Subject: [Ipsec] Can racoon initiate IKE negotiation only for one IP

From: Vaibhav agarwal <[email-masked]>
Date: Wed, 17 Oct 2007 03:34:33 -0700 (PDT)

Hi,

 I have one network interface with two IP, the first
    one is 10.118.213.113(eth0) and the other is 10.118.213.104 (eth1)
    At the moment, I want to setup one IPSec tunnels with
    the remote machine:10.118.213.69(eth0). 

    But when I use local machine to trigger the IKE negotiation,
    racoon uses 10.118.213.113 and 10.118.213.104 both as the source IP such
that
    tunnel is establish b/w both the IP 10.118.213.113 & 10.118.213.69 and
10.118.213.104 & 10.118.213.69.

But I want a tunnel  only b/w one IP 10.118.213.113 & 10.118.213.69. and I
want 10.118.213.104 IP ping from any machine (I want no tunnel created with
the 10.118.213.104 IP). 

My setkey.conf file:-
# Flush the SAD and SPD
flush;
spdflush;

# Create policies for racoon
spdadd 10.118.213.69/24 10.118.213.113/24 any -P in ipsec
           esp/tunnel/10.118.213.69-10.118.213.113/require;

spdadd 10.118.213.113/24 10.118.213.69/24 any -P out ipsec
           esp/tunnel/10.118.213.113-10.118.213.69/require;

My racoon.conf file :-

path include "/etc/racoon";
#path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";

remote 10.118.213.69
{
        exchange_mode main;
        lifetime time 24hour;
        certificate_type x509 "rncpet113_cert.pem" "rncpet113_key.pem";
        verify_cert off;
        my_identifier asn1dn;
        peers_identifier asn1dn;
         proposal  {
                encryption_algorithm 3des;
                hash_algorithm md5;
                authentication_method rsasig;
                dh_group 2;
        }
}

sainfo address 10.118.213.113/24 any address 10.118.213.69/24 any {
        pfs_group 2;
 lifetime time 24 hour ;
        encryption_algorithm 3des ;
        authentication_algorithm hmac_md5 ;
        compression_algorithm deflate ;
}

    Can anyone help me ?

Vaibhav
-- 
View this message in context: http://www.nabble.com/Can-racoon-initiate-IKE-negotiation-only-for-one-IP-tf4639459.html#a13250809
Sent from the IETF - Ipsec mailing list archive at Nabble.com.

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: VANHULLEBUS Yvan <[email-masked]>
Date: Wed, 17 Oct 2007 16:42:49 +0200

> Hi,

Hi.

>     tunnel is establish b/w both the IP 10.118.213.113 & 10.118.213.69 and

Strange...

[...]
>     Can anyone help me ?

Have a look at racoon.conf's man page, and add a 'listen' section to
your racoon.conf, when you'll only specify the local IP address you
want to use.

Yvan.

-- 
NETASQ
http://www.netasq.com

---

From: Vaibhav agarwal <[email-masked]>
Date: Thu, 18 Oct 2007 00:17:35 -0700 (PDT)

Hi,

I have added listen section in racoon.conf file but now local machine to
trigger the IKE negotiation      racoon uses only for 10.118.213.113 IP. but
10.118.213.104 IP only ping from 10.118.213.69 machine not any other machine
please tell the reason. raccon log of 10.118.213.69 machine gives some
warrning , I am sending the racoon log :-
Racoon log of 10.118.213.69 machine:-
Foreground mode.
2007-10-18 12:50:54: INFO: @(#)ipsec-tools 0.3.3
(http://ipsec-tools.sourceforge.net)
2007-10-18 12:50:54: INFO: @(#)This product linked OpenSSL 0.9.7a Feb 19
2003 (http://www.openssl.org/)
2007-10-18 12:50:54: INFO: 10.118.213.69[500] used as isakmp port (fd=7)
2007-10-18 12:50:58: INFO: IPsec-SA request for 10.118.213.113 queued due to
no phase1 found.
2007-10-18 12:50:58: INFO: initiate new phase 1 negotiation:
10.118.213.69[500]<=>10.118.213.113[500]
2007-10-18 12:50:58: INFO: begin Identity Protection mode.
2007-10-18 12:50:58: WARNING: remote address mismatched.
db=10.118.213.113[500], act=10.118.213.104[500]
2007-10-18 12:50:58: WARNING: remote address mismatched.
db=10.118.213.113[500], act=10.118.213.104[500]
2007-10-18 12:50:58: INFO: ISAKMP-SA established
10.118.213.69[500]-10.118.213.113[500] spi:95d29eae6682129f:f5d43b8286e216f5
2007-10-18 12:50:58: WARNING: remote address mismatched.
db=10.118.213.113[500], act=10.118.213.104[500]
2007-10-18 12:50:59: INFO: initiate new phase 2 negotiation:
10.118.213.69[0]<=>10.118.213.113[0]
2007-10-18 12:50:59: WARNING: remote address mismatched.
db=10.118.213.113[500], act=10.118.213.104[500]
2007-10-18 12:50:59: WARNING: remote address mismatched.
db=10.118.213.113[500], act=10.118.213.104[500]
2007-10-18 12:50:59: INFO: IPsec-SA established: ESP/Tunnel
10.118.213.113->10.118.213.69 spi=14661549(0xdfb7ad)
2007-10-18 12:50:59: INFO: IPsec-SA established: ESP/Tunnel
10.118.213.69->10.118.213.113 spi=222237002(0xd3f114a)
2007-10-18 12:50:59: INFO: IPsec-SA established: ESP/Tunnel
10.118.213.113->10.118.213.69 spi=177706358(0xa979576)
2007-10-18 12:50:59: INFO: IPsec-SA established: ESP/Tunnel
10.118.213.69->10.118.213.113 spi=64808335(0x3dce58f)

Racoon log of 10.118.213.113 machine:-
[root@ihspadev1 etc]# racoon -F -f racoon/racoon.conf
Foreground mode.
2007-10-18 10:06:22: INFO: @(#)ipsec-tools 0.3.3
(http://ipsec-tools.sourceforge.net)
2007-10-18 10:06:22: INFO: @(#)This product linked OpenSSL 0.9.7a Feb 19
2003 (http://www.openssl.org/)
2007-10-18 10:06:23: INFO: 10.118.213.113[500] used as isakmp port (fd=7)
2007-10-18 10:06:41: INFO: IPsec-SA request for 10.118.213.69 queued due to
no phase1 found.
2007-10-18 10:06:41: INFO: initiate new phase 1 negotiation:
10.118.213.113[500]<=>10.118.213.69[500]
2007-10-18 10:06:41: INFO: begin Identity Protection mode.
2007-10-18 10:07:12: ERROR: phase2 negotiation failed due to time up waiting
for phase1. ESP 10.118.213.69->10.118.213.113
2007-10-18 10:07:12: INFO: delete phase 2 handler.
2007-10-18 10:07:21: INFO: request for establishing IPsec-SA was queued due
to no phase1 found.
2007-10-18 10:07:41: ERROR: phase1 negotiation failed due to time up.
08b3397e68265732:0000000000000000
2007-10-18 10:07:49: INFO: respond new phase 1 negotiation:
10.118.213.113[500]<=>10.118.213.69[500]
2007-10-18 10:07:49: INFO: begin Identity Protection mode.
2007-10-18 10:07:50: INFO: initiate new phase 2 negotiation:
10.118.213.113[0]<=>10.118.213.69[0]
2007-10-18 10:07:50: INFO: respond new phase 2 negotiation:
10.118.213.113[0]<=>10.118.213.69[0]
2007-10-18 10:07:50: INFO: IPsec-SA established: ESP/Tunnel
10.118.213.69->10.118.213.113 spi=64808335(0x3dce58f)
2007-10-18 10:07:50: INFO: IPsec-SA established: ESP/Tunnel
10.118.213.113->10.118.213.69 spi=177706358(0xa979576)
2007-10-18 10:07:50: INFO: IPsec-SA established: ESP/Tunnel
10.118.213.69->10.118.213.113 spi=222237002(0xd3f114a)
2007-10-18 10:07:50: INFO: IPsec-SA established: ESP/Tunnel
10.118.213.113->10.118.213.69 spi=14661549(0xdfb7ad)
2007-10-18 10:09:09: INFO: purged IPsec-SA proto_id=ESP spi=177706358.
2007-10-18 10:09:09: INFO: purged IPsec-SA proto_id=ESP spi=14661549.
2007-10-18 10:09:10: INFO: purged ISAKMP-SA proto_id=ISAKMP
spi=95d29eae6682129f:f5d43b8286e216f5.

Vaibhav                                     

-- 
View this message in context: http://www.nabble.com/Can-racoon-initiate-IKE-negotiation-only-for-one-IP-tf4639459.html#a13269259
Sent from the IETF - Ipsec mailing list archive at Nabble.com.