[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Racoon

In addition to the logs;

Sep 29 21:46:02 mx04 racoon: [x.x.x.x] ERROR: couldn't find the pskey
for x.x.x.x.                                                      │
Sep 29 21:46:02 mx04 racoon: [x.x.x.x] ERROR: failed to process ph1
packet (side: 1, status: 4).
   │
Sep 29 21:46:02 mx04 racoon: [x.x.x.x] ERROR: phase1 negotiation
failed.
      │
Sep 29 21:46:28 mx04 racoon: DEBUG: pfkey X_SPDDUMP failed: No such
file or directory
         │
Sep 29 21:47:17 mx04 racoon: DEBUG: pfkey X_SPDDUMP failed: No such
file or directory



On Mon, Sep 29, 2014 at 10:40 PM, Gokan Atmaca <linux.gokan@gmail.com> wrote:
> Hello
>
>>What do you get in the logs?
>>For a "connection" (by which I assume you mean an established tunnel)
>>to be established, racoon needs to the the handshakes with the other
>>side - if these fail, there should be traces of it in the
>>logs.
>
>
> Debian racoon Logs;
>
> Sep 29 17:26:57 mx04 rsyslogd-2177: imuxsock lost 29 messages from pid
> 2353 due to rate-limiting
> Sep 29 17:26:57 mx04 racoon: DEBUG: ===
> Sep 29 17:26:57 mx04 racoon: DEBUG: 84 bytes message received from
> 2.2.2.2[500] to 1.1.1.1[500]
> Sep 29 17:26:57 mx04 racoon: DEBUG: #012d023406b 52dfd0b5 abb9799e
> 9ea312c0 08100501 940797cb 00000054 8b2eaffd#0128f73c0ea 8174951c
> 9016a691 576c75df 8c598304 4a59b436 84681892 17b9f076#012d50b7bd4
> 6b7bfd6c 5c38a83d ef4421f7 254a7906
> Sep 29 17:26:57 mx04 racoon: DEBUG: receive Information.
> Sep 29 17:26:57 mx04 racoon: DEBUG: compute IV for phase2
> Sep 29 17:26:57 mx04 racoon: DEBUG: phase1 last IV:
> Sep 29 17:26:57 mx04 racoon: DEBUG: #012049e3207 97a2f76e 940797cb
> Sep 29 17:26:57 mx04 racoon: DEBUG: hash(md5)
> Sep 29 17:26:57 mx04 racoon: DEBUG: encryption(3des)
> Sep 29 17:26:57 mx04 racoon: DEBUG: phase2 IV computed:
> Sep 29 17:26:57 mx04 racoon: DEBUG: #0126ee4bc2f 792ffba2
> Sep 29 17:26:57 mx04 racoon: DEBUG: begin decryption.
> Sep 29 17:26:57 mx04 racoon: DEBUG: encryption(3des)
> Sep 29 17:26:57 mx04 racoon: DEBUG: IV was saved for next processing:
> Sep 29 17:26:57 mx04 racoon: DEBUG: #012ef4421f7 254a7906
> Sep 29 17:26:57 mx04 racoon: DEBUG: encryption(3des)
> Sep 29 17:26:57 mx04 racoon: DEBUG: with key:
> Sep 29 17:26:57 mx04 racoon: DEBUG: #0121158b894 fcf8cc8f b7963aff
> 9f508c30 40f85979 1d9148c3
> Sep 29 17:26:57 mx04 racoon: DEBUG: decrypted payload by IV:
> Sep 29 17:26:57 mx04 racoon: DEBUG: #0126ee4bc2f 792ffba2
> Sep 29 17:26:57 mx04 racoon: DEBUG: decrypted payload, but not trimed.
> Sep 29 17:26:57 mx04 racoon: DEBUG: #0120c000014 2c306481 245bb895
> c7569e24 15af84bc 0000001c 00000001 01100001#012d023406b 52dfd0b5
> abb9799e 9ea312c0 2c7f01b2 ab9d2807
> Sep 29 17:26:57 mx04 racoon: DEBUG: padding len=8
> Sep 29 17:26:57 mx04 racoon: DEBUG: skip to trim padding.
> Sep 29 17:26:57 mx04 racoon: DEBUG: decrypted.
