[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Racoon

Hello

>What do you get in the logs?
>For a "connection" (by which I assume you mean an established tunnel)
>to be established, racoon needs to the the handshakes with the other
>side - if these fail, there should be traces of it in the
>logs.


Debian racoon Logs;

Sep 29 17:26:57 mx04 rsyslogd-2177: imuxsock lost 29 messages from pid
2353 due to rate-limiting
Sep 29 17:26:57 mx04 racoon: DEBUG: ===
Sep 29 17:26:57 mx04 racoon: DEBUG: 84 bytes message received from
2.2.2.2[500] to 1.1.1.1[500]
Sep 29 17:26:57 mx04 racoon: DEBUG: #012d023406b 52dfd0b5 abb9799e
9ea312c0 08100501 940797cb 00000054 8b2eaffd#0128f73c0ea 8174951c
9016a691 576c75df 8c598304 4a59b436 84681892 17b9f076#012d50b7bd4
6b7bfd6c 5c38a83d ef4421f7 254a7906
Sep 29 17:26:57 mx04 racoon: DEBUG: receive Information.
Sep 29 17:26:57 mx04 racoon: DEBUG: compute IV for phase2
Sep 29 17:26:57 mx04 racoon: DEBUG: phase1 last IV:
Sep 29 17:26:57 mx04 racoon: DEBUG: #012049e3207 97a2f76e 940797cb
Sep 29 17:26:57 mx04 racoon: DEBUG: hash(md5)
Sep 29 17:26:57 mx04 racoon: DEBUG: encryption(3des)
Sep 29 17:26:57 mx04 racoon: DEBUG: phase2 IV computed:
Sep 29 17:26:57 mx04 racoon: DEBUG: #0126ee4bc2f 792ffba2
Sep 29 17:26:57 mx04 racoon: DEBUG: begin decryption.
Sep 29 17:26:57 mx04 racoon: DEBUG: encryption(3des)
Sep 29 17:26:57 mx04 racoon: DEBUG: IV was saved for next processing:
Sep 29 17:26:57 mx04 racoon: DEBUG: #012ef4421f7 254a7906
Sep 29 17:26:57 mx04 racoon: DEBUG: encryption(3des)
Sep 29 17:26:57 mx04 racoon: DEBUG: with key:
Sep 29 17:26:57 mx04 racoon: DEBUG: #0121158b894 fcf8cc8f b7963aff
9f508c30 40f85979 1d9148c3
Sep 29 17:26:57 mx04 racoon: DEBUG: decrypted payload by IV:
Sep 29 17:26:57 mx04 racoon: DEBUG: #0126ee4bc2f 792ffba2
Sep 29 17:26:57 mx04 racoon: DEBUG: decrypted payload, but not trimed.
Sep 29 17:26:57 mx04 racoon: DEBUG: #0120c000014 2c306481 245bb895
c7569e24 15af84bc 0000001c 00000001 01100001#012d023406b 52dfd0b5
abb9799e 9ea312c0 2c7f01b2 ab9d2807
Sep 29 17:26:57 mx04 racoon: DEBUG: padding len=8
Sep 29 17:26:57 mx04 racoon: DEBUG: skip to trim padding.
Sep 29 17:26:57 mx04 racoon: DEBUG: decrypted.
Sep 29 17:26:57 mx04 racoon: DEBUG: #012d023406b 52dfd0b5 abb9799e
9ea312c0 08100501 940797cb 00000054 0c000014#0122c306481 245bb895
c7569e24 15af84bc 0000001c 00000001 01100001 d023406b#01252dfd0b5
abb9799e 9ea312c0 2c7f01b2 ab9d2807
Sep 29 17:26:57 mx04 racoon: DEBUG: IV freed
Sep 29 17:26:57 mx04 racoon: DEBUG: HASH with:
Sep 29 17:26:57 mx04 racoon: DEBUG: #012940797cb 0000001c 00000001
01100001 d023406b 52dfd0b5 abb9799e 9ea312c0
Sep 29 17:26:57 mx04 racoon: DEBUG: hmac(hmac_md5)
Sep 29 17:26:57 mx04 racoon: DEBUG: HASH computed:
Sep 29 17:26:57 mx04 racoon: DEBUG: #0122c306481 245bb895 c7569e24 15af84bc
Sep 29 17:26:57 mx04 racoon: DEBUG: hash validated.
Sep 29 17:26:57 mx04 racoon: DEBUG: begin.
Sep 29 17:26:57 mx04 racoon: DEBUG: seen nptype=8(hash)
Sep 29 17:26:57 mx04 racoon: DEBUG: seen nptype=12(delete)
Sep 29 17:26:57 mx04 racoon: DEBUG: succeed.
Sep 29 17:26:57 mx04 racoon: [2.2.2.2.] DEBUG: delete payload for
protocol ISAKMP
Sep 29 17:26:57 mx04 racoon: INFO: ISAKMP-SA expired
1.1.1.1[500]-2.2.2.2[500] spi:d023406b52dfd0b5:abb9799e9ea312c0
Sep 29 17:26:57 mx04 racoon: INFO: ISAKMP-SA deleted
1.1.1.1[500]-2.2.2.2[500] spi:d023406b52dfd0b5:abb9799e9ea312c0
Sep 29 17:26:57 mx04 racoon: DEBUG: IV freed
Sep 29 17:26:57 mx04 racoon: DEBUG: purged SAs.

