From owner-freebsd-net@FreeBSD.ORG Fri Feb 20 01:00:44 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F1F1616A4CE for ; Fri, 20 Feb 2004 01:00:44 -0800 (PST) Received: from burka.carrier.kiev.ua (burka.carrier.kiev.ua [193.193.193.107]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3AAD943D1D for ; Fri, 20 Feb 2004 01:00:44 -0800 (PST) (envelope-from netch@lucky.net) Received: from netch@localhost [127.0.0.1] (netch@localhost [127.0.0.1]) by burka.carrier.kiev.ua with ESMTP id i1K90dYF081027 for ; Fri, 20 Feb 2004 11:00:41 +0200 (EET) (envelope-from netch@burka.carrier.kiev.ua) Received: (from netch@localhost) by burka.carrier.kiev.ua (8.12.8p2/8.12.8/Submit) id i1K90dJC081024 for net@freebsd.org; Fri, 20 Feb 2004 11:00:39 +0200 (EET) (envelope-from netch) Date: Fri, 20 Feb 2004 11:00:39 +0200 From: Valentin Nechayev To: net@freebsd.org Message-ID: <20040220090039.GB58238@lucky.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-42: On X-Verify-Sender: verified Subject: gre, ipsec, can't detunnel X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: netch@lucky.net List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Feb 2004 09:00:45 -0000 Trying to set up ipsec'ed tunnel with explicit routing to it. Having 2 FreeBSD's (quarta - 4.9, grizzly - 5.2.1). root@grizzly:~>> # ifconfig gre0 gre0: flags=9051 mtu 1476 tunnel inet 193.193.193.138 --> 193.193.193.11 inet 10.0.0.2 --> 10.0.0.1 netmask 0xffffffff root@quarta:~>> # ifconfig gre1 gre1: flags=9051 mtu 1476 tunnel inet 193.193.193.11 --> 193.193.193.138 inet 10.0.0.1 --> 10.0.0.2 netmask 0xffffffff Interaction 10.0.0.1 <-> 10.0.0.2 works ok. Adding IPSEC transport between external sides of tunnel: root@grizzly:~>> # less /etc/ipsec.conf flush; add 193.193.193.11 193.193.193.138 esp 1100 -m transport -E des-cbc "01239876" -A keyed-md5 "dafa0066a4fc7788"; add 193.193.193.138 193.193.193.11 esp 1101 -m transport -E des-cbc "01239876" -A keyed-md5 "dafa0066a4fc7788"; spdflush; spdadd 193.193.193.138/32 193.193.193.11/32 any -P out ipsec esp/transport//use; spdadd 193.193.193.11/32 193.193.193.138/32 any -P in ipsec esp/transport//use; root@quarta:~>> # less /etc/ipsec.conf flush; add 193.193.193.11 193.193.193.138 esp 1100 -m transport -E des-cbc "01239876" -A keyed-md5 "dafa0066a4fc7788"; add 193.193.193.138 193.193.193.11 esp 1101 -m transport -E des-cbc "01239876" -A keyed-md5 "dafa0066a4fc7788"; spdflush; spdadd 193.193.193.11/32 193.193.193.138/32 any -P out ipsec esp/transport//use; spdadd 193.193.193.138/32 193.193.193.11/32 any -P in ipsec esp/transport//use; (IKE is disabled specially to simplify functioning.) Well, all interaction of external IPs is OK, with encryption and decryption. But interaction of internal IP's (e.g. `ping 10.0.0.2') fails. The same setup works in the following cases: - Encryption of packets going to GRE tunnel on FreeBSD and decryption on Cisco 7140 (well, with des-cbc, but disabling AH between FreeBSD's doesn't fix the problem): I see them after Cisco. - Encryption and decryption when tunnel is switched from GRE to IPIP (device gif). So, the only problem side is obtaining packets from GRE after IPSEC decryption: it fails on FreeBSD without any understandable reason. Questions here: 1. Did anybody seen the same problem? 2. Is it relative to my setup? If yes, why Cisco 7140 is able to decrypt and detunnel IPSEC+GRE? Admin for this Cisco router doesn't want to select IPIP encapsulation due to CEF problems, so I want to give maximal efforts to run it with GRE. P.S. Tunnel IPSEC mode also doesn't help, with the same result (Cisco can decrypt, FreeBSD can't). -netch-