(racoon 955) Connect to checkpoint NGX with racoon
"Marc Guyard" <[email protected]> Thu, 4 Jan 2007 19:40:25 +0100
| Newsgroups | gmane.network.ipv6.kame.racoon |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_11126_5212036.1167936025294
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Hi,
I've a problem to interconnect Racoon with my checkpoint office's.
I've enable the nat-t.
In the racoon log i don't have errors. In my checkpoint tracker too.
My configuration racoon.conf is :
#path certificate "/etc/racoon/cert";
> path pre_shared_key "/etc/racoon/psk.txt";
> #log notify;
>
> timer {
> counter 5; # maximum trying count to send.
> interval 20 sec; # maximum interval to resend.
> persend 1; # the number of packets per a send.
> # timer for waiting to complete each phase.
> phase1 30 sec;
> phase2 15 sec;
> }
>
> remote checkpoint_ip {
> exchange_mode main;
> passive off;
> lifetime time 1440 min; # sec,min,hour
> my_identifier user_fqdn "test";
> dpd_delay 0;
> nat_traversal on;
> proposal {
> encryption_algorithm aes;
> hash_algorithm sha1;
> authentication_method pre_shared_key;
> dh_group modp1024;
> }
> proposal_check obey;
> }
>
>
> sainfo address 0.0.0.0/0 any address 10.255.253.0/24 any {
> #pfs_group 2;
> lifetime time 3600 sec;
> encryption_algorithm aes;
> authentication_algorithm hmac_sha1;
> compression_algorithm deflate ;
> }
>
In the log i've this :
2007-01-04 10:36:56: DEBUG: Adding NON-ESP marker
> 2007-01-04 10:36:56: DEBUG: 80 bytes from 172.20.3.38[4500] to
> checkpoint_ip[4500]
> 2007-01-04 10:36:56: DEBUG: sockname 172.20.3.38[4500]
> 2007-01-04 10:36:56: DEBUG: send packet from 172.20.3.38[4500]
> 2007-01-04 10:36:56: DEBUG: send packet to checkpoint_ip[4500]
> 2007-01-04 10:36:56: DEBUG: src4 172.20.3.38[4500]
> 2007-01-04 10:36:56: DEBUG: dst4 checkpoint_ip[4500]
> 2007-01-04 10:36:56: DEBUG: 1 times of 80 bytes message will be sent to
> checkpoint_ip[4500]
> 2007-01-04 10:36:56: DEBUG:
> 00000000 d5317715 d8204e20 d36f383c be695276 05100201 00000000 0000004c
> 574d5470 b7124a1b d3ec1a20 3c460ed6 dc8ec387 16c1d282 b01ecf5b 72ade24f
> 1ffaf9bc f5c8aba5 6dd06995 46567bbd
> 2007-01-04 10:36:56: DEBUG: resend phase1 packet
> d5317715d8204e20:d36f383cbe695276
> 2007-01-04 10:36:59: DEBUG: KA: 172.20.3.38[4500]->checkpoint_ip[4500]
> 2007-01-04 10:36:59: DEBUG: sockname 172.20.3.38[4500]
> 2007-01-04 10:36:59: DEBUG: send packet from 172.20.3.38[4500]
> 2007-01-04 10:36:59: DEBUG: send packet to checkpoint_ip[4500]
> 2007-01-04 10:36:59: DEBUG: src4 172.20.3.38[4500]
> 2007-01-04 10:36:59: DEBUG: dst4 checkpoint_ip[4500]
> 2007-01-04 10:36:59: DEBUG: 1 times of 1 bytes message will be sent to
> checkpoint_ip[4500]
> 2007-01-04 10:36:59: DEBUG:
> ff
> 2007-01-04 10:37:16: ERROR: phase1 negotiation failed due to time up.
> d5317715d8204e20:d36f383cbe695276
> 2007-01-04 10:37:16: INFO: KA remove: 172.20.3.38
> [4500]->checkpoint_ip[4500]
> 2007-01-04 10:37:16: DEBUG: KA tree dump: 172.20.3.38[4500]->checkpoint_ip[4500]
> (in_use=1)
> 2007-01-04 10:37:16: DEBUG: KA removing this one...
>
My checkpoint listen on UDP 500 and 4500 on all interface.
Do you know if the problem if on my checkpoint office's or in my racoon
configuration ?
Somebody already made function a raccon with a checkpoint NGX ?
Thanks by advance to you help.
