[lug] This is a very irritating problem

Dan Ferris dan at usrsbin.com
Tue Jan 4 21:50:13 MST 2005


Howdy,

I just got done setting up L2TP over IPSec for my wireless network. 

The box is a SuSE Linux 9.2 box with OpenSwan.  Before anyone asks, I 
picked OpenSWAN because

a)  I've used it before
b)  I found a really good l2tp/ipsec tutorial that used it.

Anyway, this is an extremely irritating problem.

Here's the ipsec status.  Notice that there is an Active SA. 

an:~ # ipsec auto --status
000 interface lo/lo ::1
000 interface lo/lo 127.0.0.1
000 interface eth0/eth0 10.10.10.1
000 interface eth1/eth1 192.168.253.2
000 %myid = (none)
000 debug none
000 
000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, 
keysizemax=64
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, 
keysizemax=192
000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, 
keysizemin=40, keysizemax=448
000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, 
keysizemax=0
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, 
keysizemax=256
000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, 
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, 
keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, 
keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, 
keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, 
keysizemin=256, keysizemax=256
000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0, keysizemax=0
000 
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, 
keydeflen=128
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, 
keydeflen=192
000 algorithm IKE hash: id=2, name=OAKLEY_SHA, hashsize=20
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000 
000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0} 
trans={0,0,0} attrs={0,0,0}
000 
000 "ipsec-l2tp": 10.10.10.1:17/1701...%any:17/%any; unrouted; eroute 
owner: #0
000 "ipsec-l2tp":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 
540s; rekey_fuzz: 100%; keyingtries: 3
000 "ipsec-l2tp":   policy: PSK+ENCRYPT+TUNNEL; prio: 32,32; interface: 
eth0;
000 "ipsec-l2tp":   newest ISAKMP SA: #0; newest IPsec SA: #0;
000 "ipsec-l2tp":   IKE algorithms wanted: 5_000-1-5, 5_000-1-2, 
5_000-2-5, 5_000-2-2, flags=-strict
000 "ipsec-l2tp":   IKE algorithms found:  5_192-1_128-5, 5_192-1_128-2, 
5_192-2_160-5, 5_192-2_160-2,
000 "ipsec-l2tp":   ESP algorithms wanted: 3_000-1, 3_000-2, flags=-strict
000 "ipsec-l2tp":   ESP algorithms loaded: 3_000-1, 3_000-2, flags=-strict
000 "ipsec-l2tp"[1]: 10.10.10.1:17/1701...10.10.10.253:17/49633; 
erouted; eroute owner: #2
000 "ipsec-l2tp"[1]:   ike_life: 3600s; ipsec_life: 28800s; 
rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3
000 "ipsec-l2tp"[1]:   policy: PSK+ENCRYPT+TUNNEL; prio: 32,32; 
interface: eth0;
000 "ipsec-l2tp"[1]:   newest ISAKMP SA: #1; newest IPsec SA: #2;
000 "ipsec-l2tp"[1]:   IKE algorithms wanted: 5_000-1-5, 5_000-1-2, 
5_000-2-5, 5_000-2-2, flags=-strict
000 "ipsec-l2tp"[1]:   IKE algorithms found:  5_192-1_128-5, 
5_192-1_128-2, 5_192-2_160-5, 5_192-2_160-2,
000 "ipsec-l2tp"[1]:   IKE algorithm newest: 3DES_CBC_192-SHA-MODP1024
000 "ipsec-l2tp"[1]:   ESP algorithms wanted: 3_000-1, 3_000-2, 
flags=-strict
000 "ipsec-l2tp"[1]:   ESP algorithms loaded: 3_000-1, 3_000-2, 
flags=-strict
000 "ipsec-l2tp"[1]:   ESP algorithm newest: AES_128-HMAC_SHA1; 
pfsgroup=<N/A>
000 
000 #2: "ipsec-l2tp"[1] 10.10.10.253 STATE_QUICK_R2 (IPsec SA 
established); EVENT_SA_REPLACE in 2941s; newest IPSEC; eroute owner
000 #2: "ipsec-l2tp"[1] 10.10.10.253 esp.af9431 at 10.10.10.253 
esp.59c8a2f at 10.10.10.1
000 #1: "ipsec-l2tp"[1] 10.10.10.253 STATE_MAIN_R3 (sent MR3, ISAKMP SA 
established); EVENT_SA_REPLACE in 2940s; newest ISAKMP
000 

Now the best part, and this is where I may be going nuts, but I must be 
missing something really stupid:
dan:~ # ifconfig
eth0      Link encap:Ethernet  HWaddr 00:01:03:67:FF:49 
          inet addr:10.10.10.1  Bcast:10.10.10.255  Mask:255.255.255.0
          inet6 addr: fe80::201:3ff:fe67:ff49/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:167398 errors:0 dropped:0 overruns:1 frame:0
          TX packets:298929 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:22551386 (21.5 Mb)  TX bytes:159344883 (151.9 Mb)
          Interrupt:9 Base address:0xec80

eth1      Link encap:Ethernet  HWaddr 00:B0:D0:7C:92:80 
          inet addr:192.168.253.2  Bcast:192.168.253.255  Mask:255.255.255.0
          inet6 addr: fe80::2b0:d0ff:fe7c:9280/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:198493 errors:0 dropped:0 overruns:0 frame:0
          TX packets:151272 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:180426138 (172.0 Mb)  TX bytes:18204111 (17.3 Mb)
          Interrupt:10 Base address:0xe880

lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1878 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1878 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:254119 (248.1 Kb)  TX bytes:254119 (248.1 Kb)

ppp0      Link encap:Point-to-Point Protocol 
          inet addr:10.10.10.4  P-t-P:10.10.10.10  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1410  Metric:1
          RX packets:558 errors:0 dropped:0 overruns:0 frame:0
          TX packets:634 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:48460 (47.3 Kb)  TX bytes:461801 (450.9 Kb)

Notice something missing?  I do.....There is NO ipsec0 interface.  WTF?  
Is this something new with OpenSWAN?  I admit I haven't used it in a few 
years.

If I do a tcpdump on eth0 I see lots of nice little ESP encrypted packets.

So, like, what am I missing here.

Here's ipsec.conf:

# basic configuration
config setup
        # Debug-logging controls:  "none" for (almost) none, "all" for lots.
        #klipsdebug=all
        #plutodebug="control parsing"
        #plutodebug=all
        # Certificate Revocation List handling
        #crlcheckinterval=600
        #strictcrlpolicy=yes
        # Change rp_filter setting, default = 0 (switch off)
        rp_filter=0
        # Switch on NAT-Traversal (if patch is installed)
        nat_traversal=no
        interfaces="ipsec0=eth0"

# default settings for connections
conn %default
        ikelifetime=20m
        keylife=1h
        rekeymargin=8m

conn ipsec-l2tp
        #
        # Use a Preshared Key. Disable Perfect Forward Secrecy.
        #
        authby=secret
        pfs=no
        #
        left=10.10.10.1
        #
        # Required for original (non-updated) Windows 2000/XP clients.
        leftprotoport=17/1701
        #
        # The remote user.
        #
        right=%any
        rightprotoport=17/%any
        #
        # Authorize this connection, and wait for connection from user.
        #
        auto=add
        keyingtries=3

Anyone know what I did wrong and how I can get my ipsec0 interface back :-)

Dan







More information about the LUG mailing list