Date: Thu, 11 Feb 2010 16:17:35 +0300 From: Denis Antrushin <DAntrushin@mail.ru> To: freebsd-net@freebsd.org Subject: Re: IPSec connection troubles Message-ID: <4B74036F.6060803@mail.ru> In-Reply-To: <20100211125420.G27327@maildrop.int.zabbadoz.net> References: <4B73E902.6050301@mail.ru> <20100211124756.GA9528@zeninc.net> <20100211125420.G27327@maildrop.int.zabbadoz.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On 02/11/10 15:55, Bjoern A. Zeeb wrote: > On Thu, 11 Feb 2010, VANHULLEBUS Yvan wrote: > >>> How can I further debug this problem? >> >> You can check on responder that you have lots of TCP checksums errors, >> which will confirm that you would need support for NAT-OA extension of >> NAT-T RFC, as you want to do some Transport IPsec of TCP flows using >> NAT-T. >> >> >> Unfortunately, actually, there is no support for NAT-OA extension, >> there are just specifications on PFKey interface to send them to >> kernel. > > Him saying it works on linux - has ipsec-tools grown proper OA support > these days? If that would be the case the kernel would probably a > minor task. Yes, I see some NAT-OA debug messages in racoon logs. With ipsec-tools 0.7.3 they were missing and I could not even finish quick mode exchange... I'm sorry for ignorance, but can I workaround this problem using UDP instead? Or it requires that NAT_OA stuff as well? Thanks, Denis
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4B74036F.6060803>