Добрый день, Уважаемые!
Возникла проблема при создания туннеля IPSEC между двумя офисами в разных городах, в сети "А" в роли шлюза выступает машина с CENTOS, в сети "Б" шлюз Dlink DL804HV, коннект не устанавливается.
Как настраивал
Сеть "А"
Центось настраивал по документации http://www.centos.org/docs/5/html/5.2/Deployment_Guide/s2-ipsec-net2net-cfg.html
Создал скрипт
/etc/sysconfig/network-scripts/ifcfg-ipsec0
TYPE=IPSEC
ONBOOT=yes
IKE_METHOD=PSK
SRCGW=192.168.1.3
DSTGW=192.168.4.100
SRCNET=192.168.1.0/24
DSTNET=192.168.4.0/24
DST=Внешний_IP_Сети"В"
Создал ключ
/etc/sysconfig/network-scripts/keys-ipsec0подредактировал /etc/racoon/racoon.conf
cat /etc/racoon/racoon.conf
# Racoon IKE daemon configuration file.
# See 'man racoon.conf' for a description of the format and entries.
path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
listen
{
isakmp Внешний IP Сети "А";
}
timer
{
# These value can be changed per remote node.
counter 5; # maximum trying count to send.
interval 10 sec; # maximum interval to resend.
persend 1; # the number of packets per send.
# maximum time to wait for completing each phase.
phase1 30 sec;
phase2 15 sec;
}
sainfo anonymous
{
pfs_group 2;
lifetime time 1 hour ;
encryption_algorithm 3des ;
authentication_algorithm hmac_md5 ;
compression_algorithm deflate ;
}
в iptables добавил правила
-A INPUT -p udp --dport 500 -j ACCEPT
-A INPUT -p esp -j ACCEPT
-A INPUT -p ah -j ACCEPT
Сеть "Б"
Настройки длинка
Логи
На CenOS
Jun 11 16:14:47 gate racoon: INFO: ISAKMP-SA expired IP_Сети"А"[500]-IP_Сети"Б"[500] spi:93143411b022d098:fce3dd7d75bedb4c
Jun 11 16:14:48 gate racoon: INFO: ISAKMP-SA deleted IP_Сети"А"[500]-IP_Сети"Б"[500] spi:93143411b022d098:fce3dd7d75bedb4c
Jun 11 16:14:56 gate racoon: NOTIFY: the packet is retransmitted by IP_Сети"Б"[500].
Jun 11 16:15:16 gate racoon: NOTIFY: the packet is retransmitted by IP_Сети"Б"[500].
Jun 11 16:15:17 gate racoon: ERROR: ignore information because the message is too short
Jun 11 16:15:17 gate racoon: INFO: respond new phase 1 negotiation: IP_Сети"А"[500]<=>IP_Сети"Б"[500]
Jun 11 16:15:17 gate racoon: INFO: begin Identity Protection mode.
Jun 11 16:15:17 gate racoon: WARNING: SPI size isn't zero, but IKE proposal.
Jun 11 16:15:18 gate racoon: INFO: ISAKMP-SA established IP_Сети"А"[500]-IP_Сети"Б"[500] spi:5eb7240d00fbfd7c:8f3443ee8221db9b
Jun 11 16:15:23 gate racoon: NOTIFY: the packet is retransmitted by IP_Сети"Б"[500].
Jun 11 16:15:38 gate last message repeated 2 times
Jun 11 16:15:39 gate racoon: INFO: ISAKMP-SA expired IP_Сети"А"[500]-IP_Сети"Б"[500] spi:61df15843f2c5489:c741efe5058078c0
Jun 11 16:15:40 gate racoon: INFO: ISAKMP-SA deleted IP_Сети"А"[500]-IP_Сети"Б"[500] spi:61df15843f2c5489:c741efe5058078c0
Jun 11 16:15:48 gate racoon: NOTIFY: the packet is retransmitted by IP_Сети"Б"[500].
Jun 11 16:16:08 gate racoon: NOTIFY: the packet is retransmitted by IP_Сети"Б"[500].
Jun 11 16:16:09 gate racoon: ERROR: ignore information because the message is too short
Jun 11 16:16:09 gate racoon: INFO: respond new phase 1 negotiation: IP_Сети"А"[500]<=>IP_Сети"Б"[500]
Jun 11 16:16:09 gate racoon: INFO: begin Identity Protection mode.
Jun 11 16:16:09 gate racoon: WARNING: SPI size isn't zero, but IKE proposal.
