I am having a lot of difficulty on setting up IPsec tunnels
I have 3 monowall routers. two of the are V1.22 and the third one is
1.3b2
I have setup a firewall rule that allows all traffic to the wan
interface on each of the routers, from the other routers.
Each network is a different local lan Subnet.
here is the racoon config for 1 set of my tunnel
--- OFFICE (v1.22) ---
remote HOME {
exchange_mode aggressive;
my_identifier address "OFFICE";
peers_identifier address 76.167.242.113;
initial_contact on;
support_proxy on;
proposal_check obey;
proposal {
encryption_algorithm blowfish;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2;
lifetime time 86400 secs;
}
lifetime time 86400 secs;
}
sainfo address 192.168.65.0/24 any address 192.168.67.0/25 any {
encryption_algorithm blowfish;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
pfs_group 2;
lifetime time 86400 secs;
}
--- HOME (v1.3B2) ---
remote OFFICE {
exchange_mode aggressive;
my_identifier address "HOME";
peers_identifier address OFFICE;
initial_contact on;
support_proxy on;
proposal_check obey;
proposal {
encryption_algorithm blowfish;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2;
lifetime time 86400 secs;
}
lifetime time 86400 secs;
}
sainfo address 192.168.67.0/25 any address 192.168.65.0/24 any {
encryption_algorithm blowfish;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
pfs_group 2;
lifetime time 86400 secs;
---here is a copy from the log file from the office ---
Feb 4 12:34:00 m0n0wall racoon: DEBUG: compression algorithm can not
be checked because sadb message doesn't support it.
Feb 4 12:34:00 m0n0wall racoon: DEBUG: hmac(modp1024)
Feb 4 12:34:00 m0n0wall racoon: DEBUG: compression algorithm can not
be checked because sadb message doesn't support it.
Feb 4 12:34:00 m0n0wall racoon: DEBUG: my interface: 192.168.65.1 (vr0)
Feb 4 12:34:00 m0n0wall racoon: DEBUG: my interface: Office (vr1)
Feb 4 12:34:00 m0n0wall racoon: DEBUG: my interface: 127.0.0.1 (lo0)
Feb 4 12:34:00 m0n0wall racoon: DEBUG: configuring default isakmp port.
Feb 4 12:34:00 m0n0wall racoon: DEBUG: 3 addrs are configured
successfully
Feb 4 12:34:00 m0n0wall racoon: INFO: 127.0.0.1[500] used as isakmp
port (fd=6)
Feb 4 12:34:00 m0n0wall racoon: INFO: 71.103.254.30[500] used as
isakmp port (fd=7)
Feb 4 12:34:00 m0n0wall racoon: INFO: 192.168.65.1[500] used as
isakmp port (fd=8)
Feb 4 12:34:00 m0n0wall racoon: DEBUG: racoon: ERROR: such policy
already exists. anyway replace it: l message
Feb 4 12:34:01 m0n0wall racoon: DEBUG: msg 1 not interesting
Feb 4 12:34:01 m0n0wall racoon: DEBUG: get pfkey X_SPDDUMP message
Feb 4 12:34:01 m0n0wall racoon: DEBUG: sub:0xbfbff704:
192.168.61.0/24[0] 192.168.65.0/24[0] proto=any dir=in
Feb 4 12:34:01 m0n0wall racoon: DEBUG: db :0x80a5a08: 192.168.65.0/24
[0] 192.168.65.1/32[0] proto=any dir=in
..........
Feb 4 12:34:01 m0n0wall racoon: DEBUG: get pfkey X_SPDDUMP message
Feb 4 12:34:01 m0n0wall racoon: DEBUG: sub:0xbfbff704:
192.168.65.0/24[0] 192.168.67.0/25[0] proto=any dir=out
Feb 4 12:34:01 m0n0wall racoon: DEBUG: db :0x80a5a08: 192.168.65.0/24
[0] 192.168.65.1/32[0] proto=any dir=in
Feb 4 12:34:01 m0n0wall racoon: DEBUG: sub:0xbfbff704:
192.168.65.0/24[0] 192.168.67.0/25[0] proto=any dir=out
Feb 4 12:34:01 m0n0wall racoon: DEBUG: db :0x80a5c08: 192.168.61.0/24
[0] 192.168.65.0/24[0] proto=any dir=in
Feb 4 12:34:01 m0n0wall racoon: DEBUG: sub:0xbfbff704:
192.168.65.0/24[0] 192.168.67.0/25[0] proto=any dir=out
Feb 4 12:34:01 m0n0wall racoon: DEBUG: db :0x80ad008: 192.168.67.0/25
[0] 192.168.65.0/24[0] proto=any dir=in
Feb 4 12:34:01 m0n0wall racoon: DEBUG: sub:0xbfbff704:
192.168.65.0/24[0] 192.168.67.0/25[0] proto=any dir=out
Feb 4 12:34:01 m0n0wall racoon: DEBUG: db :0x80ad408: 192.168.65.1/32
[0] 192.168.65.0/24[0] proto=any dir=out
Feb 4 12:34:01 m0n0wall racoon: DEBUG: sub:0xbfbff704:
192.168.65.0/24[0] 192.168.67.0/25[0] proto=any dir=out
Feb 4 12:34:01 m0n0wall racoon: DEBUG: db :0x80ad608: 192.168.65.0/24
[0] 192.168.61.0/24[0] proto=any dir=out
Feb 4 12:34:01 m0n0wall racoon: DEBUG: msg 1 not interesting
Feb 4 12:34:04 m0n0wall last message repeated 2 times
---here is a copy from the log file from the HOME ---
Feb 4 12:34:12 m0n0wall racoon: INFO: @(#)ipsec-tools 0.6.6 (http://
ipsec-tools.sourceforge.net)
Feb 4 12:34:12 m0n0wall racoon: INFO: @(#)This product linked
OpenSSL 0.9.7e-p1 25 Oct 2004 (http://www.openssl.org/)
Feb 4 12:34:12 m0n0wall racoon: INFO: 127.0.0.1[500] used as isakmp
port (fd=8)
Feb 4 12:34:12 m0n0wall racoon: INFO: 127.0.0.1[500] used for NAT-T
Feb 4 12:34:12 m0n0wall racoon: INFO: HOME [500] used as isakmp port
(fd=9)
Feb 4 12:34:12 m0n0wall racoon: INFO: HOME [500] used for NAT-T
Feb 4 12:34:12 m0n0wall racoon: INFO: 192.168.67.1[500] used as
isakmp port (fd=10)
Feb 4 12:34:12 m0n0wall racoon: INFO: 192.168.67.1[500] used for NAT-T
} | 