Re: Strange IPSEC behavior for a basic setup

Christian wrote:

> Hi!
>
> I encountered a strange behavior with IPSEC when doing the following:
>
> I have two gateways, A (3.5 GENERIC#1 i386) and B (3.6 GENERIC#59 i386).
>
> Between those two I have created simple security associations, as 
> described in the vpn man page. I did not define any flows.
>
> I can connect with SSH from A to B (or the other way round, doesn't 
> matter), no problems.
>
> However, when watching the packets on the wire, the first three 
> packets of the SSH TCP connection are ALWAYS being sent plain, while 
> the following packets are sent encapsulated.
>
> (see attached tcpdump)
>
> Do I miss something?
>
> (Actually, I am also interested in why the packets get encrpyted at 
> all, since there is no matching flow?)
>
> Thanks,
> Christian
>
> ========================================================
>
> SA:
>
> /sbin/ipsecadm new esp -src A.A.A.A -dst B.B.B.B \
>        -forcetunnel -spi 1000 -enc aes -auth sha1 \
>        -keyfile enc_key -authkeyfile auth_key
>
> /sbin/ipsecadm new esp -src B.B.B.B -dst A.A.A.A \
>        -forcetunnel -spi 1001 -enc aes -auth sha1 \
>        -keyfile enc_key -authkeyfile auth_key
>
> ========================================================
>
> tcpdump -n -i em0: (on B.B.B.B, while A.A.A.A is connecting with SSH, 
> no other traffic)
>
> 03:50:49.059868 A.A.A.A.29567 > B.B.B.B.22: S 3890748540:3890748540(0) 
> win 16384 <mss 1404,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 
> 1748988273 0> (DF)
> 03:50:49.059939 B.B.B.B.22 > A.A.A.A.29567: S 27341233:27341233(0) ack 
> 3890748541 win 16384 <mss 1460,nop,nop,sackOK,nop,wscale 
> 0,nop,nop,timestamp 915081925 1748988273> (DF)
> 03:50:49.104340 A.A.A.A.29567 > B.B.B.B.22: . ack 1 win 16384 
> <nop,nop,timestamp 1748988273 915081925> (DF)
> 03:50:49.113965 esp B.B.B.B > A.A.A.A spi 0x00001001 seq 14520 len 116 
> (DF)
> 03:50:49.163055 esp A.A.A.A > B.B.B.B spi 0x00001000 seq 12115 len 116 
> (DF)
> 03:50:49.164906 esp B.B.B.B > A.A.A.A spi 0x00001001 seq 14521 len 740 
> (DF)
> 03:50:49.217896 esp A.A.A.A > B.B.B.B spi 0x00001000 seq 12116 len 708 
> (DF)
> 03:50:49.410039 esp B.B.B.B > A.A.A.A spi 0x00001001 seq 14522 len 100 
> (DF)
> 03:50:49.433388 esp A.A.A.A > B.B.B.B spi 0x00001000 seq 12117 len 116 
> (DF)
>
I think you have to define at least 2 flows on any gateway for gw<to>gw 
comunications, plus 6 more for subnets (LAN) behind them, look at my 
examples here:
http://www.sickness.it/vpnhowtoformal.txt
they used to work quite well for me, even If I use isakmpd now