(racoon 931) Racoon and FreeSwan RSA
Bram Bouwens <[email protected]> Sat, 16 Apr 2005 21:40:05 +0200
| Newsgroups | gmane.network.ipv6.kame.racoon |
|---|---|
| Message-ID | <[email protected]> |
As I am replacing my RedHat 7.0 gateway with a SuSE 9.2 box, I'm looking to get the VPN connection to the office working again. Preferably I'd like to keep the same RSA keys, so I cooked up the conf file http://www.bouwens.biz/racoon.conf I put the old ipsec.secrets file in /etc/ipsec.d/rsa, and put the public keys of both sides there in pubkey1.rsa and pubkey2.rsa, in the format: : PUB 0sAQNl0M8nHFulEZE992PBO+qqtPTGbx+dxO6.............. I have no idea if that makes sense, I can't find a description for these files. when I start racoon then I get: Apr 16 21:12:06 janus2 racoon: INFO: @(#)ipsec-tools 0.4rc1 (http://ipsec-tools.sourceforge.net) Apr 16 21:12:06 janus2 racoon: INFO: @(#)This product linked OpenSSL 0.9.7d 17 Mar 2004 (http://www.openssl.org/) Apr 16 21:12:06 janus2 racoon: INFO: 80.126.5.18[500] used as isakmp port (fd=7) Apr 16 21:12:13 janus2 racoon: INFO: respond new phase 1 negotiation: 80.126.5.18[500]<=>82.94.15.138[500] Apr 16 21:12:13 janus2 racoon: INFO: begin Identity Protection mode. Apr 16 21:12:13 janus2 racoon: WARNING: ID type mismatched. Apr 16 21:12:13 janus2 racoon: WARNING: ID value mismatched. Apr 16 21:12:13 janus2 racoon: ERROR: 2097:error:0406706C:rsa routines:RSA_EAY_PUBLIC_DECRYPT:data greater than mod len:rsa_eay.c:524: Apr 16 21:12:14 janus2 racoon: INFO: ISAKMP-SA established 80.126.5.18[500]-82.94.15.138[500] spi:a5d16985a041918d:e7837acb39017d02 which is quite puzzling: several things seem wrong, but I don't know what. And at the end nevertheless there is a ISAKMP-SA established? Still I see no traffic through the tunnel I hoped to construct. But that's no surprise as I haven't got the route I need: # ip route 195.190.249.13 dev dsl0 proto kernel scope link src 80.126.5.18 192.168.37.0/24 dev eth0 proto kernel scope link src 192.168.37.1 169.254.0.0/16 dev eth0 scope link 127.0.0.0/8 dev lo scope link default via 195.190.249.13 dev dsl0 In the old setup I used to have a route to net 192.168.0.0/24 through device ipsec0 (which is obsoleted I understand) having 195.190.249.13 as gateway. How would I get that route? Bram