forum.lissyara.su

ssh4 писал(а):Re: IPSec теория и практика
ssh4 » 2012-02-15 1:21:30
до инициализации работы демона mpd5 l2tp дело не доходит.
Я поэтому и не парился с выкладыванием конфига mpd5.

fazer » 2013-01-21 17:04:17

ssh4 писал(а):
Re: IPSec теория и практика
ssh4 » 2012-02-15 1:21:30
до инициализации работы демона mpd5 l2tp дело не доходит.
Я поэтому и не парился с выкладыванием конфига mpd5.


Аналогичная фигня..., что-нибудь удолось прояснить ?

2013-01-21 17:21:01: [95.28.213.55] INFO: Selected NAT-T version: draft-ietf-ipsec-nat-t-ike-02
2013-01-21 17:21:01: [92.204.164.3] INFO: Hashing 92.204.164.3[500] with algo #2
2013-01-21 17:21:01: INFO: NAT-D payload #0 verified
2013-01-21 17:21:01: [95.28.213.55] INFO: Hashing 95.28.213.55[56513] with algo #2
2013-01-21 17:21:01: INFO: NAT-D payload #1 doesn't match
2013-01-21 17:21:01: INFO: NAT detected: PEER
2013-01-21 17:21:01: [95.28.213.55] INFO: Hashing 95.28.213.55[56513] with algo #2
2013-01-21 17:21:01: [92.204.164.3] INFO: Hashing 92.204.164.3[500] with algo #2
2013-01-21 17:21:01: INFO: Adding remote and local NAT-D payloads.
2013-01-21 17:21:01: INFO: NAT-T: ports changed to: 95.28.213.55[53266]<->92.204.164.3[4500]
2013-01-21 17:21:01: INFO: KA list add: 92.204.164.3[4500]->95.28.213.55[53266]
2013-01-21 17:21:01: WARNING: Expecting IP address type in main mode, but FQDN.
2013-01-21 17:21:01: INFO: ISAKMP-SA established 92.204.164.3[4500]-95.28.213.55[53266] spi:28711ac3345a7ee1:1ff341eda2b3cec8
2013-01-21 17:21:01: INFO: respond new phase 2 negotiation: 92.204.164.3[4500]<=>95.28.213.55[53266]
2013-01-21 17:21:01: INFO: Update the generated policy : 95.28.213.55/32[53266] 92.204.164.3/32[1701] proto=udp dir=in
2013-01-21 17:21:01: INFO: Adjusting my encmode UDP-Transport->Transport
2013-01-21 17:21:01: INFO: Adjusting peer's encmode UDP-Transport(61444)->Transport(2)
2013-01-21 17:21:01: INFO: IPsec-SA established: ESP/Transport 92.204.164.3[500]->95.28.213.55[500] spi=230203707(0xdb8a13b)
2013-01-21 17:21:01: INFO: IPsec-SA established: ESP/Transport 92.204.164.3[500]->95.28.213.55[500] spi=411438922(0x18860f4a)

и ВСЁ, отваливается по таймауту
fazer
проходил мимо

Сообщения: 4
Зарегистрирован: 2010-01-05 9:48:57

Re: IPSec теория и практика
ssh4 » 2012-02-15 1:21:30
до инициализации работы демона mpd5 l2tp дело не доходит.

alex_471
1. Нужен kernel patch kern/146190
2 . после пересборки ядра активировать net.inet.esp.esp_ignore_natt_cksum=1

l2tp_client:
        create bundle static B1
        set bundle disable compression
        set bundle disable round-robin
        set bundle disable encryption
        set bundle disable crypt-reqd
        set bundle disable bw-manage
        set bundle disable ipv6cp
        set bundle enable ipcp
        set ipcp no vjcomp
        set iface idle 0
        set iface enable tcpmssfix

        create link static L1 l2tp
        set link action bundle B1
        set auth authname blabla
        set auth password 12345
        set link max-redial 5
        set link mtu 1460
        set link keep-alive 20 75
        set l2tp peer xxx.xxx.xxx.xxx
        open

path pre_shared_key "/usr/local/etc/racoon/psk.txt";

log debug;

