|
||||||||
As some of you may know, I have been unable to ping or talk to any DMZ machine from inside my LAN. I have setup a static route from my LAN -> my DMZ and still nothing. I have also added a rule into the DMZ that would allow any traffic from the LAN to the DMZ. But still, no dice... My question is, do I have to have a static route back from the DMZ to the LAN? I mean, if I try to ping a machine in the DMZ, does there need to be a static route saying "DMZ -> LAN" so that the ping packet can find its way back? I have actually tried to set two static routes like described, but still didn't get it to work. But I wanted to ask to see if perhaps this is even necessary. /still trying but getting frustrated... Rodman ----- Original Message ----- From: "Chris Buechler" <cbuechler at gmail dot com> To: "John Tran" <jtran at pcwerk dot com> Cc: <m0n0wall at lists dot m0n0 dot ch> Sent: Wednesday, September 08, 2004 2:20 PM Subject: Re: [m0n0wall] interesting routing issue > On Wed, 08 Sep 2004 01:07:28 -0700, John Tran <jtran at pcwerk dot com> wrote: >> But sadly, I cannot ping 192.168.2.2 from 192.168.1.4 or vice versa. >> >> FYI, I've rebooted the two firewalls several times and triple check my >> settings against the examples, but seems to be no idea why this is not >> working. >> >> I also noticed the following message: >> >> Sep 8 00:27:07 racoon: INFO: isakmp.c:1368:isakmp_open(): >> 127.0.0.1[500] used as isakmp port (fd=6) >> Sep 8 00:27:07 racoon: INFO: isakmp.c:1368:isakmp_open(): >> 64.27.17.75[500] used as isakmp port (fd=7) >> Sep 8 00:27:07 racoon: INFO: isakmp.c:1368:isakmp_open(): >> 192.168.2.254[500] used as isakmp port (fd=8) >> Sep 8 00:30:02 racoon: INFO: isakmp.c:1694:isakmp_post_acquire(): >> IPsec-SA request for 69.39.193.19 queued due to no phase1 found. >> Sep 8 00:30:02 racoon: INFO: isakmp.c:808:isakmp_ph1begin_i(): initiate >> new phase 1 negotiation: 64.27.17.75[500]<=>69.39.193.19[500] >> Sep 8 00:30:02 racoon: INFO: isakmp.c:813:isakmp_ph1begin_i(): begin >> Aggressive mode. >> Sep 8 00:30:33 racoon: ERROR: isakmp.c:1786:isakmp_chkph1there(): >> phase2 negotiation failed due to time up waiting for phase1. ESP >> 69.39.193.19->64.27.17.75 >> Sep 8 00:30:33 racoon: INFO: isakmp.c:1791:isakmp_chkph1there(): delete >> phase 2 handler. >> Sep 8 00:31:03 racoon: ERROR: isakmp.c:1447:isakmp_ph1resend(): phase1 >> negotiation failed due to time up. 5f60cc8aa3564685:0000000000000000 >> >> and >> >> racoon: INFO: isakmp.c:1694:isakmp_post_acquire(): IPsec-SA request for >> 67.27.17.75 queued due to no phase1 found. >> Sep 8 00:25:55 racoon: INFO: isakmp.c:808:isakmp_ph1begin_i(): initiate >> new phase 1 negotiation: 69.39.193.19[500]<=>67.27.17.75[500] >> Sep 8 00:25:55 racoon: INFO: isakmp.c:813:isakmp_ph1begin_i(): begin >> Aggressive mode. >> Sep 8 00:26:26 racoon: ERROR: isakmp.c:1786:isakmp_chkph1there(): >> phase2 negotiation failed due to time up waiting for phase1. ESP >> 67.27.17.75->69.39.193.19 >> Sep 8 00:26:26 racoon: INFO: isakmp.c:1791:isakmp_chkph1there(): delete >> phase 2 handler. >> Sep 8 00:26:55 racoon: ERROR: isakmp.c:1447:isakmp_ph1resend(): phase1 >> negotiation failed due to time up. 9591d65f69fee93a:0000000000000000 >> Sep 8 00:29:14 racoon: INFO: isakmp.c:1694:isakmp_post_acquire(): >> IPsec-SA request for 67.27.17.75 queued due to no phase1 found. >> Sep 8 00:29:14 racoon: INFO: isakmp.c:808:isakmp_ph1begin_i(): initiate >> new phase 1 negotiation: 69.39.193.19[500]<=>67.27.17.75[500] >> Sep 8 00:29:14 racoon: INFO: isakmp.c:813:isakmp_ph1begin_i(): begin >> Aggressive mode. >> Sep 8 00:29:45 racoon: ERROR: isakmp.c:1786:isakmp_chkph1there(): >> phase2 negotiation failed due to time up waiting for phase1. ESP >> 67.27.17.75->69.39.193.19 >> Sep 8 00:29:45 racoon: INFO: isakmp.c:1791:isakmp_chkph1there(): delete >> phase 2 handler. >> Sep 8 00:29:47 racoon: INFO: isakmp.c:1713:isakmp_post_acquire(): >> request for establishing IPsec-SA was queued due to no phase1 found. >> Sep 8 00:30:10 racoon: ERROR: isakmp.c:861:isakmp_ph1begin_r(): >> couldn't find configuration. >> Sep 8 00:30:14 racoon: ERROR: isakmp.c:1447:isakmp_ph1resend(): phase1 >> negotiation failed due to time up. d1dee0a586c3deab:0000000000000000 >> Sep 8 00:30:18 racoon: ERROR: isakmp.c:1786:isakmp_chkph1there(): >> phase2 negotiation failed due to time up waiting for phase1. ESP >> 67.27.17.75->69.39.193.19 >> Sep 8 00:30:18 racoon: INFO: isakmp.c:1791:isakmp_chkph1there(): delete >> phase 2 handler. >> Sep 8 00:30:21 racoon: ERROR: isakmp.c:861:isakmp_ph1begin_r(): >> couldn't find configuration. >> Sep 8 00:31:00 last message repeated 4 times >> >> Any suggestions would be greatly appreciated.... >> >> > > Your routes look fine at a glance. The problem is (according to those > logs) your tunnel isn't coming up. Check your phase 1 settings, make > sure everything other than "my identifier" is identical on both. Also > make sure you've added the pre-shared keys on the appropriate tab on > both sides, using the identifier of the remote m0n0wall. There is > something wrong or missing in there somewhere. > > -Chris > > --------------------------------------------------------------------- > To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch > For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch > > |