Subject: [Ipsec] Racoon does not start negotation in transport mode

From: Vaibhav agarwal <[email-masked]>
Date: Thu, 25 Oct 2007 23:34:29 -0700 (PDT)

Hi,

I tried IP sec in transport mode with racoon but racoon does not start
negotation.

setkey.conf:-
# Flush the SAD and SPD
flush;
spdflush;

# Create policies for racoon
spdadd 10.118.213.69 10.118.213.113 any -P in ipsec
           esp/transport//require;

spdadd 10.118.213.113 10.118.213.69 any -P out ipsec
           esp/transport//require;

racoon.conf:-
# Racoon IKE daemon configuration file.
# See 'man racoon.conf' for a description of the format and entries.

path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
#path certificate "/etc/racoon/certs";

remote 10.118.213.69
{
        exchange_mode main;
        lifetime time 24hour;
         proposal  {
                encryption_algorithm 3des;
                hash_algorithm md5;
                authentication_method pre_shared_key;
                dh_group 2;
        }
}

sainfo anonymous {
        pfs_group 2;
        lifetime time 24 hour ;
        encryption_algorithm 3des ;
        authentication_algorithm hmac_md5 ;
        compression_algorithm deflate ;
}

racoon logs:- 

2007-10-26 11:11:54: INFO: @(#)ipsec-tools 0.3.3
(http://ipsec-tools.sourceforge.net)
2007-10-26 11:11:54: INFO: @(#)This product linked OpenSSL 0.9.7a Feb 19
2003
(http://www.openssl.org/)
2007-10-26 11:11:54: DEBUG: call pfkey_send_register for AH
2007-10-26 11:11:54: DEBUG: call pfkey_send_register for ESP
2007-10-26 11:11:54: DEBUG: call pfkey_send_register for IPCOMP
2007-10-26 11:11:54: DEBUG: reading config file racoon/racoon_cert.conf
2007-10-26 11:11:54: DEBUG: compression algorithm can not be checked because
sadb message doesn't support it.
2007-10-26 11:11:54: DEBUG: open /tmp/.racoon as racoon management.
2007-10-26 11:11:54: DEBUG: my interface: 127.0.0.1 (lo)
2007-10-26 11:11:54: DEBUG: my interface: 10.118.213.113 (eth0)
2007-10-26 11:11:54: DEBUG: my interface: 10.118.213.104 (eth1)
2007-10-26 11:11:54: DEBUG: my interface: ::1 (lo)
2007-10-26 11:11:54: DEBUG: my interface: fe80::211:25ff:fe3f:876f%eth1
(eth1)
2007-10-26 11:11:54: DEBUG: configuring default isakmp port.
2007-10-26 11:11:54: DEBUG: 5 addrs are configured successfully
2007-10-26 11:11:54: INFO: fe80::211:25ff:fe3f:876f%eth1[500] used as isakmp
port (fd=7)
2007-10-26 11:11:54: INFO: ::1[500] used as isakmp port (fd=8)
2007-10-26 11:11:54: INFO: 10.118.213.104[500] used as isakmp port (fd=9)
2007-10-26 11:11:54: INFO: 10.118.213.113[500] used as isakmp port (fd=10)
2007-10-26 11:11:54: INFO: 127.0.0.1[500] used as isakmp port (fd=11)
2007-10-26 11:11:54: DEBUG: get pfkey X_SPDDUMP message
2007-10-26 11:11:54: DEBUG: get pfkey X_SPDDUMP message
2007-10-26 11:11:54: DEBUG: sub:0xbfeb3260: 10.118.213.113/32[0]
10.118.213.69/32[0] proto=any dir=out
2007-10-26 11:11:54: DEBUG: db :0x9a60ba0: 10.118.213.69/32[0]
10.118.213.113/32[0] proto=any dir=in

please any one help me.
vaibhav
-- 
View this message in context: http://www.nabble.com/Racoon-does-not-start-negotation-in-transport-mode-tf4695442.html#a13421598
Sent from the IETF - Ipsec mailing list archive at Nabble.com.

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec