Date: Wed, 8 Mar 2017 13:20:10 +0700 From: Victor Sudakov <vas@mpeks.tomsk.su> To: freebsd-net@freebsd.org Subject: Re: GSSAPI and racoon Message-ID: <20170308062010.GA65343@admin.sibptus.transneft.ru> In-Reply-To: <20170303154509.GA81714@admin.sibptus.transneft.ru> References: <20170303154509.GA81714@admin.sibptus.transneft.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
Victor Sudakov wrote: > > Is anyone running GSSAPI+IKE (racoon)? I'm still struggling with racoon in GSSAPI mode. racoon says 2017-03-08 13:01:59: [192.168.3.38] ERROR: failed to get valid proposal. 2017-03-08 13:01:59: [192.168.3.38] ERROR: failed to pre-process ph1 packet (side: 1, status 1). 2017-03-08 13:01:59: [192.168.3.38] ERROR: phase1 negotiation failed. I would be very grateful if someone with IPSec experience could look at my configs and logs. What am I missing? Not to clutter the list, I'm giving short URLs: racoon.conf: http://termbin.com/lk2w racoon debug log: http://termbin.com/0lol keytab: http://termbin.com/4yj9 The remote host configuration is identical, only it's called "ipsec1", not "ipsec2". BTW, does the "gss_id" parameter in the proposal section mean my id or remote's id? I interpret is as my id. PS If I comment out the GSSAPI stuff and enable the PSK stuff, everything works all right, so my SPDs at least are correct. -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN AS43859
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20170308062010.GA65343>