From owner-freebsd-security@FreeBSD.ORG Thu Jul 29 00:44:05 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1B21016A4CE for ; Thu, 29 Jul 2004 00:44:05 +0000 (GMT) Received: from mail.star-sw.com (mail.star-sw.com [217.195.82.1]) by mx1.FreeBSD.org (Postfix) with ESMTP id 079A443D2F for ; Thu, 29 Jul 2004 00:44:04 +0000 (GMT) (envelope-from nkritsky@internethelp.ru) Received: from exchange.star-sw.com (argon.star-sw.com [217.195.82.10]) by mail.star-sw.com (8.12.11/8.12.11) with ESMTP id i6T0i1L5085301 for ; Thu, 29 Jul 2004 04:44:01 +0400 (MSD) Received: from star-sw.com ([217.195.82.9]) by exchange.star-sw.com with Microsoft SMTPSVC(5.0.2195.5329); Thu, 29 Jul 2004 04:44:01 +0400 Received: from ibmka.star-sw.com ([192.168.32.130]) by star-sw.com with Microsoft SMTPSVC(5.0.2195.5329); Thu, 29 Jul 2004 04:44:00 +0400 Date: Thu, 29 Jul 2004 04:44:01 +0400 From: "Nickolay A. Kritsky" X-Mailer: The Bat! (v1.49) Personal X-Priority: 3 (Normal) Message-ID: <1201164112343.20040729044401@internethelp.ru> To: Lewey Taylor In-reply-To: <1090892097.7219.0.camel@localhost> References: <1090892097.7219.0.camel@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 29 Jul 2004 00:44:00.0888 (UTC) FILETIME=[23C90780:01C47505] cc: freebsd-security@freebsd.org Subject: Re: Cisco IOS and racoon X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: "Nickolay A. Kritsky" List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Jul 2004 00:44:05 -0000 Hello Lewey, First, I am really new to IPSEC, so may be my advices will be no use to you. Second, I have once succeded in setting up FreeBSD<->Cisco IPSec link, so may be my advices will be of some use to you. Tuesday, July 27, 2004, 5:34:58 AM, you wrote: LT> LT> #! /bin/sh LT> #spdadd 1.1.1.1/32[500] 2.2.2.2/32[500] udp -P out none; LT> #spdadd 1.1.1.1/32[500] 2.2.2.2/32[500] udp -P out none; LT> case "$1" in LT> start) LT> setkey -F LT> setkey -FP LT> setkey -c < spdadd 10.0.10.0/24 10.0.3.0/24 ipencap -P out ipsec LT> esp/tunnel/1.1.1.1-2.2.2.2/require; LT> spdadd 10.0.3.0/24 10.0.1.0/24 ipencap -P in ipsec LT> esp/tunnel/2.2.2.2-1.1.1.1/require; LT> EOF LT> ;; LT> stop) LT> setkey -F LT> setkey -FP LT> ;; LT> *) LT> echo "Usage: `basename $0` {start|stop}" >&2 LT> ;; LT> esac LT> exit 0 LT> First advice: change `ipencap' to `any' in your spdadd config. If i am right, you don't need ipencap here since you don't use ipinip on cisco. If i am wrong, `any' should work anyway. Second advice: do not try to understand racoon's logs. This is the last thing to do. Only if nothing else helps, you can try it. And the best way to do it is to build racoon from sources, to have the ability to put there some human-readable debugprintfs. Third advice - what really helps: Make some errors. Change the config file of racoon in strictly wrong way. Use wrong algorithms for encryption and signing, non-matching psk, play with padding, change some weird options like `proposal_check', `situation', `doi', etc... Do the wrong things. _ONE_CHANGE_FOR_ONE_RUN_ . Then take a quick look in the log. If setting psk from to produces no change in logs - ie, everything stops on the same error, then, _maybe_ your is not correct at all. _But_ , _maybe_ things just become broken before anybody cares about your psk. You will need to use your brain. I am sorry, but I don't know about silver bullets on IPSec debugging. Using intentional errors can help you to narrow your search to some specific sections of racoon.conf, and to some specific files/functions in src tree. Otherwise you will be lost in the sea of even possibilities. The most ugly problem I ran into, was that IPSec uses about 50 different parameters that should match on each sides of tunnel, and 1. Most of them are named differently in racoon and cisco (that's called synonym - sounds different, means the same) 2. Some of them can be named the same but mean different (that's called homonym ;) ) 3. Some of them can be hardwired into the system. Different ones on racoon and cisco. Well, I hope that will help you. Good luck! ;------------------------------------------- ; NKritsky ; mailto:nkritsky@internethelp.ru