Date: Sat, 26 Sep 2015 20:30:57 +0600 From: Victor Sudakov <vas@mpeks.tomsk.su> To: freebsd-net@freebsd.org Subject: Re: transport mode IPSec with Windows 7, static keys Message-ID: <20150926143057.GA88375@admin.sibptus.tomsk.ru> In-Reply-To: <20150925064234.GA63016@admin.sibptus.tomsk.ru> References: <20150922084111.GA89385@admin.sibptus.tomsk.ru> <20150925064234.GA63016@admin.sibptus.tomsk.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
Victor Sudakov wrote: > > However, FreeBSD+racoon and Windows 7 with its builtin IPsec > PolicyAgent service work more or less (E: 3des-cbc, A: hmac-sha1) on > pre-shared secret. > > The only problem I have encountered is that after Windows reboot, > traffic stops flowing between FreeBSD and Windows until racoon is > restarted. > > I wonder if it has anything to do with the net.key.preferred_oldsa > setting. The two sysctls: net.key.preferred_oldsa=0 net.key.blockacq_count=0 seem to fix the reboot problem. Could anyone explain the mechanism? I have never had to tweak them to get IPsec working between FreeBSD hosts. -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN sip:sudakov@sibptus.tomsk.ru
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20150926143057.GA88375>