Date: Thu, 5 Sep 2002 22:50:49 -0600 From: Tillman Hodgson <tillman@seekingfire.com> To: Mike Tancsa <mike@sentex.net> Cc: questions@FreeBSD.ORG Subject: Re: IPSEC & routing w/o gif Message-ID: <20020905225049.A13151@seekingfire.com> In-Reply-To: <vq9gnu0qk29fjk0un4tne8vku57f33vmh2@4ax.com>; from mike@sentex.net on Fri, Sep 06, 2002 at 12:01:25AM -0400 References: <mailman.1031178127.4718.fquestions-l@lists.sentex.ca> <vq9gnu0qk29fjk0un4tne8vku57f33vmh2@4ax.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> One of the things I dont like about how IPSec works is that it doesnt work > like you would expect in terms of routes and interfaces. So when you do a > netstat -nr, you dont see a route to the other side. The packets, just get > there "magically" which is fine in Windows world, but irks people in the > land of UNIX as most admins like to have a bit of understanding.... In > your example, it looks like the ESP tunnel is setup, but you need to > specify your soruce address. So, if your internal interface is > 192.168.23.2, try the following ping instead > > ping -S 192.168.32.2 192.168.31.206 > > Otherwise, the IP stack will automatically chose the source address based > upon the next hop. That explains my discovery that the tunnel *does* work, from workstations behind the gateway. Thanks! How does this interact with and affect dynamic routing (i.e., OSPF via zebra)? > You dont need any of that. I wrote a quick howto on creating an ESP tunnel > between FreeBSD and a Cisco that someone posted at > > http://www.ezunix.org/modules.php?op=modload&name=Sections&file=index&req=viewarticle&artid=34&page=1 > > You should be able to get it up and running against LINUX as well. If you > do, perhaps post the LINUX config here. We've now got a mostly-working config, and an NFS mount works across it :-) The remaining problem is that after a period of time the FreeBSD box can't access the other side ("sendto: No route to host"). However, if at that point the FreeS/WAN box initiates any traffic then everything comes back to normal. IOW, the FreeS/WAN box will always appear to work, the FreeBSD box will "go away" after a while and will have to wait until the other side initiates. We have identical lifetime values (lifetime 52 min in the remote section, lifetiem 30 min in the sainfo section in my racoon.conf and ikelifetime=52m, keylife=30m in the other ends ipsec.conf), which I initially thought might have been the problem. Any ideas on what I should be looking for? Thanks muchly, -T -- Why look for meaning where there is none? Would you follow a path you know leads nowhere? - Query of the Mentat School To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020905225049.A13151>