На одном(5.5.5.5) валятся ошибки:
Код: Выделить всё
2013-05-27 05:38:22: INFO: Reading configuration from "/usr/local/etc/racoon/racoon.conf"
2013-05-27 05:46:55: INFO: IPsec-SA request for 2.2.2.2 queued due to no phase1 found.
2013-05-27 05:46:55: INFO: initiate new phase 1 negotiation: 5.5.5.5[500]<=>2.2.2.2[500]
2013-05-27 05:46:55: INFO: begin Identity Protection mode.
2013-05-27 05:46:55: ERROR: phase1 negotiation failed due to send error. 38166c3ce73d5f39:0000000000000000
2013-05-27 05:46:55: ERROR: failed to begin ipsec sa negotication.Код: Выделить всё
2013-05-26 21:14:48: INFO: Reading configuration from "/usr/local/etc/racoon/racoon.conf"
2013-05-26 21:14:48: WARNING: setsockopt(UDP_ENCAP_ESPINUDP_NON_IKE): UDP_ENCAP Invalid argument
2013-05-26 21:14:48: INFO: 2.2.2.2[500] used as isakmp port (fd=5)
2013-05-26 21:36:44: INFO: caught signal 15
2013-05-26 21:36:44: INFO: racoon process 1897 shutdown
2013-05-26 21:37:43: INFO: @(#)ipsec-tools 0.8.0 (http://ipsec-tools.sourceforge.net)
2013-05-26 21:37:43: INFO: @(#)This product linked OpenSSL 0.9.8x 10 May 2012 (http://www.openssl.org/)
2013-05-26 21:37:43: INFO: Reading configuration from "/usr/local/etc/racoon/racoon.conf"
2013-05-26 21:37:43: [b]]WARNING: setsockopt(UDP_ENCAP_ESPINUDP_NON_IKE): UDP_ENCAP Invalid argument[/b
2013-05-26 21:37:43: INFO: 2.2.2.2[500] used as isakmp port (fd=5)
Код: Выделить всё
setkey -DP
192.168.55.0/24[any] 192.168.10.0/24[any] any
in ipsec
esp/tunnel/5.5.5.5-2.2.2.2/unique#16386
spid=2 seq=1 pid=1977
refcnt=1
192.168.10.0/24[any] 192.168.55.0/24[any] any
out ipsec
esp/tunnel/2.2.2.2-5.5.5.5/unique#16385
spid=1 seq=0 pid=1977
refcnt=1Код: Выделить всё
flush;
spdflush;
spdadd 192.168.10.0/24 192.168.55.0/24 any -P out ipsec esp/tunnel/2.2.2.2-5.5.5.5/unique;
spdadd 192.168.55.0/24 192.168.10.0/24 any -P in ipsec esp/tunnel/5.5.5.5-2.2.2.2/unique;racoon.conf
Код: Выделить всё
path include "/usr/local/etc/racoon";
path pre_shared_key "/usr/local/etc/racoon/psk.txt";
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
listen
{
isakmp 2.2.2.2 [500]; # внешний ip данного роутера
}
# Specify various default timers.
timer
{
counter 5; # maximum trying count to send.
interval 20 sec; # maximum interval to resend.
persend 1; # the number of packets per send.
phase1 30 sec;
phase2 15 sec;
}
###############
# REMOTE NET 1
###############
remote 5.5.5.5
{
exchange_mode main,base;
lifetime time 28800 sec;
generate_policy on;
proposal_check strict;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2;
}
}
sainfo subnet 192.168.10.0/24 any address 192.168.55.0/24 any
{
lifetime time 28800 sec;
encryption_algorithm aes128, 3des, cast128, blowfish 448, des, rijndael;
authentication_algorithm hmac_md5, hmac_sha1;
compression_algorithm deflate;
}