Re: FreeBSD 4.7-REL-p3 and an IPsec connection to Linksys BEFVP41

On 2/19/2003 8:39 PM, George Hartzell wrote:
> I'd like to set up an IPsec connection between my laptop running
> FreeBSD 4.7-REL-p3 and a Linksys BEFVP41 router w/ built in IPsec
> capability.
> 
> I've found a number of sites w/ information on setting up ipsec
> between a pair of FreeBSD machines, including:
> 
>   http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html
>   http://www.freebsddiary.org/ipsec-tunnel.php
>   http://www.daemonnews.org/200101/ipsec-howto.html
>   http://www.bsdtoday.com/2002/April/Features671.html
> 
> But none that talk about getting FreeBSD's IPsec talking to anything
> non-FreeBSD.
> 
> All of the methods are based on setting up a gif tunnel and passing
> the packets over that.

Not really. There are a number of different ways to set this up, and 
only one (valid) one uses gif tunnels:

1. Use IPsec transport mode. The handbook (1st link) explains how to set 
this up.

2. Use IPsec tunnel mode. Again, the handbook describes the setup, so 
does the bsdtoday article.

(Note that these two do not use IPIP gif tunnels!)

3. Use an IPIP gif tunnel and IPsec transport mode, as described in 
draft-touch-ipsec-vpn, and the daemonnews article. This is an 
alternative to IPsec tunnel mode that has advantages when running 
dynamic routing - you don't seem to, so you should stick to vanilla 
IPsec, esp. since you only control one end.

You do NOT want to follow the freebsddiary article, which sets up 
parallel IPIP gif tunnels and IPsec tunnel mode SAs. It abuses the 
duplicate tunnels for routing, and can result in subtle interactions 
that can make your traffic go silently unencrypted. (I've contacted the 
author a long time ago, but he doesn't seem to belive in fixing "diary" 
entries.)

 > I've tried a number of variations on the
> recommended recipes, and at best I can watch the isakmp packet going
> from the laptop towards the router and get see an icmp packet back
> from the router that suggests the the gif tunnel isn't what it wants
> to see (sadly, I didn't save the exact message, but can recreate it if
> it's important enough).

Without a lot more information about your configuration, we can only 
guess at the issues.

> So, the quick question is, has anyone set up a FreeBSD laptop as a
> "road warrior" to an IPsec router?  I'd appreciate any pointers.

All three aproaches above can be made to work, as explained by the 
tutorials you cite. The question is, which one is supported by your 
Linksys box?

Lars
-- 
Lars Eggert <[email protected]>           USC Information Sciences Institute