(racoon2 17) Fw: Problems with IKEv2 in racoon2
Shoichi Sakane <[email protected]> Wed, 27 Jul 2005 13:55:56 +0900
| Newsgroups | gmane.network.ipv6.kame.racoon |
|---|---|
| Message-ID | <[email protected]> |
--NextPart-20050727135545-1018400 Content-Type: Message/Rfc822 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Subject: Problems with IKEv2 in racoon2 Date: Fri, 15 Jul 2005 15:08:22 +0200 Message-ID: <F1B6FA4577594043ACAD06F77CCC6023B93158@esealmw105.eemea.ericsson.se> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Problems with IKEv2 in racoon2 thread-index: AcWJPjuJSfvy0GYXSC20oydXY/kPmw== From: "Martin Eriksson Y (LI/EAB)" <[email protected]> To: <[email protected]> X-OriginalArrivalTime: 15 Jul 2005 13:08:03.0438 (UTC) FILETIME=[3BCFD0E0:01C5893E] X-Brightmail-Tracker: AAAAAA== X-MIME-Autoconverted: from quoted-printable to 8bit by papa.tanu.org id j6FCvwH6028577 Content-Transfer-Encoding: quoted-printable I'm mailing you because I can't seem to find a mailinglist for racoon2. I= would really appreciate a response.=20 I'm testing racoon2 and I have a problem. According to the logfile from t= he initiator: "message lacks IDr payload". I've tried several different s= etups in the config fil but I can't seem to get it to work. Am I doing so= mething wrong? I've tried to print the id_r value to the logfile using "I= Dr value: %10c", id_r) but i only get an empty space and some escape/cont= rol character at the end. Do you have any other suggestions on how to vie= w the IDr value? I include parts from the logfile and the config files for the two hosts. = Host "A" (172.26.5.1) pings host "B" (172.26.7.1) in this example Jul 15 14:24:55 mah-3 spmd[10392]: Racoon Spmd - Security Policy Manageme= nt Daemon - Started Jul 15 14:24:55 mah-3 spmd[10392]: Spmd Version: 20050625b Jul 15 14:24:55 mah-3 spmd[10392]: 'files' found in nsswitch.conf hosts l= ine, we will read hosts file Jul 15 14:24:55 mah-3 spmd[10392]: 'dns' found in nsswitch.conf hosts lin= e, we will start dns proxy service Jul 15 14:25:00 mah-3 iked: [INFO]: main.c:270:main(): starting iked for = racoon2 20050625b Jul 15 14:25:00 mah-3 iked: [INFO]: main.c:272:main(): OPENSSLDIR: "/usr/= share/ssl" Jul 15 14:25:00 mah-3 iked: [INFO]: main.c:292:main(): reading config /us= r/local/racoon2/etc/racoon2.conf Jul 15 14:25:01 mah-3 iked: [INFO]: isakmp.c:336:isakmp_open(): socket 5 = bind 172.26.5.1[500] Jul 15 14:25:28 mah-3 iked: [PROTO_ERR]: ikev2.c:2374:initiator_ike_sa_au= th_recv(): 1:172.26.5.1[500] - 172.26.7.1[500]:0x809fe70:message lacks IDr payload Jul 15 14:25:28 mah-3= iked: [INFO]: ike_sa.c:116:ikev2_abort(): 1:? - ?:(nil):aborting ike_sa ... Jul 15 14:25:28 mah-2 iked: [PROTO_ERR]: ikev2.c:2034:responder_ike_sa_au= th_recv(): 1:172.26.7.1[500] - 172.26.5.1[500]:0x8ada968:authentication f= ailure Jul 15 14:25:28 mah-2 iked: [INFO]: ike_sa.c:116:ikev2_abort(): 1:? - ?:(= nil):aborting ike_sa Output from TCPdump 14:30:47.829367 IP 172.26.5.1.isakmp > 172.26.7.1.isakmp: isakmp: phase 1= I #34[] 14:30:47.848145 IP 172.26.7.1.isakmp > 172.26.5.1.isakmp: isakmp: phase 1= R #34[] 14:30:47.874182 IP 172.26.5.1.isakmp > 172.26.7.1.isakmp: isakmp: phase 2= /others I #35[] 14:30:47.881053 IP 172.26.7.1.isakmp > 172.26.5.1.isakmp: isakmp: phase 2= /others R #35[] # interface info interface { ike { 172.26.5.1; }; spmd { unix "/var/run/racoon/spmif"; }; spmd_password "/usr/local/racoon2/etc/secret/spmd.psk"; }; resolver { resolver on; nameserver { # 2001:db8:1b0:2031::1 port 53; 172.26.1.1 port 53; # specify your recurive server }; dns_query { 127.0.0.1 port 53; ::1 port 53; }; }; remote remote-B { acceptable_kmp { ikev2; }; =20 ikev2 { peers_ipaddr 172.26.7.1; # 10.1.1.1 at B peers_id ipaddr 172.26.7.1; # 10.1.1.1 at B my_id ipaddr 172.26.5.1; # 10.2.2.2 at B kmp_enc_alg { aes128_cbc; 3des_cbc; }; kmp_hash_alg { hmac_sha1; hmac_md5; aes_xcbc; }; kmp_prf_alg { hmac_sha1; hmac_md5; aes_xcbc; }; kmp_auth_method { psk; }; kmp_dh_group { 2;}; pre_shared_key "/usr/local/racoon2/etc/secret/psk.txt"; }; }; selector slt-A-B-any { direction outbound; # set "inbound" at B src 172.26.5.1; dst 172.26.7.1; upper_layer_protocol "any"; policy_index policy-A-B; }; selector slt-B-A-any { direction inbound; # set "outbound" at B src 172.26.7.1; dst 172.26.5.1; upper_layer_protocol "any"; policy_index policy-A-B; }; policy policy-A-B { action auto_ipsec; remote_index remote-B; ipsec_mode transport; ipsec_index { ipsec-esp-a-b; }; ipsec_level unique; # peers_sa_ipaddr 172.26.7.1; # 10.1.1.1 at B # my_sa_ipaddr 172.26.5.1; # 10.2.2.2 at B }; ipsec ipsec-esp-a-b { sa_index { sa-esp-1; }; }; sa sa-esp-1 { sa_protocol esp; esp_enc_alg { aes128_cbc; 3des_cbc; }; esp_auth_alg { hmac_sha1; hmac_md5; }; }; ----------------------------------- Other host: ----------------------------------- # interface info interface { ike { 172.26.7.1; }; spmd { unix "/var/run/racoon/spmif"; }; spmd_password "/usr/local/racoon2/etc/secret/spmd.psk"; }; resolver { resolver on; nameserver { # 2001:db8:1b0:2031::1 port 53; 172.26.1.1 port 53; # specify your recurive server }; dns_query { 127.0.0.1 port 53; ::1 port 53; }; }; remote remote-B { acceptable_kmp { ikev2; }; =20 ikev2 { peers_ipaddr 172.26.5.1; # 10.1.1.1 at B peers_id ipaddr 172.26.5.1"; # 10.1.1.1 at B my_id ipaddr 172.26.7.1; # 10.2.2.2 at B kmp_enc_alg { aes128_cbc; 3des_cbc; }; kmp_hash_alg { hmac_sha1; hmac_md5; aes_xcbc; }; kmp_prf_alg { hmac_sha1; hmac_md5; aes_xcbc; }; kmp_auth_method { psk; }; kmp_dh_group { 2;}; pre_shared_key "/usr/local/racoon2/etc/secret/psk.txt"; }; }; selector slt-A-B-any { direction inbound; # set "inbound" at B src 172.26.5.1; dst 172.26.7.1; upper_layer_protocol "any"; policy_index policy-A-B; }; selector slt-B-A-any { direction outbound; # set "outbound" at B src 172.26.7.1; dst 172.26.5.1; upper_layer_protocol "any"; policy_index policy-A-B; }; policy policy-A-B { action auto_ipsec; remote_index remote-B; ipsec_mode transport; ipsec_index { ipsec-esp-a-b; }; ipsec_level unique; # peers_sa_ipaddr 172.26.7.1; # 10.1.1.1 at B # my_sa_ipaddr 172.26.5.1; # 10.2.2.2 at B }; ipsec ipsec-esp-a-b { sa_index { sa-esp-1; }; }; sa sa-esp-1 { sa_protocol esp; esp_enc_alg { aes128_cbc; 3des_cbc; }; esp_auth_alg { hmac_sha1; hmac_md5; }; }; --NextPart-20050727135545-1018400--