Subject: IPsec and racoon in tunnel-mode

From: "Frank Herchet (mailings)" <[email-masked]>
Date: Fri, 12 Mar 2004 22:57:15 +0100

Hello,

possibly somone can help me. i'm trying to secure a connection between two 
hosts. i'v configured setkey:

- -----------------------------------------------------------------------
# /usr/sbin/setkey -f

# Flush the SAD and SPD
flush;
spdflsuh;

spdadd 192.168.1.10[any] 192.168.1.12[any] any -P out ipsec
        esp/transport/192.168.1.10-192.168.1.12/require
        ah/transport/192.168.1.10-192.168.1.12/require;

spdadd 192.168.1.12[any] 192.168.1.10[any] any -P in ipsec
        esp/transport/192.168.1.12-192.168.1.10/require
        ah/transport/192.168.1.12-192.168.1.10/require;
- -----------------------------------------------------------------------
and racoon.conf
- -----------------------------------------------------------------------
   remote 192.168.1.12
   {
   exchange_mode main;
   proposal {
            encryption_algorithm 3des;
            hash_algorithm md5;
            authentication_method pre_shared_key;
            dh_group modp1024;
            }
   }
   sainfo address 192.168.1.0/24 any address 192.168.1.0/24 any {
            pfs_group modp768;
            encryption_algorithm 3des;
            authentication_algorithm hmac_md5;
            compression_algorithm deflate;
   }
- -----------------------------------------------------------------------

after starting racoon and trying to ping the other host, i get these messages 
and no connection:
2004-03-12 22:58:19: DEBUG: pfkey.c:195:pfkey_handler(): get pfkey ACQUIRE
message
2004-03-12 22:58:19: DEBUG: pfkey.c:1548:pk_recvacquire(): suitable outbound
SP found: 192.168.1.12/32[0] 192.168.1.10/32[0] proto=any dir=out.
2004-03-12 22:58:19: DEBUG: policy.c:183:cmpspidxstrict(): sub:0xbffff480:
192.168.1.10/32[0] 192.168.1.12/32[0] proto=any dir=in
2004-03-12 22:58:19: DEBUG: policy.c:184:cmpspidxstrict(): db :0x809f490:
192.168.1.10/32[0] 192.168.1.12/32[0] proto=any dir=in
2004-03-12 22:58:19: DEBUG: pfkey.c:1564:pk_recvacquire(): suitable inbound SP
found: 192.168.1.10/32[0] 192.168.1.12/32[0] proto=any dir=in.
2004-03-12 22:58:19: DEBUG: pfkey.c:1603:pk_recvacquire(): new acquire
192.168.1.12/32[0] 192.168.1.10/32[0] proto=any dir=out
2004-03-12 22:58:19: ERROR: pfkey.c:1633:pk_recvacquire(): failed to get
sainfo.

can smeone help me please ?
what i've done wrong ?

thx
Frank

---

From: Francis Dupont <[email-masked]>
Date: Sun, 14 Mar 2004 18:18:16 +0100

In your previous mail you wrote:

=> the sainfo should be equal to the negociated phase 2 ID payloads,
i.e., in transport mode /32 (or /128) is required.

Regards

[email-masked]