ipsec freeswan vs. cisco

[AB]

Problem je IMHO obecne v tom, ze linuxova strana nema jak zjistit, ze cisco
bylo restartovane, takze nema duvod znovu vyjednat SA. Dozvi se o tom az ve
chvili, kdy prijde nejaky traffic z cisca (resp. isakmp pro navazani novych
SA).
Jinak dve cisco zarizeni mezi sebou pouzivaji keepalives (ktere jsou myslim
proprietarni pro cisco a nejsou standardni).

Preji prijemny den :-)
--
AB


"Petr Sretr" <sretr na datis.cdrail.cz> wrote in message
news:3CECA3A0.8235DAD3 na datis.cdrail.cz...
> Dobry den,
>
> mam maly problem s chovanim implementace ipsec na linuxu ( freeswan )
> vuci ciscu ( konfigurace viz. nize ) . Vse se mi podarilo zprovoznit
> podle navodu
> a po startu systemu se vytvori  tunel a vse funguje tak jak ma. Problem,
>
> ale nastane kdyz restartuji cisco router, linux si stale mysli, ze je
> tunel vytvoren a nesnazi se o znovu navazani relace. Na cisco routeru se
> pak objevuji hlasky typu 'IPSEC packet has invalid spi'. Nesetkal jste
> se nekdo s podobnym chovanim ? Neni nejaka moznost jak linux donutit,
> aby se po restartu cisca snazil tunel znovu vytvorit ?
>
> Diky,
>         Petr
>
> Konfigurace site
>
> host 10.28.12.141
>  |
> -------------------------- 10.28.12.0
>                 |
>          linux router - 10.28.12.1, 10.28.13.1
>                 |
>                 |      10.28.13.0
>                 |
>           cisco router - 10.28.17.1, 10.28.13.2
>                 |
> -------------------------- 10.28.17.0
>   |
> host 10.28.17.128
>
> Konfigurace freeswan ( verze 1.97, jadro 2.4.18-3, redhat 7.3 )
>
> /etc/ipsec.conf
>
> config setup
>         interfaces="ipsec0=eth0"
>         klipsdebug=none
>         plutodebug=none
>         plutoload=%search
>         plutostart=%search
>         uniqueids=yes
>
> conn %default
>         keyingtries=0
>
> conn cisco1
>         left=10.28.13.1
>         leftsubnet=10.28.12.0/24
>         right=10.28.13.2
>         rightsubnet=10.28.17.0/24
>         auto=start
>         lifetime=8h
>         pfs=no
>
> /etc/ipsec.secrets
>
> 10.28.13.1 10.28.13.2 10.28.12.1 10.28.17.1: PSK "pokus"
>
>
> Konfigurace cisco routeru ( 1720, IOS 12.0(3) T )
>
> crypto isakmp policy 30
>  encr 3des
>  hash md5
>  authentication pre-share
>  group 2
>  lifetime 28880
> crypto isakmp key pokus address 10.28.13.1
> !
> !
> crypto ipsec transform-set 3des-md5 esp-3des esp-md5-hmac
> !
> crypto map vpn local-address FastEthernet0
> crypto map vpn 30 ipsec-isakmp
>  set peer 10.28.13.1
>  set transform-set 3des-md5
>  match address 130
> !
> interface FastEthernet0
>  ip address 10.28.17.1 255.255.255.0 secondary
>  ip address 10.28.13.2 255.255.255.0
>  speed auto
>  no cdp enable
>  crypto map vpn
> !
> access-list 130 permit ip 10.28.17.0 0.0.0.255 10.28.12.0 0.0.0.255
>