долгое время бьюсь над соединением двух сетей
что имеем:
ТОЧКА1 wan ip 94.xxx.xxx.xxx
сеть за сервером 192.168.4.0/24
ТОЧКА2wan 88.yyy.yyy.yyy
сеть за сервером 192.168.1.0/24
конфиг
ТОЧКА1cat /etc/ipsec-tools.conf
# /usr/sbin/setkey -f
flush;
spdflush;
spdadd 192.168.4.0/24 192.168.1.0/24 any -P out ipsec esp/tunnel/94.xxx.xxx.xxx-88.yyy.yyy.yyy/require;
spdadd 192.168.1.0/24 192.168.4.0/24 any -P in ipsec esp/tunnel/88.yyy.yyy.yyy-94.xxx.xxx.xxx/require;
cat /etc/racoon/racoon.conf
root@mail:~# cat /etc/racoon/racoon.conf
path pre_shared_key "/etc/racoon/psk.key";
#path backupsa "/etc/racoon/backupsa";
log notify;
#log debug;
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
listen
{
isakmp 94.xxx.xxx.xxx [500];
strict_address;
}
timer
{
counter 5;
interval 20 sec;
persend 1;
phase1 30 sec;
phase2 15 sec;
}
remote 88.yyy.yyy.yyy
{
exchange_mode main;
proposal
{
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group modp1024;
}
}
#
sainfo address 192.168.4.0/24 any address 192.168.1.0/24 any
{
pfs_group modp1024;
encryption_algorithm 3des;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
lifetime time 3600 sec;
}
cat /etc/racoon/psk.txt
# IPv4/v6 addresses
10.160.94.3 mekmitasdigoat
172.16.1.133 0x12345678
194.100.55.1 whatcertificatereally
3ffe:501:410:ffff:200:86ff:fe05:80fa mekmitasdigoat
3ffe:501:410:ffff:210:4bff:fea2:8baa mekmitasdigoat
# USER_FQDN
foo@kame.net mekmitasdigoat
# FQDN
foo.kame.net hoge
88.yyy.yyy.yyy b2cef132a99e3172fffde2bee6e3d6db0f905d69a96e465231e3bb7ef186c0692210999a
конфиги
ТОЧКА2cat /etc/ipsec-tools.conf
# /usr/sbin/setkey -f
flush;
spdflush;
spdadd 192.168.1.0/24 192.168.4.0/24 any -P out ipsec esp/tunnel/88.yyy.yyy.yyy-94.xxx.xxx.xxx/require;
spdadd 192.168.4.0/24 192.168.1.0/24 any -P in ipsec esp/tunnel/94.xxx.xxx.xxx-88.yyy.yyy.yyy/require;
cat /etc/racoon/racoon.conf
path pre_shared_key "/etc/racoon/psk.txt";
log notify;
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
listen
{
isakmp 88.yyy.yyy.yyy [500];
strict_address;
}
timer
{
counter 5;
interval 20 sec;
persend 1;
phase1 30 sec;
phase2 15 sec;
}
remote 94.xxx.xxx.xxx
{
exchange_mode main;
proposal
{
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group modp1024;
}
}
sainfo address 192.168.1.0/24 any address 192.168.4.0/24 any
{
pfs_group modp1024;
encryption_algorithm 3des;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
lifetime time 3600 sec;
}
cat /etc/racoon/psk.txt
# IPv4/v6 addresses
10.160.94.3 mekmitasdigoat
172.16.1.133 0x12345678
194.100.55.1 whatcertificatereally
3ffe:501:410:ffff:200:86ff:fe05:80fa mekmitasdigoat
3ffe:501:410:ffff:210:4bff:fea2:8baa mekmitasdigoat
# USER_FQDN
foo@kame.net mekmitasdigoat
# FQDN
foo.kame.net hoge
94.xxx.xxx.xxx b2cef132a99e3172fffde2bee6e3d6db0f905d69a96e465231e3bb7ef186c0692210999a
собственно теперь на каждом из серверов
/etc/init.d/setkey restart
/etc/init.d/racoon restartsetkey -D на
ТОЧКЕ1No SAD entries.
setkey -DP на
ТОЧКЕ1(per-socket policy)
Policy:[Invalid direciton]
created: Oct 27 18:56:34 2012 lastused:
lifetime: 0(s) validtime: 0(s)
spid=588 seq=1 pid=20618
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Oct 27 18:56:34 2012 lastused:
lifetime: 0(s) validtime: 0(s)
spid=579 seq=2 pid=20618
refcnt=1
192.168.1.0/24[any] 192.168.4.0/24[any] any
fwd prio def ipsec
esp/tunnel/88.yyy.yyy.yyy-94.xxx.xxx.xxx/require
created: Oct 27 18:56:29 2012 lastused:
lifetime: 0(s) validtime: 0(s)
spid=570 seq=3 pid=20618
refcnt=1
192.168.1.0/24[any] 192.168.4.0/24[any] any
in prio def ipsec
esp/tunnel/88.yyy.yyy.yyy-94.xxx.xxx.xxx/require
created: Oct 27 18:56:29 2012 lastused:
lifetime: 0(s) validtime: 0(s)
spid=560 seq=4 pid=20618
refcnt=1
192.168.4.0/24[any] 192.168.1.0/24[any] any
out prio def ipsec
esp/tunnel/94.xxx.xxx.xxx-88.yyy.yyy.yyy/require
created: Oct 27 18:56:29 2012 lastused:
lifetime: 0(s) validtime: 0(s)
spid=553 seq=0 pid=20618
refcnt=1
setkey -D на
ТОЧКЕ2No SAD entries.
setkey -DP на
ТОЧКЕ2192.168.4.0/24[any] 192.168.1.0/24[any] 255
fwd prio def ipsec
esp/tunnel/94.xxx.xxx.xxx-88.yyy.yyy.yyy/require
created: Oct 27 20:02:21 2012 lastused:
lifetime: 0(s) validtime: 0(s)
spid=1530 seq=1 pid=23263
refcnt=1
192.168.4.0/24[any] 192.168.1.0/24[any] 255
in prio def ipsec
esp/tunnel/94.xxx.xxx.xxx-88.yyy.yyy.yyy/require
created: Oct 27 20:02:21 2012 lastused:
lifetime: 0(s) validtime: 0(s)
spid=1520 seq=2 pid=23263
refcnt=1
192.168.1.0/24[any] 192.168.4.0/24[any] 255
out prio def ipsec
esp/tunnel/88.yyy.yyy.yyy-94.xxx.xxx.xxx/require
created: Oct 27 20:02:21 2012 lastused:
lifetime: 0(s) validtime: 0(s)
spid=1513 seq=3 pid=23263
refcnt=1
(per-socket policy)
out(socket) none
created: Oct 26 19:16:13 2012 lastused: Oct 27 18:31:24 2012
lifetime: 0(s) validtime: 0(s)
spid=1476 seq=4 pid=23263
refcnt=1
(per-socket policy)
in(socket) none
created: Oct 26 19:16:13 2012 lastused: Oct 27 18:30:04 2012
lifetime: 0(s) validtime: 0(s)
spid=1467 seq=0 pid=23263
refcnt=1
логи на предмет ошибок чисты.
пинги с серверов на эти подсети не ходят, даже при явно указанном интерфейсе.
также при добавлении роутинга
route add -net 192.168.4.0 gw 88.yyy.yyy.yyy dev eth1пинги не идут
подскажите, куда еще капнуть?
Тема: racoon (Прочитано 2217 раз)