============

> This looks like a bad copy/paste?? You have spaces in it? Really??
Yes , bad paste...
===========


> Which version of racoon is this?


Racoon informaiton;

root@mx04:/etc/racoon# dpkg -s racoon
Package: racoon
Status: install ok installed
Priority: extra
Section: net
Installed-Size: 1120
Maintainer: Matthew Grant <matthewgrant5@gmail.com>
Architecture: amd64
Source: ipsec-tools
Version: 1:0.8.0-14
Provides: ike-server
Depends: debconf (>= 0.5) | debconf-2.0, ipsec-tools (= 1:0.8.0-14),
libc6 (>= 2.8), libcomerr2 (>= 1.01), libgssapi-krb5-2 (>=
1.10+dfsg~), libk5crypto3 (>= 1.6.dfsg.2), libkrb5-3 (>= 1.6.dfsg.2),
libldap-2.4-2 (>= 2.4.7), libpam0g (>= 0.99.7.1), libssl1.0.0 (>=
1.0.0), adduser, perl
Conflicts: ike-server
Conffiles:
 /etc/init.d/racoon 249ef4dcc91c0b3f05fdda8c13b9d5ac
 /etc/racoon/psk.txt 8912f9ec996ab814f11c45064e80b749
 /etc/racoon/racoon-tool.conf dd682434a9e4bfa828c3595510874e15
 /etc/racoon/racoon.conf 4f91882b325d8ab11361171ef0e56c5d
Description: IPsec Internet Key Exchange daemon
 IPsec (Internet Protocol security) offers end-to-end security for
 network traffic at the IP layer.
=================

B site logs;

01108d29 6f187d06
22:27:11 ipsec,debug,packet e00903ea 2d309a93 7021a75d 000006ec 9db78703
22:27:11 ipsec,debug,packet HASH with:
22:27:11 ipsec,debug,packet b3c284d5 00000020 00000001 01108d29
6f187d06 e00903ea
2d309a93 7021a75d
22:27:11 ipsec,debug,packet 000006ec
22:27:11 ipsec,debug,packet hmac(hmac_md5)
22:27:11 ipsec,debug,packet HASH computed:
22:27:11 ipsec,debug,packet a020f2a8 63d1e2eb 09deec37 eca91b36
22:27:11 ipsec,debug,packet hash validated.
22:27:11 ipsec,debug,packet begin.
22:27:11 ipsec,debug,packet seen nptype=8(hash)
22:27:11 ipsec,debug,packet seen nptype=11(notify)
22:27:11 ipsec,debug,packet succeed.
22:27:11 ipsec,debug,packet DPD R-U-There-Ack received
22:27:11 ipsec,debug,packet received an R-U-THERE-ACK
22:29:11 ipsec,debug,packet DPD monitoring....
22:29:11 ipsec,debug,packet compute IV for phase2
22:29:11 ipsec,debug,packet phase1 last IV:
22:29:11 ipsec,debug,packet c5dfab82 921ed132 b6fcee44
22:29:11 ipsec,debug,packet hash(md5)
22:29:11 ipsec,debug,packet encryption(3des)
22:29:11 ipsec,debug,packet phase2 IV computed:
22:29:11 ipsec,debug,packet 493da261 2debdfc4
22:29:11 ipsec,debug,packet HASH with:
22:29:11 ipsec,debug,packet b6fcee44 00000020 00000001 01108d28
6f187d06 e00903ea
2d309a93 7021a75d
22:29:11 ipsec,debug,packet 000006ed
22:29:11 ipsec,debug,packet hmac(hmac_md5)
22:29:11 ipsec,debug,packet HASH computed:
22:29:11 ipsec,debug,packet 32fee3ae b91d25a6 b9a87f84 d7c297c3
22:29:11 ipsec,debug,packet begin encryption.
22:29:11 ipsec,debug,packet encryption(3des)
22:29:11 ipsec,debug,packet pad length = 4
22:29:11 ipsec,debug,packet 0b000014 32fee3ae b91d25a6 b9a87f84
d7c297c3 00000020
00000001 01108d28
==============

