From owner-freebsd-security@FreeBSD.ORG Tue May 9 07:08:12 2006 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1ECB516A400 for ; Tue, 9 May 2006 07:08:12 +0000 (UTC) (envelope-from johnryan_852@hotmail.com) Received: from hotmail.com (bay22-f24.bay22.hotmail.com [64.4.16.74]) by mx1.FreeBSD.org (Postfix) with ESMTP id D255E43D49 for ; Tue, 9 May 2006 07:08:11 +0000 (GMT) (envelope-from johnryan_852@hotmail.com) Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Tue, 9 May 2006 00:08:11 -0700 Message-ID: Received: from 80.15.249.165 by by22fd.bay22.hotmail.msn.com with HTTP; Tue, 09 May 2006 07:08:07 GMT X-Originating-IP: [157.161.173.24] X-Originating-Email: [johnryan_852@hotmail.com] X-Sender: johnryan_852@hotmail.com From: "fred bloggs" To: freebsd-security@freebsd.org Date: Tue, 09 May 2006 07:08:07 +0000 Mime-Version: 1.0 Content-Type: text/plain; format=flowed X-OriginalArrivalTime: 09 May 2006 07:08:11.0356 (UTC) FILETIME=[550711C0:01C67337] Subject: IPsec with Racoon2 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 May 2006 07:08:12 -0000 Hi, I tried posting this to FreeBSD-questions and to freebsd-security (while not a member) and haven't had any replies. I'm trying to get IPsec running between 2 FreeBSD boxes, using racoon2. I was originnaly using vmware systems, but in order to eliminate vmware as a cause, I've moved it to a native machine. spmd and iked start up okay, but I get an error when I try a ping across the tunnel. /var/log/messages shows: May 5 13:52:36 biosa-vm4 iked: [INTERNAL_ERR]: if_spmd.c:726: SLID failed: 550 Operation failed May 5 13:52:36 biosa-vm4 iked: [INTERNAL_ERR]: isakmp.c:647:isakmp_initiate_cont(): 0:172.20.36.55[0] - 172.20.36.52[0]:0x0:can't find selector (index (null)) The startup shows: 2006-05-05 13:53:54 [INFO]: main.c:269:main(): starting iked for racoon2 20051102a 2006-05-05 13:53:54 [INFO]: main.c:272:main(): OPENSSLDIR: "/etc/ssl" 2006-05-05 13:53:54 [INFO]: main.c:282:main(): reading config /usr/local/etc/racoon2.conf 2006-05-05 13:53:54 [DEBUG]: ike_conf.c:3247:ike_conf_check_consistency(): checking configuration 2006-05-05 13:53:54 [DEBUG]: if_spmd.c:350: spmd I/F connection ok: 220 F8A......76C2B9 2006-05-05 13:53:54 [DEBUG]: cfsetup.c:3306: spmd_read_password_file([/usr/local/etc/racoon2/spmd.pwd], [cfsetup.c:3376], 1) 2006-05-05 13:53:54 [DEBUG]: cfsetup.c:3351: read 16 bytes 20 06-05-05 13:53:54 [DEBUG]: if_spmd.c:413: spmd LOGIN ok: 250 OK 2006-05-05 13:53:54 [INFO]: isakmp.c:339:isakmp_open(): socket 5 bind 172.20.36.55[500] uname -a shows: Running FreeBSD-STABLE via cvsup FreeBSD zengyu.nowhere.com 6.1-RC FreeBSD 6.1-RC #0: Fri Apr 28 12:36:37 CEST 2006 Heres my network: The host has 2 network cards are functional. ifconfig_rl0="inet 172.20.36.55 netmask 0xfffff800" ifconfig_xl0="inet 192.168.4.1 netmask 0xffffff00" # _______________________ _______________________ # / Ext IP A.B.C.D \ tunnel / Ext IP W.X.Y.Z \ # ---| Int IP 192.168.1.1/24 |===============| Int IP 192.168.4.1/24 |--- # \_______________________/ \_______________________/ # For host "A.B.C.D" # gif_interfaces="gif0" # gifconfig_gif0="A.B.C.D W.X.Y.Z" # ifconfig_gif0="inet 192.168.1.1 192.168.4.1 netmask 0xffffffff" # static_routes="vpn" # route_vpn="-net 192.168.4.0/24 192.168.4.1" gif_interfaces="gif0" gifconfig_gif0="172.20.36.55 172.20.36.52" ifconfig_gif0="inet 192.168.4.1 192.168.1.1 netmask 0xffffffff" static_routes="vpn" route_vpn="-net 192.168.1.0/24 192.168.1.1" Without IPsec running, I can ping the remote interfaces 192.168.[14].1 both ways My racoon2.conf looks like: setval { PSKDIR "/usr/local/etc/racoon2/psk"; CERTDIR "/usr/local/etc/racoon2/cert"; }; # interface info interface { ike { MY_IPV4%rl0; }; spmd { unix "/var/run/racoon/spmif"; }; spmd_password "/usr/local/etc/racoon2/spmd.pwd"; }; # resolver info resolver { resolver off; }; # # default section # default { remote { ikev2 { logmode normal; kmp_sa_lifetime_time infinite; kmp_sa_lifetime_byte infinite; max_retry_to_send 3; interval_to_send 10 sec; times_per_send 1; kmp_sa_nego_time_limit 60 sec; ipsec_sa_nego_time_limit 40 sec; kmp_enc_alg { aes256_cbc; 3des_cbc; }; kmp_hash_alg { hmac_sha1; hmac_md5; aes_xcbc; }; kmp_auth_method { dss; }; kmp_dh_group { 1; 2; 5; 14; 15; }; random_pad_content on; random_padlen on; max_padlen 50 bytes; }; }; policy { ipsec_mode tunnel; ipsec_level unique; # Not Yet Implemented, always 'unique' }; ipsec { ipsec_sa_lifetime_time infinite; ipsec_sa_lifetime_byte infinite; }; sa { esp_enc_alg { aes128_cbc; 3des_cbc; }; esp_auth_alg { hmac_sha1; hmac_md5; }; }; }; ipsec ipsec_ah_esp { ipsec_sa_lifetime_time 28800 sec; sa_index { ah_01; esp_01; }; }; ipsec ipsec_esp { ipsec_sa_lifetime_time 28800 sec; sa_index esp_01; }; sa ah_01 { sa_protocol ah; ah_auth_alg { hmac_sha1; hmac_md5; }; }; sa esp_01 { sa_protocol esp; esp_enc_alg { aes128_cbc; 3des_cbc; }; esp_auth_alg { hmac_sha1; hmac_md5; }; }; # biosa-vm1.ch.genedata.com remote biosa-vm1.nowhere.com { acceptable_kmp { ikev2; }; ikev2 { my_id fqdn "biosa-vm4.nowhere.com"; peers_id fqdn "biosa-vm1.nowhere.com"; peers_ipaddr 172.20.36.52 port 500; kmp_enc_alg { aes256_cbc; aes192_cbc; 3des_cbc; }; kmp_prf_alg { hmac_md5; hmac_sha1; aes128_cbc; }; kmp_hash_alg { hmac_md5; hmac_sha1; aes_xcbc; }; kmp_dh_group { 5; }; kmp_auth_method { psk; }; pre_shared_key "${PSKDIR}/secret.psk"; }; selector_index 42; }; selector 41 { direction outbound; src 172.20.36.55; dst 172.20.36.52; upper_layer_protocol "tcp"; policy_index TUNNEL; }; selector 42 { direction inbound; dst 172.20.36.52; src 172.20.36.55; upper_layer_protocol "tcp"; policy_index TUNNEL; }; policy TUNNEL { action auto_ipsec; remote_index biosa-vm1.nowhere.com; ipsec_mode tunnel; ipsec_index { ipsec_esp; }; ipsec_level unique; peers_sa_ipaddr 172.20.36.52; my_sa_ipaddr 172.20.36.55; }; Anyone got any idea what I'm doing wrong? Thanks in advance John Ryan _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/