Jun 11 16:16:10 gate racoon: INFO: ISAKMP-SA established IP_Сети"А"[500]-IP_Сети"Б"[500] spi:298c96b5ea2d2d1d:984221a1c0162df7
Jun 11 16:16:15 gate racoon: NOTIFY: the packet is retransmitted by IP_Сети"Б"[500].
Jun 11 16:16:30 gate last message repeated 2 times
Jun 11 16:16:31 gate racoon: INFO: ISAKMP-SA expired IP_Сети"А"[500]-IP_Сети"Б"[500] spi:924c422945750807:21b0ba6f4bd9689d
Jun 11 16:16:32 gate racoon: INFO: ISAKMP-SA deleted IP_Сети"А"[500]-IP_Сети"Б"[500] spi:924c422945750807:21b0ba6f4bd9689d
Jun 11 16:16:40 gate racoon: NOTIFY: the packet is retransmitted by IP_Сети"Б"[500].
Jun 11 16:17:00 gate racoon: NOTIFY: the packet is retransmitted by IP_Сети"Б"[500].
Jun 11 16:17:01 gate racoon: ERROR: ignore information because the message is too short
Jun 11 16:17:01 gate racoon: INFO: respond new phase 1 negotiation: IP_Сети"А"[500]<=>IP_Сети"Б"[500]
Jun 11 16:17:01 gate racoon: INFO: begin Identity Protection mode.
Jun 11 16:17:01 gate racoon: WARNING: SPI size isn't zero, but IKE proposal.
Jun 11 16:17:02 gate racoon: INFO: ISAKMP-SA established IP_Сети"А"[500]-IP_Сети"Б"[500] spi:cceacb95d1d3f58e:3da5dedb5ad4a88b
Jun 11 16:17:07 gate racoon: NOTIFY: the packet is retransmitted by IP_Сети"Б"[500].
Jun 11 16:17:22 gate last message repeated 2 times
Jun 11 16:17:23 gate racoon: INFO: ISAKMP-SA expired IP_Сети"А"[500]-IP_Сети"Б"[500] spi:f112137207ec2077:98fb8622ac1db93e
Jun 11 16:17:24 gate racoon: INFO: ISAKMP-SA deleted IP_Сети"А"[500]-IP_Сети"Б"[500] spi:f112137207ec2077:98fb8622ac1db93e
Jun 11 16:17:32 gate racoon: NOTIFY: the packet is retransmitted by IP_Сети"Б"[500].Логи
На Dlink
Friday June 11, 2010 15:28:09 IKED re-TX : IDINIT to IP_Сети"А"
Friday June 11, 2010 15:28:09 Receive IKE M6(IDRESP) : IP_Сети"А" --> IP_Сети"Б"
Friday June 11, 2010 15:28:09 ID error
Friday June 11, 2010 15:28:14 IKED re-TX : IDINIT to IP_Сети"А"
Friday June 11, 2010 15:28:14 Receive IKE M6(IDRESP) : IP_Сети"А" --> IP_Сети"Б"
Friday June 11, 2010 15:28:14 ID error
Friday June 11, 2010 15:28:24 IKED re-TX : IDINIT to IP_Сети"А"
Friday June 11, 2010 15:28:24 Receive IKE M6(IDRESP) : IP_Сети"А" --> IP_Сети"Б"
Friday June 11, 2010 15:28:24 ID error
Friday June 11, 2010 15:28:34 IKED re-TX : IDINIT to IP_Сети"А"
Friday June 11, 2010 15:28:34 Receive IKE M6(IDRESP) : IP_Сети"А" --> IP_Сети"Б"
Friday June 11, 2010 15:28:34 ID error
Friday June 11, 2010 15:28:54 IKED re-TX : IDINIT to IP_Сети"А"
Friday June 11, 2010 15:28:54 Receive IKE M6(IDRESP) : IP_Сети"А" --> IP_Сети"Б"
Friday June 11, 2010 15:28:54 ID error
Friday June 11, 2010 15:28:55 Send IKE (INFO) : delete IP_Сети"Б" -> IP_Сети"А" phase 1
Friday June 11, 2010 15:28:55 IKE phase1 (ISAKMP SA) remove : IP_Сети"Б" <-> IP_Сети"А"
Friday June 11, 2010 15:28:55 Send IKE M1(INIT) : IP_Сети"Б" --> IP_Сети"А"
Friday June 11, 2010 15:28:55 Receive IKE M2(RESP) : IP_Сети"А" --> IP_Сети"Б"
Friday June 11, 2010 15:28:55 Try to match with ENC:3DES AUTH:PSK HASH:SHA1 Group:Group2Не как не могу понять в чем проблема, может кто сталкивался?