> Sep 29 17:26:57 mx04 racoon: DEBUG: #012d023406b 52dfd0b5 abb9799e
> 9ea312c0 08100501 940797cb 00000054 0c000014#0122c306481 245bb895
> c7569e24 15af84bc 0000001c 00000001 01100001 d023406b#01252dfd0b5
> abb9799e 9ea312c0 2c7f01b2 ab9d2807
> Sep 29 17:26:57 mx04 racoon: DEBUG: IV freed
> Sep 29 17:26:57 mx04 racoon: DEBUG: HASH with:
> Sep 29 17:26:57 mx04 racoon: DEBUG: #012940797cb 0000001c 00000001
> 01100001 d023406b 52dfd0b5 abb9799e 9ea312c0
> Sep 29 17:26:57 mx04 racoon: DEBUG: hmac(hmac_md5)
> Sep 29 17:26:57 mx04 racoon: DEBUG: HASH computed:
> Sep 29 17:26:57 mx04 racoon: DEBUG: #0122c306481 245bb895 c7569e24 15af84bc
> Sep 29 17:26:57 mx04 racoon: DEBUG: hash validated.
> Sep 29 17:26:57 mx04 racoon: DEBUG: begin.
> Sep 29 17:26:57 mx04 racoon: DEBUG: seen nptype=8(hash)
> Sep 29 17:26:57 mx04 racoon: DEBUG: seen nptype=12(delete)
> Sep 29 17:26:57 mx04 racoon: DEBUG: succeed.
> Sep 29 17:26:57 mx04 racoon: [2.2.2.2.] DEBUG: delete payload for
> protocol ISAKMP
> Sep 29 17:26:57 mx04 racoon: INFO: ISAKMP-SA expired
> 1.1.1.1[500]-2.2.2.2[500] spi:d023406b52dfd0b5:abb9799e9ea312c0
> Sep 29 17:26:57 mx04 racoon: INFO: ISAKMP-SA deleted
> 1.1.1.1[500]-2.2.2.2[500] spi:d023406b52dfd0b5:abb9799e9ea312c0
> Sep 29 17:26:57 mx04 racoon: DEBUG: IV freed
> Sep 29 17:26:57 mx04 racoon: DEBUG: purged SAs.
>
> ============
>
>> This looks like a bad copy/paste?? You have spaces in it? Really??
> Yes , bad paste...
> ===========
>
>
>> Which version of racoon is this?
>
>
> Racoon informaiton;
>
> root@mx04:/etc/racoon# dpkg -s racoon
> Package: racoon
> Status: install ok installed
> Priority: extra
> Section: net
> Installed-Size: 1120
> Maintainer: Matthew Grant <matthewgrant5@gmail.com>
> Architecture: amd64
> Source: ipsec-tools
> Version: 1:0.8.0-14
> Provides: ike-server
> Depends: debconf (>= 0.5) | debconf-2.0, ipsec-tools (= 1:0.8.0-14),
> libc6 (>= 2.8), libcomerr2 (>= 1.01), libgssapi-krb5-2 (>=
> 1.10+dfsg~), libk5crypto3 (>= 1.6.dfsg.2), libkrb5-3 (>= 1.6.dfsg.2),
> libldap-2.4-2 (>= 2.4.7), libpam0g (>= 0.99.7.1), libssl1.0.0 (>=
> 1.0.0), adduser, perl
> Conflicts: ike-server
> Conffiles:
>  /etc/init.d/racoon 249ef4dcc91c0b3f05fdda8c13b9d5ac
>  /etc/racoon/psk.txt 8912f9ec996ab814f11c45064e80b749
>  /etc/racoon/racoon-tool.conf dd682434a9e4bfa828c3595510874e15
>  /etc/racoon/racoon.conf 4f91882b325d8ab11361171ef0e56c5d
> Description: IPsec Internet Key Exchange daemon
>  IPsec (Internet Protocol security) offers end-to-end security for
>  network traffic at the IP layer.
> =================
>
> B site logs;
>
> 01108d29 6f187d06
> 22:27:11 ipsec,debug,packet e00903ea 2d309a93 7021a75d 000006ec 9db78703
> 22:27:11 ipsec,debug,packet HASH with:
> 22:27:11 ipsec,debug,packet b3c284d5 00000020 00000001 01108d29
> 6f187d06 e00903ea
> 2d309a93 7021a75d
> 22:27:11 ipsec,debug,packet 000006ec
> 22:27:11 ipsec,debug,packet hmac(hmac_md5)
> 22:27:11 ipsec,debug,packet HASH computed:
> 22:27:11 ipsec,debug,packet a020f2a8 63d1e2eb 09deec37 eca91b36
> 22:27:11 ipsec,debug,packet hash validated.
> 22:27:11 ipsec,debug,packet begin.
> 22:27:11 ipsec,debug,packet seen nptype=8(hash)
> 22:27:11 ipsec,debug,packet seen nptype=11(notify)
> 22:27:11 ipsec,debug,packet succeed.
> 22:27:11 ipsec,debug,packet DPD R-U-There-Ack received
> 22:27:11 ipsec,debug,packet received an R-U-THERE-ACK
> 22:29:11 ipsec,debug,packet DPD monitoring....