Regards,
--
------------------------
SoukoussMan
[email protected]
--
------------------------
SoukoussMan
[email protected]
------=_Part_11126_5212036.1167936025294
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Hi,<br><br>I've a problem to interconnect Racoon with my checkpoint office's.<br>I've enable the nat-t.<br>In the racoon log i don't have errors. In my checkpoint tracker too.<br><br>My configuration racoon.conf
is :<br><br><blockquote style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;" class="gmail_quote">#path certificate "/etc/racoon/cert";<br>path pre_shared_key "/etc/racoon/psk.txt";
<br>#log notify;<br><br>timer {<br> counter 5; # maximum trying count to send.<br> interval 20 sec; # maximum interval to resend.<br> persend 1; # the number of packets per a send.
<br> # timer for waiting to complete each phase.<br> phase1 30 sec;<br> phase2 15 sec;<br>}<br><br>remote checkpoint_ip {<br> exchange_mode main;<br> passive off;<br> lifetime time 1440 min; # sec,min,hour
<br> my_identifier user_fqdn "test";<br> dpd_delay 0; <br> nat_traversal on;<br> proposal {<br> encryption_algorithm aes;<br> hash_algorithm sha1;<br> authentication_method pre_shared_key;
<br> dh_group modp1024;<br> }<br> proposal_check obey;<br>}<br><br><br>sainfo address <a href="http://0.0.0.0/0" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
0.0.0.0/0</a> any address <a href="http://10.255.253.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.255.253.0/24
</a> any {<br> #pfs_group 2;<br> lifetime time 3600 sec;<br> encryption_algorithm aes;<br> authentication_algorithm hmac_sha1;<br> compression_algorithm deflate ;<br>}<br clear="all"></blockquote>
<br>In the log i've this :<br><br><blockquote style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;" class="gmail_quote">2007-01-04 10:36:56: DEBUG: Adding NON-ESP marker<br>
2007-01-04 10:36:56: DEBUG: 80 bytes from
172.20.3.38[4500] to checkpoint_ip[4500]<br>2007-01-04 10:36:56: DEBUG: sockname 172.20.3.38[4500]<br>2007-01-04 10:36:56: DEBUG: send packet from 172.20.3.38[4500]<br>2007-01-04 10:36:56: DEBUG: send packet to checkpoint_ip[4500]
<br>2007-01-04 10:36:56: DEBUG: src4 172.20.3.38[4500]<br>2007-01-04 10:36:56: DEBUG: dst4 checkpoint_ip[4500]<br>2007-01-04 10:36:56: DEBUG: 1 times of 80 bytes message will be sent to checkpoint_ip[4500]<br>2007-01-04 10:36:56: DEBUG:
<br>00000000 d5317715 d8204e20 d36f383c be695276 05100201 00000000 0000004c<br>574d5470 b7124a1b d3ec1a20 3c460ed6 dc8ec387 16c1d282 b01ecf5b 72ade24f<br>1ffaf9bc f5c8aba5 6dd06995 46567bbd<br>2007-01-04 10:36:56: DEBUG: resend phase1 packet d5317715d8204e20:d36f383cbe695276
<br>2007-01-04 10:36:59: DEBUG: KA: 172.20.3.38[4500]->checkpoint_ip[4500]<br>2007-01-04 10:36:59: DEBUG: sockname 172.20.3.38[4500]<br>2007-01-04 10:36:59: DEBUG: send packet from 172.20.3.38[4500]<br>2007-01-04 10:36:59: DEBUG: send packet to checkpoint_ip[4500]
<br>2007-01-04 10:36:59: DEBUG: src4 172.20.3.38[4500]<br>2007-01-04 10:36:59: DEBUG: dst4 checkpoint_ip[4500]<br>2007-01-04 10:36:59: DEBUG: 1 times of 1 bytes message will be sent to checkpoint_ip[4500]<br>2007-01-04 10:36:59: DEBUG:
<br>ff<br>2007-01-04 10:37:16: ERROR: phase1 negotiation failed due to time up. d5317715d8204e20:d36f383cbe695276<br>2007-01-04 10:37:16: INFO: KA remove: 172.20.3.38[4500]->checkpoint_ip[4500]<br>2007-01-04 10:37:16: DEBUG: KA tree dump:
172.20.3.38[4500]->checkpoint_ip[4500] (in_use=1)<br>2007-01-04 10:37:16: DEBUG: KA removing this one...<br></blockquote><br>My checkpoint listen on UDP 500 and 4500 on all interface.<br>Do you know if the problem if on my checkpoint office's or in my racoon configuration ?
<br>Somebody already made function a raccon with a checkpoint NGX ?<br><br>Thanks by advance to you help.<br><br>Regards,<br><span class="sg">-- <br>------------------------<br>SoukoussMan<br><a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
[email protected]</a></span><br clear="all"><br>-- <br>------------------------<br>SoukoussMan<br><a href="mailto:[email protected]">[email protected]</a>
------=_Part_11126_5212036.1167936025294--