(racoon 931) Racoon and FreeSwan RSA

Bram Bouwens <[email protected]> Sat, 16 Apr 2005 21:40:05 +0200
Newsgroups gmane.network.ipv6.kame.racoon
Message-ID <[email protected]>
As I am replacing my RedHat 7.0 gateway with a SuSE 9.2 box, I'm
looking to get the VPN connection to the office working again.
Preferably I'd like to keep the same RSA keys, so I cooked up
the conf file http://www.bouwens.biz/racoon.conf

I put the old ipsec.secrets file in /etc/ipsec.d/rsa, and put
the public keys of both sides there in pubkey1.rsa and pubkey2.rsa,
in the format:

: PUB 0sAQNl0M8nHFulEZE992PBO+qqtPTGbx+dxO6..............

I have no idea if that makes sense, I can't find a description
for these files.

when I start racoon then I get:

Apr 16 21:12:06 janus2 racoon: INFO: @(#)ipsec-tools 0.4rc1 
(http://ipsec-tools.sourceforge.net)
Apr 16 21:12:06 janus2 racoon: INFO: @(#)This product linked OpenSSL 
0.9.7d 17 Mar 2004 (http://www.openssl.org/)
Apr 16 21:12:06 janus2 racoon: INFO: 80.126.5.18[500] used as isakmp 
port (fd=7)
Apr 16 21:12:13 janus2 racoon: INFO: respond new phase 1 negotiation: 
80.126.5.18[500]<=>82.94.15.138[500]
Apr 16 21:12:13 janus2 racoon: INFO: begin Identity Protection mode.
Apr 16 21:12:13 janus2 racoon: WARNING: ID type mismatched.
Apr 16 21:12:13 janus2 racoon: WARNING: ID value mismatched.
Apr 16 21:12:13 janus2 racoon: ERROR: 2097:error:0406706C:rsa 
routines:RSA_EAY_PUBLIC_DECRYPT:data greater than mod len:rsa_eay.c:524:
Apr 16 21:12:14 janus2 racoon: INFO: ISAKMP-SA established 
80.126.5.18[500]-82.94.15.138[500] spi:a5d16985a041918d:e7837acb39017d02

which is quite puzzling: several things seem wrong, but I don't know
what.

And at the end nevertheless there is a ISAKMP-SA established?

Still I see no traffic through the tunnel I hoped to construct. But
that's no surprise as I haven't got the route I need:
# ip route
195.190.249.13 dev dsl0  proto kernel  scope link  src 80.126.5.18
192.168.37.0/24 dev eth0  proto kernel  scope link  src 192.168.37.1
169.254.0.0/16 dev eth0  scope link
127.0.0.0/8 dev lo  scope link
default via 195.190.249.13 dev dsl0


In the old setup I used to have a route to net 192.168.0.0/24 through
device ipsec0 (which is obsoleted I understand) having 195.190.249.13
as gateway. How would I get that route?


Bram