Freeswan IPSEC 1.94++ & auth=rsasig ??

[Zdenek Pizl]

Dne čt 7. únor 2002 17:19 Michal Ludvig napsal(a):
> Zdenek Pizl wrote:
> > Problem: ani si na sebe nepingnou. Predesilam, ze s
> > shared-secret-key to funguje, lec neni to zpusob, ktery
> > bych preferoval. Proste tam chci RSA klic ...
>
> Prvni nastrel - ty klice jsou spravne na spravnych
> strojich (= nemate je prohozene)?

Po kontrole a znovuvlozeni vystupu ipsec showhostkey --left / --right
( left provedeno na jednom stroji a right na druhem) si myslim, ze 
oba tyto problemy se me netykaji

!!!
BTW - na leve strane je 1.94++ ale na prave strane je 1.91 :( 
Jestli  i tohle nebude mit vliv
!!!

> Druhy nastrel (moje oblibena chyba): pri cut'n'paste z
> /etc/ipsec.secrets do /etc/ipsec.conf se klic prenese
> jako 3 oddelene stringy (jelikoz se nevejde na obrazovku)
> a tim padem to pak nechodi. Urcite je mate spravne dlouhe
> a spojene?

jak dlouhe maji byt 2048 bitu v podobe s prefixem 0s ?

> A zatreti - dejte tam jen auto=add (misto auto=route) a
> poslete nam vypis 'ipsec auto --status' a 'ipsec look'
> ... treba z toho neco vykoumame :-)

obavam se, ze tady nemohu slevit. Protoze ty masinky pak 
nenastavi spravne routing. A nebo nevim jak je k tomu prinutit.

Po zmene na auto=add mi totiz nenastavi routu host-to-host
 a dopadne to takhle :
10.0.0.0        *               255.255.255.0   U     0      0        0 eth0
10.0.0.0        *               255.255.255.0   U     0      0        0 ipsec0
127.0.0.0       *              255.0.0.0       U     0      0        0 lo
default         10.0.0.1   0.0.0.0         UG    0      0        0 eth0

Coz znamena , ze komunikace se deje pres nekodovanou eth0...

Vypis LEFT ( ipsec auto --status)
[root na srv1 etc]#  ipsec auto --status
000 interface ipsec0/eth0 10.0.0.130
000
000 "secure0": 10.0.0.130...10.0.0.1
000 "secure0":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "secure0":   policy: RSASIG+ENCRYPT+TUNNEL+PFS; interface: eth0; routed HOLD
000 "secure0":   newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0
000
000 #1: "secure0" STATE_MAIN_I1 (sent MI1, expecting MR1); EVENT_RETRANSMIT in 8s

Vypis LEFT (ipsec look)
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.0.0.1        0.0.0.0         UG       40 0          0 eth0
10.0.0.0        0.0.0.0         255.255.255.0   U        40 0          0 eth0
10.0.0.0        0.0.0.0         255.255.255.0   U        40 0          0 ipsec0
10.0.0.1        10.0.0.1        255.255.255.255 UGH      40 0          0 ipsec0

Vypis RIGHT (ipsec auto --status)
000 "secure0": 10.0.0.130...10.0.0.1
000 "secure0":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3
000 "secure0":   policy: RSASIG+ENCRYPT+TUNNEL+PFS; interface: ; unrouted
000 "secure0":   newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0

Vypis RIGHT (ipsec look)
ipsec1->eth1 mtu=16260(1500)->1500
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         194.213.203.153 0.0.0.0         UG        0 0          0 eth0
10.0.0.0        0.0.0.0         255.255.255.0   U         0 0          0 eth1
10.0.0.0        0.0.0.0         255.255.255.0   U         0 0          0 ipsec1
10.0.0.130      10.0.0.130      255.255.255.255 UGH       0 0          0 ipsec1
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth1
w.x.y.z	 0.0.0.0         255.255.255.252 U         0 0          0 eth0
w.x.y.z	 0.0.0.0         255.255.255.252 U         0 0          0 ipsec0