Настраиваю тестовый канал между "офисом" и "удаленной точкой".Обе машины:
FreeBSD 8.2 + ipsec-tools из портов
options><------>IPSEC
options><------>IPSEC_NAT_T
device<><------>crypto
device<><------>enc
для упрощения firewall_type="OPEN" (все равно в локалке играюсь)
Гейт "офиса":
-------------
rc.conf
-------------
net_oif="ae0"
net_oip="172.16.100.9"
net_onet="172.16.100.0/22"
net_omask="255.255.252.0"
net_iif="re0"
net_iip="192.168.0.1"
net_inet="192.168.0.0/24"
net_imask="255.255.255.0"
gateway_enable="YES"
ifconfig_ae0="inet ${net_oip} netmask ${net_omask}"
ifconfig_re0="inet ${net_iip} netmask ${net_imask}"
firewall_enable="YES"
firewall_type="OPEN"
firewall_quiet="YES"
firewall_nat_enable="YES"
firewall_nat_interface="${net_oif}"
racoon_enable="YES"
ipsec_enable="YES"
cloned_interfaces="gif0"
ipsec_remote0_iface="gif0"
ipsec_remote0_oip="172.16.100.10"
ipsec_remote0_iip="192.16.1.1"
ipsec_remote0_imask="255.255.255.0"
ipsec_remote0_inet="192.168.1.0/24"
gifconfig_gif0="${net_oip} ${ipsec_remote0_oip}"
ifconfig_gif0="inet ${net_iip} ${ipsec_remote0_iip} netmask 255.255.255.255"
static_routes="RemoteLan0"
route_RemoteLan0="${ipsec_remote0_inet} -interface ${ipsec_remote0_iface}"
----------
ipsec.conf
----------
flush;
spdflush;
spdadd 172.16.100.9/32 172.16.100.10/32 any -P out ipsec esp/tunnel/172.16.100.9-172.16.100.10/require;
spdadd 172.16.100.10/32 172.16.100.9/32 any -P in ipsec esp/tunnel/172.16.100.10-172.16.100.9/require;
-----------
racoon.conf
-----------
path include "/usr/local/etc/racoon";
path certificate "/usr/local/etc/racoon/certs";
path pidfile "/var/run/racoon/racoon.pid";
log debug2;
padding
{
maximum_length 20;
randomize off;
strict_check off;
exclusive_tail off;
}
listen
{
isakmp 172.16.100.9 [500];
}
timer
{
counter 5;
interval 20 sec;
persend 1;
phase1 30 sec;
phase2 15 sec;
}
#Remote 01
remote 172.16.100.10
{
exchange_mode main,base;
my_identifier asn1dn;
peers_identifier asn1dn;
certificate_type x509 "office.pub" "office.priv";
peers_certfile x509 "remote01.pub";
proposal
{
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method rsasig;
dh_group 2;
}
}
#SA Remote 01
sainfo address 192.168.0.0/24 any address 192.168.1.0/24 any
{
pfs_group 2;
lifetime time 60 min;
encryption_algorithm 3des;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
}
Гейт "удаленной точки":
-----------------------
rc.conf
-------------
net_oif="fxp0"
net_oip="172.16.100.10"
net_onet="172.16.100.0/22"
net_omask="255.255.252.0"
net_iif="re0"
net_iip="192.168.1.1"
net_inet="192.168.1.0/24"
net_imask="255.255.255.0"
gateway_enable="YES"
ifconfig_fxp0="inet ${net_oip} netmask ${net_omask}"
ifconfig_re0="inet ${net_iip} netmask ${net_imask}"
firewall_enable="YES"
firewall_type="OPEN"
firewall_quiet="YES"
firewall_nat_enable="YES"
firewall_nat_interface="${net_oif}"
racoon_enable="YES"
ipsec_enable="YES"
cloned_interfaces="gif0"
ipsec_remote0_iface="gif0"
ipsec_remote0_oip="172.16.100.9"
ipsec_remote0_iip="192.16.0.1"
ipsec_remote0_imask="255.255.255.0"
ipsec_remote0_inet="192.168.0.0/24"
gifconfig_gif0="${net_oip} ${ipsec_remote0_oip}"
ifconfig_gif0="inet ${net_iip} ${ipsec_remote0_iip} netmask 255.255.255.255"
static_routes="RemoteLan0"
route_RemoteLan0="${ipsec_remote0_inet} -interface ${ipsec_remote0_iface}"
----------
ipsec.conf
----------
flush;
spdflush;
