openswan - pix HITNO!!!!

[ mrleus @ 11.10.2006. 20:29 ] @

Treba da povezem linux sa pix-om... tj trba da ostvarim vpn sa jednom firmom...
e sad u chemu je caka :P ne mogu da utichem na pix...ali sam dobio parametre koje glase..

phase1
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400

phase2
transform-set: esp-3des esp-md5-hmac
lifetime 8,800 sec / 4608000 KB )

znachi to mi je uslov s tim shto ne mogu da utichem na te parametre, ponavljam

to izgleda ovako

10.10.10.0/24-------pix(a.b.c.d)------INERNET--------Linux(e.f.g.h)-------10.0.0.0/24
s tim shto su a.b.c.d i e.f.g.h javne adrese...

ubi se trazeci po netu... al nikako da provalim..

ovako mi izgleda ipsec.conf

Code:

version 2.0
config setup
        interfaces=%defaultroute
        klipsdebug=none
        plutodebug=none

conn pix
        type            = tunnel
        left            = a.b.c.d
        leftsubnet      = 10.10.10.0/24
        right           = e.f.g.h
        rightsubnet     = 10.0.0.0/24
        esp             = 3des-md5-96
        authby          = secret
        keyexchange     = ike
        pfs             = no
        auto            = add

u ipsec.secrets je PSK

gde greshim ......... verovatno ima josh toga shto nisam ubacio ..... al ne znam gde i kako
ljudi bash mi je frka..

[ Jbyn4e @ 12.10.2006. 09:35 ] @

Pa sta ti kaze kad startujes ipsec? Jesi pogledao logove? Koja je verzija openswan-a?

Sta si se stis'o, daj vise podataka :)

P.S. Konfiguracija koja je meni radila da se poveze, ali nije hteo posle da uspostavi vezu (nije bitno zasto, znaci posle uspostavljanja vpn tunela, nije radio kako treba...)

Code:

conn pix
        type=tunnel
        left=xxx.xxx.xxx..xxx (cenzurisano)
        leftnexthop=%defaultroute
        leftsubnet=xx.xx.xx.xx/24 (cenzurisano)
        right=yy.yy.yy.yy (cenzurisano)
        rightsubnet=yyy.yyy.yyy/24 (cenzurisano)
        rightnexthop=%defaultroute
        authby=secret
        esp=3des-md5-96
        keyexchange=ike
        auth=esp

Nakon toga - /etc/init.d/ipsec start
i
ipsec auto --up pix
ili ako hoces vise podataka:
ipsec auto --verbose --up pix
Ako hoces da proveris idu li i vracaju li se ESP paketi:
tcpdump -i eth1 -vv |grep ESP
(eth1 je mrezni uredjaj)...

P.S. ipsec.secrets je oblika:

Citat:

xxx.xxx.xxx.xxx yyy.yyy.yyy.yyy : PSK "psk koji si dobio od njih"

P.P.S. Ako si iza NAT-a, moraces da uradis u delu setup jos i:

Code:

nat_traversal=yes

[ mrleus @ 12.10.2006. 10:37 ] @

kaze sledece

Code:

108 "pix" #4: STATE_MAIN_I3: sent MI3, expecting MR3
010 "pix" #4: STATE_MAIN_I3: retransmission; will wait 20s for response
010 "pix" #4: STATE_MAIN_I3: retransmission; will wait 40s for response
031 "pix" #4: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message
000 "pix" #4: starting keying attempt 2 of an unlimited number, but releasing whack

mashina nije u NAT-u

openswan je 2.4.4

[ Jbyn4e @ 12.10.2006. 11:23 ] @

Sa
http://wiki.openswan.org/index.php/Openswan/CiscoPIX

Citat:

I don't get to STATE_MAIN_I4 :

* Make sure you have opened port 500 UDP and protcol 50/51.

I don't get to STATE_QUICK_I2 - Two likely possibilities:

* You have set 3DES/MD5 at one end and 3DES/SHA1 at the other, or some similar misconfiguration.
* Your access lists are set up wrong on the PIX. For example, =access-list FREESWAN-VPN permit ip 10.7.3.0 255.255.255.0 10.69.1.0 255.255.255.0= will work, where =access-list FREESWAN-VPN permit ip 10.7.3.0 255.255.255.0 host 202.0.45.170= while it appears to do to the same thing, will cause problems at this point when the ISAKMP? phase has finished, and the actual establishing of the tunnel begins.

Dakle, nesto ti nije omoguceno (udp port 500, protokol 50/51). Proveri firewall ako ga koristis... ili ga iskljuci privremeno testa radi.

[ mrleus @ 12.10.2006. 11:28 ] @

firewall je iskljuchen.. nikad nije ni bio startovan. A za ovaj link znam po njemu sam i konfigurisao ipsec

probacu dalje da chachkam ...