmac-sha1 17a06ce2 870d704b 2886826c 5b79fcef 9cb9c7ed seq=0x00000000 replay=4 flags=0x00000000 state=mature created: Dec 22 17:05:13 2004 current: Dec 22 17:05:13 2004 diff: 0(s) hard: 28800(s) soft: 23040(s) last: hard: 0(s) soft: 0(s) current: 0(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 0 hard: 0 soft: 0 sadb_seq=1 pid=5666 refcnt=0 192.168.1.65 194.94.AAA.BBB esp mode=tunnel spi=4126466822(0xf5f4e306) reqid=0(0x00000000) E: 3des-cbc 605becfb a5e03c04 98fd4c91 5d496444 237ad676 1de08d2b A: hmac-sha1 37ad52d7 aa55bd3b 19bf0bb3 bf7173a2 89d343a9 seq=0x00000000 replay=4 flags=0x00000000 state=mature created: Dec 22 17:05:13 2004 current: Dec 22 17:05:13 2004 diff: 0(s) hard: 28800(s) soft: 23040(s) last: hard: 0(s) soft: 0(s) current: 0(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 0 hard: 0 soft: 0 sadb_seq=0 pid=5666 refcnt=0 ---------------------------------------------------------------------- /etc/racoon/racoon.conf ======================= remote anonymous { exchange_mode main; doi ipsec_doi; certificate_type x509 "my_pubcert.pem" "my_private_key.pem"; my_identifier asn1dn ; # nat_traversal on; // Same result with/without verify_cert off; proposal { encryption_algorithm 3des; hash_algorithm md5; authentication_method rsasig; dh_group 2; } send_cr off; } sainfo anonymous { pfs_group 2; encryption_algorithm 3des; authentication_algorithm hmac_sha1; compression_algorithm deflate; } ---------------------------------------------------------------------- Successful connect with CheckPoint/Windows Client ================================================ No. Time Source Destination Protocol Info 44 4.345007 192.168.1.65 194.94.AAA.BBB ISAKMP Identity Protection (Main Mode) 45 4.360310 194.94.AAA.BBB 192.168.1.65 ISAKMP Identity Protection (Main Mode) 46 4.437415 192.168.1.65 194.94.AAA.BBB ISAKMP Identity Protection (Main Mode) 47 4.453444 194.94.AAA.BBB 192.168.1.65 ISAKMP Identity Protection (Main Mode) 48 4.517083 192.168.1.65 194.94.AAA.BBB ISAKMP Identity Protection (Main Mode) 49 4.517133 192.168.1.65 194.94.AAA.BBB IP Fragmented IP protocol (proto=UDP 0x11, off=1280) 50 4.560044 194.94.AAA.BBB 192.168.1.65 ISAKMP Identity Protection (Main Mode) 51 4.560059 194.94.AAA.BBB 192.168.1.65 IP Fragmented IP protocol (proto=UDP 0x11, off=1480) 52 4.668087 194.94.AAA.BBB 192.168.1.65 ISAKMP Identity Protection (Main Mode) 53 4.668105 194.94.AAA.BBB 192.168.1.65 IP Fragmented IP protocol (proto=UDP 0x11, off=1480) 57 4.768604 194.94.AAA.BBB 192.168.1.65 ISAKMP Identity Protection (Main Mode) 58 4.768621 194.94.AAA.BBB 192.168.1.65 IP Fragmented IP protocol (proto=UDP 0x11, off=1480) 59 4.782450 192.168.1.65 194.94.AAA.BBB ISAKMP Quick Mode 60 4.800838 194.94.AAA.BBB 192.168.1.65 ISAKMP Quick Mode 62 4.942969 192.168.1.65 194.94.136. 49 UDP Source port: socks Destination port: 18234 63 4.964194 192.168.1.65 194.94.AAA.BBB ISAKMP Quick Mode 64 5.062702 192.168.1.65 194.94.AAA.BBB ISAKMP Quick Mode 68 5.162778 192.168.1.65 194.94.AAA.BBB ISAKMP Quick Mode 70 5.405044 194.94.AAA.CCC 192.168.1.65 DNS Standard query response, No such name 71 5.943952 192.168.1.65 194.94.136.49 UDP Source port: socks Destination port: 18234 72 5.956417 194.94.136.49 192.168.1.65 UDP Source port: 18234 Destination port: socks 82 6.945386 192.168.1.65 194.94.136.49 UDP Source port: socks Destination port: 18234 83 6.964448 194.94.136.49 192.168.1.65 UDP Source port: 18234 Destination port: socks 249 13.333335 192.168.1.65 194.94.AAA.DDD TCP 1087 > imap2 [SYN] Seq=0 Ack=0 Win=65535 Len=0 MSS=1260 250 13.345910 194.94.AAA.DDD 192.168.1.65 TCP imap2 > 1087 [SYN, ACK] Seq=0 Ack=1 Win=32162 Len=0 MSS=1237 251 13.345969 192.168.1.65 194.94.AAA.DDD TCP 1087 > imap2 [ACK] Seq=1 Ack=1 Win=65535 Len=0 252 13.369089 194.94.AAA.DDD 192.168.1.65 IMAP Response: * OK [CAPABILITY IMAP4 IMAP4REV1 STARTTLS ... Unsuccessful with Linux 2.6.8 ============================= No. Time Source Destination Protocol Info 1 0.000000 192.168.1.65 194.94.AAA.BBB ISAKMP Identity Protection (Main Mode) 2 0.013822 194.94.AAA.BBB 192.168.1.65 ISAKMP Identity Protection (Main Mode) 3 0.026694 192.168.1.65 194.94.AAA.BBB ISAKMP Identity Protection (Main Mode) 4 0.068867 194.94.AAA.BBB 192.168.1.65 ISAKMP Identity Protection (Main Mode) 5 0.113217 192.168.1.65 194.94.AAA.BBB ISAKMP Identity Protection (Main Mode) 6 0.151831 194.94.AAA.BBB 192.168.1.65 ISAKMP Identity Protection (Main Mode) 7 0.152938 192.168.1.65 194.94.AAA.BBB ISAKMP Informational 8 0.256953 194.94.AAA.BBB 192.168.1.65 ISAKMP Identity Protection (Main Mode) 9 0.357208 194.94.AAA.BBB 192.168.1.65 ISAKMP Identity Protection (Main Mode) 10 1.368529 192.168.1.65 194.94.AAA.BBB ISAKMP Quick Mode 11 1.386887 194.94.AAA.BBB 192.168.1.65 ISAKMP Quick Mode 12 1.387343 192.168.1.65 194.94.AAA.BBB ISAKMP Quick Mode 13 4.744919 192.168.1.65 194.94.AAA.BBB ESP ESP (SPI=0xfd5a2f11) 14 7.747488 192.168.1.65 194.94.AAA.BBB ESP ESP (SPI=0xfd5a2f11) 15 13.746581 192.168.1.65 194.94.AAA.BBB ESP ESP (SPI=0xfd5a2f11) 16 25.744765 192.168.1.65 194.94.AAA.BBB ESP ESP (SPI=0xfd5a2f11) Checksum mismatch problem: ========================== No. Time Source Destination Protocol Info 12 1.387343 192.168.1.65 194.94.136.34 ISAKMP Quick Mode Frame 12 (94 bytes on wire, 94 bytes captured) Ethernet II, Src: 00:0f:1f:c4:06:c3, Dst: 00:04:75:e9:51:b9 Internet Protocol, Src Addr: 192.168.1.65 (192.168.1.65), Dst Addr: 194.94.AAA.BBB (194.94.AAA.BBB) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) Total Length: 80 Identification: 0x0005 (5) Flags: 0x04 (Don't Fragment) Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) O.K.=> Header checksum: 0x2e2e (correct) Source: 192.168.1.65 (192.168.1.65) Destination: 194.94.AAA.BBB (194.94.AAA.BBB) User Datagram Protocol, Src Port: isakmp (500), Dst Port: isakmp (500) Source port: isakmp (500) Destination port: isakmp (500) Length: 60 !!! => Checksum: 0x0cb8 (incorrect, should be 0x65e1) Internet Security Association and Key Management Protocol