spdadd 172.16.100.10/32 172.16.100.9/32 any -P out ipsec esp/tunnel/172.16.100.10-172.16.100.9/require;
spdadd 172.16.100.9/32 172.16.100.10/32 any -P in ipsec esp/tunnel/172.16.100.9-172.16.100.10/require;
-----------
racoon.conf
-----------
path include "/usr/local/etc/racoon";
path certificate "/usr/local/etc/racoon/certs" ;
path pidfile "/var/run/racoon/racoon.pid";
log debug2;
padding
{
maximum_length 20;
randomize off;
strict_check off;
exclusive_tail off;
}
listen
{
isakmp 172.16.100.10 [500];
}
timer
{
counter 5;
interval 20 sec;
persend 1;
phase1 30 sec;
phase2 15 sec;
}
#Office
remote 172.16.100.9
{
exchange_mode main,base;
my_identifier asn1dn;
peers_identifier asn1dn;
certificate_type x509 "remote01.pub" "remote01.priv";
peers_certfile x509 "office.pub";
proposal
{
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method rsasig;
dh_group 2;
}
}
#SA Office
sainfo address 192.168.1.0/24 any address 192.168.0.0/24 any
{
pfs_group 2;
lifetime time 60 min;
encryption_algorithm 3des;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
}
--------------
Лог "офиса"
racoon: DEBUG: filename: /usr/local/etc/racoon/certs/office.pub
racoon: DEBUG: filename: /usr/local/etc/racoon/certs/remote01.pub
racoon: DEBUG2: lifetime = 28800
racoon: DEBUG2: lifebyte = 0
racoon: DEBUG2: encklen=0
racoon: DEBUG2: p:1 t:1
racoon: DEBUG2: 3DES-CBC(5)
racoon: DEBUG2: SHA(2)
racoon: DEBUG2: 1024-bit MODP group(2)
racoon: DEBUG2: RSA signatures(3)
racoon: DEBUG2:
racoon: DEBUG2: Etype mismatch: got 2, expected 4.
racoon: DEBUG2: Etype mismatch: got 1, expected 4.
racoon: DEBUG: no check of compression algorithm; not supported in sadb message.
racoon: DEBUG: getsainfo params: loc='192.168.0.0/24' rmt='192.168.1.0/24' peer='NULL' client='NULL' id=0
racoon: DEBUG2: parse successed.
racoon: DEBUG: open /var/db/racoon/racoon.sock as racoon management.
Лог "точки"
gw racoon: DEBUG: filename: /usr/local/etc/racoon/certs/remote01.pub
gw racoon: DEBUG: filename: /usr/local/etc/racoon/certs/office.pub
gw racoon: DEBUG2: lifetime = 28800
gw racoon: DEBUG2: lifebyte = 0
gw racoon: DEBUG2: encklen=0
gw racoon: DEBUG2: p:1 t:1
gw racoon: DEBUG2: 3DES-CBC(5)
gw racoon: DEBUG2: SHA(2)
gw racoon: DEBUG2: 1024-bit MODP group(2)
gw racoon: DEBUG2: RSA signatures(3)
gw racoon: DEBUG2:
gw racoon: DEBUG2: Etype mismatch: got 2, expected 4.
gw racoon: DEBUG2: Etype mismatch: got 1, expected 4.
gw racoon: DEBUG: no check of compression algorithm; not supported in sadb message.
gw racoon: DEBUG: getsainfo params: loc='192.168.1.0/24' rmt='192.168.0.0/24' peer='NULL' client='NULL' id=0
gw racoon: DEBUG2: parse successed.
--------------------------------------------------------
Ну и собственно, вопрос, с чего бы на "удаленной" машине в логах ни слова о том, что создан сокет. Не трудно заметить, что разница в логах только в последней строке, что "сокет создан"
При попытке пинга "удаленной сети" (192.168.1.1) с "офисной" машины, получаю
office# ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes
ping: sendto: Network is down
ping: sendto: Network is down
При попытке обратного пинга - тоже самое...
При попытке пинга "внешнего" интерфейса "удаленной" машины с "офисной и обратно вообще никакой реакции. Но в то же время, пинги на остальные машины сети 172.16.100.0/22 и с них на эти две идут без проблем.
В чем я не прав?
Вариант для распечатки
on 24-Окт-11, 06:53 
