Subject: [Ipsec] Can racoon initiate IKE negotiation only for one IP

From: Vaibhav agarwal <[email-masked]>
Date: Wed, 17 Oct 2007 05:12:49 -0700 (PDT)

Hi,

 I have one network interface with two IP, the first
    one is 10.118.213.113(eth0) and the other is 10.118.213.104 (eth1)
    At the moment, I want to setup one IPSec tunnels with
    the remote machine:10.118.213.69(eth0). 

    But when I use local machine to trigger the IKE negotiation,
    racoon uses 10.118.213.113 and 10.118.213.104 both as the source IP such
that
    tunnel is establish b/w both the IP 10.118.213.113 & 10.118.213.69 and
10.118.213.104 & 10.118.213.69.

But I want a tunnel  only b/w one IP 10.118.213.113 & 10.118.213.69. and I
want 10.118.213.104 IP ping from any machine (I want no tunnel created with
the 10.118.213.104 IP). 

My setkey.conf file:-
# Flush the SAD and SPD
flush;
spdflush;

# Create policies for racoon
spdadd 10.118.213.69/24 10.118.213.113/24 any -P in ipsec
           esp/tunnel/10.118.213.69-10.118.213.113/require;

spdadd 10.118.213.113/24 10.118.213.69/24 any -P out ipsec
           esp/tunnel/10.118.213.113-10.118.213.69/require;

My racoon.conf file :-

path include "/etc/racoon";
#path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";

remote 10.118.213.69
{
        exchange_mode main;
        lifetime time 24hour;
        certificate_type x509 "rncpet113_cert.pem" "rncpet113_key.pem";
        verify_cert off;
        my_identifier asn1dn;
        peers_identifier asn1dn;
         proposal  {
                encryption_algorithm 3des;
                hash_algorithm md5;
                authentication_method rsasig;
                dh_group 2;
        }
}

sainfo address 10.118.213.113/24 any address 10.118.213.69/24 any {
        pfs_group 2;
 lifetime time 24 hour ;
        encryption_algorithm 3des ;
        authentication_algorithm hmac_md5 ;
        compression_algorithm deflate ;
}

    Can anyone help me ?

Vaibhav
-- 
View this message in context: http://www.nabble.com/Can-racoon-initiate-IKE-negotiation-only-for-one-IP-tf4639459.html#a13250809
Sent from the IETF - Ipsec mailing list archive at Nabble.com.

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Vikrant Mittal <[email-masked]>
Date: Thu, 18 Oct 2007 00:07:13 +0530

Hi,

Tunnels depends on the way you are triggring the IKE negotiation. If you use any broadcast machanism like ping this scenarion will be there.

You can use, say tcp server configured on particular IP to trigger IKE neotiation.

Other option is to update your conf file.

Cheers
Vikrant Mittal
Tata Consultancy Services
Mailto: [email-masked]
Website: http://www.tcs.com
____________________________________________
Experience certainty. IT Services
Business Solutions
Outsourcing
____________________________________________

Vaibhav agarwal <[email-masked]>

10/17/2007 03:34 MST

To

[email-masked]

cc

bcc

Subject

[Ipsec] Can racoon initiate IKE negotiation only for one IP

Hi,

My setkey.conf file:-
# Flush the SAD and SPD
flush;
spdflush;

My racoon.conf file :-

remote 10.118.213.69
{

exchange_mode main;
lifetime time 24hour;

}
}

Can anyone help me ?

Vaibhav

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec
ForwardSourceID:NT0002C05A
=====-----=====-----=====
Notice: The information contained in this e-mail
message and/or attachments to it may contain
confidential or privileged information. If you are
not the intended recipient, any dissemination, use,
review, distribution, printing or copying of the
information contained in this e-mail message
and/or attachments to it are strictly prohibited. If
you have received this communication in error,
please notify us by reply e-mail or telephone and
immediately and permanently delete the message
and any attachments. Thank you