padding
{
 maximum_length 20;
 randomize off;
 strict_check off;
 exclusive_tail off;
}

listen
{
 isakmp 192.168.11.11 [500];
 isakmp_natt 192.168.11.11 [4500];
 adminsock "/var/db/racoon/racoon.sock";
}

timer
{
 counter 5;
 interval 20 sec;
 persend 1;
 phase1 90 sec;
 phase2 90 sec;
}

remote xxx.xxx.xxx.xxx
{
 exchange_mode main;
 lifetime time 28800 sec;
 generate_policy on;
 proposal_check obey;
 nat_traversal on;
 ike_frag on;
 my_identifier address xxx.xxx.xxx.xx1; внешний адрес на рутере
 proposal {
<------>encryption_algorithm 3des;
<------>#encryption_algorithm aes;
<------>#hash_algorithm md5;
<------>hash_algorithm sha1;
<------>authentication_method pre_shared_key;
<------>dh_group 2;
    }
}

sainfo anonymous
{
 pfs_group 2;
 lifetime time 1 hour;
 encryption_algorithm 3des;
 authentication_algorithm hmac_md5, hmac_sha1;
 compression_algorithm deflate;
}

flush;
spdflush;

spdadd 192.168.11.11/32[any] xxx.xxx.xxx.xxx/32[1701] udp -P out ipsec esp/transport/192.168.11.11-xxx.xxx.xxx.xxx/unique;
spdadd xxx.xxx.xxx.xxx/32[1701] 192.168.11.11/32[any] udp -P in ipsec esp/transport/xxx.xxx.xxx.xxx-192.168.11.11/unique;

• racoon: INFO: IPsec-SA request for xxx.xxx.xxx.xxx queued due to no phase1 found.
  racoon: INFO: initiate new phase 1 negotiation: 192.168.11.11[500]<=>xxx.xxx.xxx.xxx[500]
  racoon: INFO: begin Identity Protection mode.
  racoon: INFO: received Vendor ID: RFC 3947
  racoon: INFO: received broken Microsoft ID: FRAGMENTATION
  racoon: [xxx.xxx.xxx.xxx] INFO: Selected NAT-T version: RFC 3947
  racoon: [xxx.xxx.xxx.xxx] INFO: Hashing xxx.xxx.xxx.xxx[500] with algo #2
  racoon: [192.168.11.11] INFO: Hashing 192.168.11.11[500] with algo #2
  racoon: INFO: Adding remote and local NAT-D payloads.
  racoon: INFO: received Vendor ID: CISCO-UNITY
  racoon: INFO: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
  racoon: [192.168.11.11] INFO: Hashing 192.168.11.11[500] with algo #2
  racoon: INFO: NAT-D payload #0 doesn't match
  racoon: [xxx.xxx.xxx.xxx] INFO: Hashing xxx.xxx.xxx.xxx[500] with algo #2
  racoon: INFO: NAT-D payload #1 verified
  racoon: INFO: NAT detected: ME
  racoon: INFO: KA list add: 192.168.11.11[4500]->xxx.xxx.xxx.xxx[4500]
  racoon: INFO: received Vendor ID: DPD
  racoon: WARNING: port 4500 expected, but 0
  racoon: INFO: ISAKMP-SA established 192.168.11.11[4500]-xxx.xxx.xxx.xxx[4500] spi:afc1face5d027ecc:a7fb795f0104d980
  racoon: INFO: initiate new phase 2 negotiation: 192.168.11.11[4500]<=>xxx.xxx.xxx.xxx[4500]
  racoon: INFO: NAT detected -> UDP encapsulation (ENC_MODE 2->4).
  racoon: INFO: ISAKMP-SA expired 192.168.11.11[4500]-xxx.xxx.xxx.xxx[4500] spi:afc1face5d027ecc:a7fb795f0104d980
  racoon: INFO: ISAKMP-SA deleted 192.168.11.11[4500]-xxx.xxx.xxx.xxx[4500] spi:afc1face5d027ecc:a7fb795f0104d980
  racoon: INFO: KA remove: 192.168.11.11[4500]->xxx.xxx.xxx.xxx[4500]