Seems to be no problem according to the system log.

cat /etc/ipsec cat-tools.conf

#
-P out ipsec spdadd any 2.2.2.2/24 4.4.4.4/24
            esp / tunnel / 1.1.1.1-3.3.3.3 / required;

-P out ipsec spdadd any 4.4.4.4/24 2.2.2.2/24
            esp / tunnel / 3.3.3.3-1.1.1.1 / required;



On Mon, Sep 29, 2014 at 9:34 PM, Karl E. Jorgensen
<karl@jorgensen.org.uk> wrote:
> Hi
>
> On Mon, Sep 29, 2014 at 08:30:31PM +0300, Gokan Atmaca wrote:
>> Hello
>>
>> I want to make using racoon IPSEC connection. My configuration is as
>> follows. B site RouterOS (Mikrotik) are available. A kind of
>> connection can not be established.
>
> What do you get in the logs?
>
> For a "connection" (by which I assume you mean an established tunnel)
> to be established, racoon needs to the the handshakes with the other
> side - if these fail, there should be traces of it in the
> logs.
>
> Usually, there will be logging even if it is successfull.  Racoon
> should log via syslog, hence (depending on your syslog configuration)
> /var/log/daemon.log would be the place to look.
>
>> Note: IP addresses are shown as examples.
>>
>> WAN sites: 1.1.1.1
>> LAN sites: 2.2.2.2
>> B's: 3.3.3.3
>> B's: 4.4.4.4
>>
>>
>>
>> - A site config;
>>
>> pre_shared_key path "/etc/racoon/psk.txt";
>> path certificate "/ etc / racoon / certs";
>
> This looks like a bad copy/paste?? You have spaces in it? Really??
>
>> remote 3.3.3.3 {
>>         exchange_mo in the main;
>
> This does not look like valid syntax. More bad copy/paste? Looks like
> it was an attempt at "exchange_mode" ...
>
>>         initial_contact one;
>>         proposal_check obey;
>>         proposal {
>>                  encryption_algorithm 3DES;
>>                  hash_algorithm md5;
>>                  authentication_method pre_shared_key;
>>                  dh_group modp1024;
>>          }
>> }
>
> You may want to avoid 3DES...
>
>>
>>
>> Sainfoin any address 2.2.2.2/24 4.4.4.4/24 address any {
>
> "Sainfoin" .. hm...
>
> Which version of racoon is this?
>
>>          lifetime time 24 hour;
>>          encryption_algorithm 3DES;
>>          authentication_algorithm hmac_md5;
>>          compression_algorithm deflate;
>>          pfs_group modp1024;
>> }
>
> I'd recommend looking in the logs to start with, and getting rid of
> the syntax errors in the config before going further...
>
> Hope this helps
> --
> Karl E. Jorgensen
>
>
> --
> To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
> Archive: [🔎] 20140929183443.GA17498@hawking">https://lists.debian.org/[🔎] 20140929183443.GA17498@hawking
>
Reply to: