(racoon 873) Racoon behind NAT, SA established, but no Traffic
[email protected] Wed, 22 Dec 2004 17:29:43 +0100
| Newsgroups | gmane.network.ipv6.kame.racoon |
|---|---|
| Message-ID | <[email protected]> |
Hi,
I have a working IPSec Road Warrior Setup
from a Linux (Debian, Kernel 2..6.8) Box
on a public IP into the coorporate LAN
behind a CheckPoint FW-1.
I now moved into a different network behind
a Linux (Mandrake) FireWall with NAT.
I have UDP 500 and UDP 2764 opened,
as well as IP Protocols ESP,AH and SPIKE (50,51,57)
to the FW-1 adress 194.94.AAA.BBB
I have successfully connected with the Windows client,
and an extract of the network dump is attached.
I can successfully create an SA with the FW-1,
but no actual traffic goes through. I enabled
nat_traversal in racoon.conf without making difference.
When comparing the Net Dumps I see several differences:
1) Under Windows the CP Client is not using ESP packets
2) Under Windows the corporate DNS is queried for the mail server
3) Under Linux verifying the checksum of some UDP packet fails,
marked with => in the dump below. The SA is established nevertheless.
So any clues how to continue debugging ? What other
requisite is neccessary when doing IPSec behind NAT ?
Anything obvious we missed ?
Unfortunately our local admin does not know IPSec,
the Firewall admin doesn't know Linux/Racoon and I am not
a wizard in both. But we're all willing to try hard ;-)
Yours,
Steffen
----------------------------------------------------------------------
Successfully established SA:
============================
194.94.AAA.BBB 192.168.1.65
esp mode=tunnel spi=34760875(0x021268ab) reqid=0(0x00000000)
E: 3des-cbc 96dd0454 0e62ed79 0dd30b43 f39b1dca ef97f27f 7b98ef99
A: hmac-sha1 17a06ce2 870d704b 2886826c 5b79fcef 9cb9c7ed
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Dec 22 17:05:13 2004 current: Dec 22 17:05:13 2004
diff: 0(s) hard: 28800(s) soft: 23040(s)
last: hard: 0(s) soft: 0(s)
current: 0(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 0 hard: 0 soft: 0
sadb_seq=1 pid=5666 refcnt=0
192.168.1.65 194.94.AAA.BBB
esp mode=tunnel spi=4126466822(0xf5f4e306) reqid=0(0x00000000)
E: 3des-cbc 605becfb a5e03c04 98fd4c91 5d496444 237ad676 1de08d2b
A: hmac-sha1 37ad52d7 aa55bd3b 19bf0bb3 bf7173a2 89d343a9
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Dec 22 17:05:13 2004 current: Dec 22 17:05:13 2004
diff: 0(s) hard: 28800(s) soft: 23040(s)
last: hard: 0(s) soft: 0(s)
current: 0(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 0 hard: 0 soft: 0
sadb_seq=0 pid=5666 refcnt=0
----------------------------------------------------------------------
/etc/racoon/racoon.conf
=======================
remote anonymous
{
exchange_mode main;
doi ipsec_doi;
certificate_type x509 "my_pubcert.pem" "my_private_key.pem";
my_identifier asn1dn ;
# nat_traversal on; // Same result with/without
verify_cert off;
proposal
{
encryption_algorithm 3des;
hash_algorithm md5;
authentication_method rsasig;
dh_group 2;
}
send_cr off;
}
sainfo anonymous
{
pfs_group 2;
encryption_algorithm 3des;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
}
----------------------------------------------------------------------
Successful connect with CheckPoint/Windows Client
================================================
No. Time Source Destination Protocol Info
44 4.345007 192.168.1.65 194.94.AAA.BBB ISAKMP
Identity Protection (Main Mode)
45 4.360310 194.94.AAA.BBB 192.168.1.65 ISAKMP
Identity Protection (Main Mode)
46 4.437415 192.168.1.65 194.94.AAA.BBB ISAKMP
Identity Protection (Main Mode)
47 4.453444 194.94.AAA.BBB 192.168.1.65 ISAKMP
Identity Protection (Main Mode)
48 4.517083 192.168.1.65 194.94.AAA.BBB ISAKMP
Identity Protection (Main Mode)
49 4.517133 192.168.1.65 194.94.AAA.BBB IP
Fragmented IP protocol (proto=UDP 0x11, off=1280)
50 4.560044 194.94.AAA.BBB 192.168.1.65 ISAKMP
Identity Protection (Main Mode)
51 4.560059 194.94.AAA.BBB 192.168.1.65 IP
Fragmented IP protocol (proto=UDP 0x11, off=1480)
52 4.668087 194.94.AAA.BBB 192.168.1.65 ISAKMP
Identity Protection (Main Mode)
53 4.668105 194.94.AAA.BBB 192.168.1.65 IP
Fragmented IP protocol (proto=UDP 0x11, off=1480)
57 4.768604 194.94.AAA.BBB 192.168.1.65 ISAKMP
Identity Protection (Main Mode)
58 4.768621 194.94.AAA.BBB 192.168.1.65 IP
Fragmented IP protocol (proto=UDP 0x11, off=1480)
59 4.782450 192.168.1.65 194.94.AAA.BBB ISAKMP Quick
Mode
60 4.800838 194.94.AAA.BBB 192.168.1.65 ISAKMP Quick
Mode
62 4.942969 192.168.1.65 194.94.136. 49 UDP Source
port: socks Destination port: 18234
63 4.964194 192.168.1.65 194.94.AAA.BBB ISAKMP Quick
Mode
64 5.062702 192.168.1.65 194.94.AAA.BBB ISAKMP Quick
Mode
68 5.162778 192.168.1.65 194.94.AAA.BBB ISAKMP Quick
Mode
70 5.405044 194.94.AAA.CCC 192.168.1.65 DNS
Standard query response, No such name
71 5.943952 192.168.1.65 194.94.136.49 UDP Source
port: socks Destination port: 18234
72 5.956417 194.94.136.49 192.168.1.65 UDP Source
port: 18234 Destination port: socks
82 6.945386 192.168.1.65 194.94.136.49 UDP Source
port: socks Destination port: 18234
83 6.964448 194.94.136.49 192.168.1.65 UDP Source
port: 18234 Destination port: socks
249 13.333335 192.168.1.65 194.94.AAA.DDD TCP 1087 >
imap2 [SYN] Seq=0 Ack=0 Win=65535 Len=0 MSS=1260
250 13.345910 194.94.AAA.DDD 192.168.1.65 TCP imap2 >
1087 [SYN, ACK] Seq=0 Ack=1 Win=32162 Len=0 MSS=1237
251 13.345969 192.168.1.65 194.94.AAA.DDD TCP 1087 >
imap2 [ACK] Seq=1 Ack=1 Win=65535 Len=0
252 13.369089 194.94.AAA.DDD 192.168.1.65 IMAP
Response: * OK [CAPABILITY IMAP4 IMAP4REV1 STARTTLS ...
Unsuccessful with Linux 2.6.8
=============================
No. Time Source Destination Protocol Info
1 0.000000 192.168.1.65 194.94.AAA.BBB ISAKMP
Identity Protection (Main Mode)
2 0.013822 194.94.AAA.BBB 192.168.1.65 ISAKMP
Identity Protection (Main Mode)
3 0.026694 192.168.1.65 194.94.AAA.BBB ISAKMP
Identity Protection (Main Mode)
4 0.068867 194.94.AAA.BBB 192.168.1.65 ISAKMP
Identity Protection (Main Mode)
5 0.113217 192.168.1.65 194.94.AAA.BBB ISAKMP
Identity Protection (Main Mode)
6 0.151831 194.94.AAA.BBB 192.168.1.65 ISAKMP
Identity Protection (Main Mode)
7 0.152938 192.168.1.65 194.94.AAA.BBB ISAKMP
Informational
8 0.256953 194.94.AAA.BBB 192.168.1.65 ISAKMP
Identity Protection (Main Mode)
9 0.357208 194.94.AAA.BBB 192.168.1.65 ISAKMP
Identity Protection (Main Mode)
10 1.368529 192.168.1.65 194.94.AAA.BBB ISAKMP Quick
Mode
11 1.386887 194.94.AAA.BBB 192.168.1.65 ISAKMP Quick
Mode
12 1.387343 192.168.1.65 194.94.AAA.BBB ISAKMP Quick
Mode
13 4.744919 192.168.1.65 194.94.AAA.BBB ESP ESP
(SPI=0xfd5a2f11)
14 7.747488 192.168.1.65 194.94.AAA.BBB ESP ESP
(SPI=0xfd5a2f11)
15 13.746581 192.168.1.65 194.94.AAA.BBB ESP ESP
(SPI=0xfd5a2f11)
16 25.744765 192.168.1.65 194.94.AAA.BBB ESP ESP
(SPI=0xfd5a2f11)
Checksum mismatch problem:
==========================
No. Time Source Destination Protocol Info
12 1.387343 192.168.1.65 194.94.136.34 ISAKMP Quick
Mode
Frame 12 (94 bytes on wire, 94 bytes captured)
Ethernet II, Src: 00:0f:1f:c4:06:c3, Dst: 00:04:75:e9:51:b9
Internet Protocol, Src Addr: 192.168.1.65 (192.168.1.65), Dst Addr:
194.94.AAA.BBB (194.94.AAA.BBB)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
Total Length: 80
Identification: 0x0005 (5)
Flags: 0x04 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
O.K.=> Header checksum: 0x2e2e (correct)
Source: 192.168.1.65 (192.168.1.65)
Destination: 194.94.AAA.BBB (194.94.AAA.BBB)
User Datagram Protocol, Src Port: isakmp (500), Dst Port: isakmp (500)
Source port: isakmp (500)
Destination port: isakmp (500)
Length: 60
!!! => Checksum: 0x0cb8 (incorrect, should be 0x65e1)
Internet Security Association and Key Management Protocol