IPSEC VPN racoon

[Jan Koukal - FS]

Dobry den,
Mame zakaznika, který ma podobne na Vigorech  pobocky a jako VPN koncentrator se pouziva PfSense a s DRAYTEK Vigor 2820n se to chovalo velmi podobne. Vigor se restarnul vždy po navazani VPN asi po 5-15 minutach,bez ni bezel v poho. Museli jsme ho vymenit za starsi shodou okolnosti 2700G s fw 2.7.3.3_1401302, kde to ale funguje. Bohuzel Vam nyní nemuzu poslat konfiguraci,az pristi tyden :(


Zdravi,

	Jan Koukal


P.s: Myslim,ze Draytekuv IPSec nebude z nejlepsich.....



-----Original Message-----
From: users-l-bounces at freebsd.cz [mailto:users-l-bounces at freebsd.cz] On Behalf Of Stefan Valko
Sent: Tuesday, July 01, 2008 11:17 AM
To: users-l at freebsd.cz
Subject: IPSEC VPN racoon

Zdravim riesim nasledujuci problem. Mam IPSEC VPN server (racoon) ktory spaja
22 pobociek LAN - LAN (FreeBSD - Vigor 2700) na Vigore je posledny fw 2.7.3 od T-COMu (kedze zo starsimi,robilo problem to ze po vytoceni VPNky sa resetol na tvrdo VIGOR) , problem mam ten ze niekedy padne VPNka medzi BSD a Vigorom a niektore Vigori vytocia si VPN spojenie ktore je v poriadku prechadzaju hned data a je to ok, ale niektore si vytvoria VPN spojenie ale nepretecie cez tunnel nic :( len sa tvari ze VPN je vytvorena. Potom pomoze len to ze racoon restartnem a potom sa tie VPNky ktore mali tz. neuplny tunnel pripoja uplne bez problemov !!! Neriesil niekto nieco podobne? V logoch racoonu som nic mimoriadne nevsimol a na google som nic normalne nenasiel :( Vychadza mi to na problem Vigorov ale pre istotu sa tu pytam ze ci nahodou ma niekto nevie nakopnut a nejako to doladit. Tyka sa to cca 3 - 4 Vigorov z 22. PS. Pred tym to na CISCO slo ok..... (nechcel som meni) aj zo starym firmware 

ipsec.conf

flush;
spdflush;
spdadd LAN_BSD/24 LAN_VIGOR/24 any -P out ipsec esp/tunnel/WAN_BSD-WAN_VIGOR/require;
spdadd LAN_VIGOR/24 LAN_BSD/24 any -P in ipsec esp/tunnel/WAN_VIGOR-WAN_BSD/require;

racoon.conf

remote WAN_VIGOR
{
        #exchange_mode main,aggressive,base;
        exchange_mode main;

        my_identifier address WAN_BSD;
        peers_identifier address WAN_VIGOR;
        verify_identifier on;
        nonce_size 16;
        lifetime time 86400 sec ;       # sec,min,hour
        proposal_check obey;

        # phase 1 proposal (for ISAKMP SA)
        proposal {
                encryption_algorithm 3des;
                hash_algorithm sha1;
                authentication_method pre_shared_key;
                dh_group 2;
        }
}

sainfo address LAN_BSD/24 any address LAN_VIGOR/24 any {
        pfs_group 1;
        lifetime time 86400 sec;
        encryption_algorithm 3des;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
}

                                                                                                    
Stefan Valko

 
--
FreeBSD mailing list (users-l at freebsd.cz) http://www.freebsd.cz/listserv/listinfo/users-l