> 22:29:11 ipsec,debug,packet compute IV for phase2
> 22:29:11 ipsec,debug,packet phase1 last IV:
> 22:29:11 ipsec,debug,packet c5dfab82 921ed132 b6fcee44
> 22:29:11 ipsec,debug,packet hash(md5)
> 22:29:11 ipsec,debug,packet encryption(3des)
> 22:29:11 ipsec,debug,packet phase2 IV computed:
> 22:29:11 ipsec,debug,packet 493da261 2debdfc4
> 22:29:11 ipsec,debug,packet HASH with:
> 22:29:11 ipsec,debug,packet b6fcee44 00000020 00000001 01108d28
> 6f187d06 e00903ea
> 2d309a93 7021a75d
> 22:29:11 ipsec,debug,packet 000006ed
> 22:29:11 ipsec,debug,packet hmac(hmac_md5)
> 22:29:11 ipsec,debug,packet HASH computed:
> 22:29:11 ipsec,debug,packet 32fee3ae b91d25a6 b9a87f84 d7c297c3
> 22:29:11 ipsec,debug,packet begin encryption.
> 22:29:11 ipsec,debug,packet encryption(3des)
> 22:29:11 ipsec,debug,packet pad length = 4
> 22:29:11 ipsec,debug,packet 0b000014 32fee3ae b91d25a6 b9a87f84
> d7c297c3 00000020
> 00000001 01108d28
> ==============
>
> Seems to be no problem according to the system log.
>
> cat /etc/ipsec cat-tools.conf
>
> #
> -P out ipsec spdadd any 2.2.2.2/24 4.4.4.4/24
>             esp / tunnel / 1.1.1.1-3.3.3.3 / required;
>
> -P out ipsec spdadd any 4.4.4.4/24 2.2.2.2/24
>             esp / tunnel / 3.3.3.3-1.1.1.1 / required;
>
>
>
> On Mon, Sep 29, 2014 at 9:34 PM, Karl E. Jorgensen
> <karl@jorgensen.org.uk> wrote:
>> Hi
>>
>> On Mon, Sep 29, 2014 at 08:30:31PM +0300, Gokan Atmaca wrote:
>>> Hello
>>>
>>> I want to make using racoon IPSEC connection. My configuration is as
>>> follows. B site RouterOS (Mikrotik) are available. A kind of
>>> connection can not be established.
>>
>> What do you get in the logs?
>>
>> For a "connection" (by which I assume you mean an established tunnel)
>> to be established, racoon needs to the the handshakes with the other
>> side - if these fail, there should be traces of it in the
>> logs.
>>
>> Usually, there will be logging even if it is successfull.  Racoon
>> should log via syslog, hence (depending on your syslog configuration)
>> /var/log/daemon.log would be the place to look.
>>
>>> Note: IP addresses are shown as examples.
>>>
>>> WAN sites: 1.1.1.1
>>> LAN sites: 2.2.2.2
>>> B's: 3.3.3.3
>>> B's: 4.4.4.4
>>>
>>>
>>>
>>> - A site config;
>>>
>>> pre_shared_key path "/etc/racoon/psk.txt";
>>> path certificate "/ etc / racoon / certs";
>>
>> This looks like a bad copy/paste?? You have spaces in it? Really??
>>
>>> remote 3.3.3.3 {
>>>         exchange_mo in the main;
>>
>> This does not look like valid syntax. More bad copy/paste? Looks like
>> it was an attempt at "exchange_mode" ...
>>
>>>         initial_contact one;
>>>         proposal_check obey;
>>>         proposal {
>>>                  encryption_algorithm 3DES;
>>>                  hash_algorithm md5;
>>>                  authentication_method pre_shared_key;
>>>                  dh_group modp1024;
>>>          }
>>> }
>>
>> You may want to avoid 3DES...
>>
>>>
>>>
>>> Sainfoin any address 2.2.2.2/24 4.4.4.4/24 address any {
>>
>> "Sainfoin" .. hm...
>>
>> Which version of racoon is this?
>>
>>>          lifetime time 24 hour;
>>>          encryption_algorithm 3DES;
>>>          authentication_algorithm hmac_md5;
>>>          compression_algorithm deflate;
>>>          pfs_group modp1024;
>>> }
>>
>> I'd recommend looking in the logs to start with, and getting rid of
>> the syntax errors in the config before going further...
>>
>> Hope this helps
>> --
>> Karl E. Jorgensen
>>
>>
>> --
>> To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
>> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
>> Archive: [🔎] 20140929183443.GA17498@hawking">https://lists.debian.org/[🔎] 20140929183443.GA17498@hawking
>>
Reply to: