Суть такова
10.20.10.83(хост)<->216.193.93.179(cisco шлюз)<--->Internet<--->193.148.246.66(Linux шлюз)<->172.16.10.0/24(сеть)
Настроил IPsec между Linux и Cisco. Фаза 1 и 2 устанавливается, но не проходит пинг между сетями. Конфиг файлы и конфигурация:
Код: Выделить всё
Sun ~ # setkey -DP
10.20.10.83[any] 172.16.10.0/24[any] 255
in prio def ipsec
esp/tunnel/216.193.93.179-193.148.246.66/require
created: May 14 08:49:57 2014 lastused:
lifetime: 0(s) validtime: 0(s)
spid=4440 seq=26 pid=28964
refcnt=1
172.16.10.0/24[any] 10.20.10.83[any] 255
out prio def ipsec
esp/tunnel/193.148.246.66-216.193.93.179/require
created: May 14 08:49:57 2014 lastused: May 14 08:55:28 2014
lifetime: 0(s) validtime: 0(s)
spid=4433 seq=0 pid=28964
refcnt=2Код: Выделить всё
Sun ~ # setkey -D
193.148.246.66 216.193.93.179
esp mode=tunnel spi=2208704428(0x83a627ac) reqid=0(0x00000000)
E: 3des-cbc 7ad70d0e 59d077f2 13c2734b f08037ee 7003fed7 8961777f
A: hmac-md5 e1e157bd 53ed8edf b1b101c4 0e78f1eb
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: May 14 08:50:43 2014 current: May 14 09:01:59 2014
diff: 676(s) hard: 28800(s) soft: 23040(s)
last: hard: 0(s) soft: 0(s)
current: 0(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 0 hard: 0 soft: 0
sadb_seq=1 pid=29030 refcnt=0
216.193.93.179 193.148.246.66
esp mode=tunnel spi=3314345(0x003292a9) reqid=0(0x00000000)
E: 3des-cbc 588a57b6 9be43f4f 8c6b5c7d 612d2601 17f617a8 bff38eb0
A: hmac-md5 a7f6d395 c2acc243 287ed0fc b863d8f2
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: May 14 08:50:43 2014 current: May 14 09:01:59 2014
diff: 676(s) hard: 28800(s) soft: 23040(s)
last: hard: 0(s) soft: 0(s)
current: 0(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 0 hard: 0 soft: 0
sadb_seq=0 pid=29030 refcnt=0
Код: Выделить всё
Sun ~ # cat /etc/racoon/racoon.conf
path pre_shared_key "/etc/racoon/psk.txt";
remote 216.193.93.179
{
nat_traversal on;
exchange_mode main;
proposal_check claim;
lifetime time 86400 sec;
proposal {
encryption_algorithm 3des;
hash_algorithm md5;
authentication_method pre_shared_key;
dh_group 5;
}
}
sainfo address 172.16.10.0/24 any address 10.20.10.83/32 any
{
pfs_group 5;
lifetime time 86400 sec;
encryption_algorithm 3des;
authentication_algorithm hmac_md5;
compression_algorithm deflate;
}Код: Выделить всё
Sun ~ # cat /etc/ipsec-tools.conf
#!/usr/sbin/setkey -f
flush;
spdflush;
spdadd 172.16.10.0/24 10.20.10.83 any -P out ipsec esp/tunnel/193.148.246.66-216.193.93.179/require;
spdadd 10.20.10.83 172.16.10.0/24 any -P in ipsec esp/tunnel/216.193.93.179-193.148.246.66/require;
Код: Выделить всё
May 14 08:49:57 Sun racoon: INFO: 172.16.10.1[500] used for NAT-T
May 14 08:49:57 Sun racoon: INFO: 172.16.10.1[500] used as isakmp port (fd=12)
May 14 08:49:57 Sun racoon: INFO: 172.16.10.1[4500] used for NAT-T
May 14 08:49:57 Sun racoon: INFO: 172.16.10.1[4500] used as isakmp port (fd=13)
May 14 08:49:57 Sun racoon: INFO: 193.148.246.66[500] used for NAT-T
May 14 08:49:57 Sun racoon: INFO: 193.148.246.66[500] used as isakmp port (fd=18)
May 14 08:49:57 Sun racoon: INFO: 193.148.246.66[4500] used for NAT-T
May 14 08:49:57 Sun racoon: INFO: 193.148.246.66[4500] used as isakmp port (fd=19)
May 14 08:50:42 Sun racoon: INFO: IPsec-SA request for 216.193.93.179 queued due to no phase1 found.
May 14 08:50:42 Sun racoon: INFO: initiate new phase 1 negotiation: 193.148.246.66[500]<=>216.193.93.179[500]
May 14 08:50:42 Sun racoon: INFO: begin Identity Protection mode.
May 14 08:50:42 Sun racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
May 14 08:50:42 Sun racoon: INFO: received broken Microsoft ID: FRAGMENTATION
May 14 08:50:42 Sun racoon: [216.193.93.179] INFO: Selected NAT-T version: draft-ietf-ipsec-nat-t-ike-02
May 14 08:50:42 Sun racoon: [216.193.93.179] INFO: Hashing 216.193.93.179[500] with algo #1
May 14 08:50:42 Sun racoon: [193.148.246.66] INFO: Hashing 193.148.246.66[500] with algo #1
May 14 08:50:42 Sun racoon: INFO: Adding remote and local NAT-D payloads.
May 14 08:50:42 Sun racoon: INFO: received Vendor ID: CISCO-UNITY
May 14 08:50:42 Sun racoon: INFO: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
May 14 08:50:42 Sun racoon: [193.148.246.66] INFO: Hashing 193.148.246.66[500] with algo #1
May 14 08:50:42 Sun racoon: INFO: NAT-D payload #0 verified
May 14 08:50:42 Sun racoon: [216.193.93.179] INFO: Hashing 216.193.93.179[500] with algo #1
May 14 08:50:42 Sun racoon: INFO: NAT-D payload #1 verified
May 14 08:50:42 Sun racoon: INFO: NAT not detected
May 14 08:50:42 Sun racoon: INFO: received Vendor ID: DPD
May 14 08:50:42 Sun racoon: WARNING: port 500 expected, but 0
May 14 08:50:42 Sun racoon: INFO: ISAKMP-SA established 193.148.246.66[500]-216.193.93.179[500] spi:d4308f00f105e919:30df322a74ba9f4d
May 14 08:50:43 Sun racoon: INFO: initiate new phase 2 negotiation: 193.148.246.66[500]<=>216.193.93.179[500]
May 14 08:50:43 Sun racoon: INFO: received RESPONDER-LIFETIME: 28800 seconds
May 14 08:50:43 Sun racoon: INFO: IPsec-SA established: ESP/Tunnel 193.148.246.66[500]->216.193.93.179[500] spi=3314345(0x3292a9)
May 14 08:50:43 Sun racoon: INFO: IPsec-SA established: ESP/Tunnel 193.148.246.66[500]->216.193.93.179[500] spi=2208704428(0x83a627ac)
Код: Выделить всё
09:31:06.722808 IP 193.148.246.66 > 10.20.10.83: ICMP echo request, id 32391, seq 2413, length 64
09:31:07.730926 IP 193.148.246.66 > 10.20.10.83: ICMP echo request, id 32391, seq 2414, length 64
09:31:08.732133 IP 193.148.246.66 > 10.20.10.83: ICMP echo request, id 32391, seq 2415, length 64
09:31:09.738854 IP 193.148.246.66 > 10.20.10.83: ICMP echo request, id 32391, seq 2416, length 64
09:31:10.746983 IP 193.148.246.66 > 10.20.10.83: ICMP echo request, id 32391, seq 2417, length 64