Т.к. по умолчанию в ядро встроен netkey пришлось пропатчить ядро для поддержки klips.
После настройки ipsec.conf был поднят туннель. Но в логах появились ошибки:
Informational Exchange is for an unknown (expired?) SA with MSGID: 0x....
и
PROTO_IPSEC_ESP SA (0x...) not found
Код: Выделить всё
Sep 15 11:03:38 motor ipsec_setup: Starting Openswan IPsec 2.6.21...
Sep 15 11:03:38 motor ipsec_setup: Using KLIPS/legacy stack
Sep 15 11:03:38 motor kernel: padlock: VIA PadLock not detected.
Sep 15 11:03:38 motor kernel: padlock: VIA PadLock Hash Engine not detected.
Sep 15 11:03:38 motor kernel: padlock: VIA PadLock not detected.
Sep 15 11:03:38 motor kernel: padlock: VIA PadLock Hash Engine not detected.
Sep 15 11:03:38 motor ipsec_setup: KLIPS debug `none'
Sep 15 11:03:38 motor kernel:
Sep 15 11:03:38 motor ipsec_setup: KLIPS ipsec0 on eth1 172.16.132.82/255.255.255.252 broadcast 172.16.132.83
Sep 15 11:03:38 motor ipsec__plutorun: Starting Pluto subsystem...
Sep 15 11:03:38 motor pluto: adjusting ipsec.d to /etc/ipsec.d
Sep 15 11:03:38 motor pluto[11401]: Starting Pluto (Openswan Version 2.6.21; Vendor ID OE~q\177kZNr}Wk) pid:11401
Sep 15 11:03:38 motor pluto[11401]: Setting NAT-Traversal port-4500 floating to off
Sep 15 11:03:38 motor pluto[11401]: port floating activation criteria nat_t=0/port_float=1
Sep 15 11:03:38 motor pluto[11401]: KLIPS does not have NAT-Traversal built in (see /proc/net/ipsec/natt)
Sep 15 11:03:38 motor pluto[11401]: including NAT-Traversal patch (Version 0.6c) [disabled]
Sep 15 11:03:38 motor pluto[11401]: using /dev/urandom as source of random entropy
Sep 15 11:03:38 motor pluto[11401]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC_SSH: Ok (ret=0)
Sep 15 11:03:38 motor pluto[11401]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0)
Sep 15 11:03:38 motor pluto[11401]: ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0)
Sep 15 11:03:38 motor pluto[11401]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
Sep 15 11:03:38 motor ipsec_setup: ...Openswan IPsec started
Sep 15 11:03:39 motor pluto[11401]: ike_alg_register_enc(): Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0)
Sep 15 11:03:39 motor pluto[11401]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)
Sep 15 11:03:39 motor pluto[11401]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)
Sep 15 11:03:38 motor ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d
Sep 15 11:03:39 motor pluto[11401]: starting up 1 cryptographic helpers
Sep 15 11:03:39 motor pluto[11401]: started helper pid=11409 (fd:7)
Sep 15 11:03:39 motor pluto[11401]: Using KLIPS IPsec interface code on 2.6.27.29-0.1-pae
Sep 15 11:03:39 motor pluto[11409]: using /dev/urandom as source of random entropy
Sep 15 11:03:39 motor pluto[11401]: Changed path to directory '/etc/ipsec.d/cacerts'
Sep 15 11:03:39 motor pluto[11401]: Could not change to directory '/etc/ipsec.d/aacerts': /var/log
Sep 15 11:03:39 motor pluto[11401]: Could not change to directory '/etc/ipsec.d/ocspcerts': /var/log
Sep 15 11:03:39 motor pluto[11401]: Changing to directory '/etc/ipsec.d/crls'
Sep 15 11:03:39 motor pluto[11401]: Warning: empty directory
Sep 15 11:03:39 motor pluto[11401]: added connection description "Gorod-Region"
Sep 15 11:03:39 motor ipsec__plutorun: 002 added connection description "Gorod-Region"
Sep 15 11:03:39 motor pluto[11401]: listening for IKE messages
Sep 15 11:03:39 motor pluto[11401]: adding interface ipsec0/eth1 172.16.132.82:500
Sep 15 11:03:39 motor pluto[11401]: loading secrets from "/etc/ipsec.secrets"
Sep 15 11:03:39 motor pluto[11401]: loaded private key for keyid: PPK_RSA:AQPAeJ1lw
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: initiating Main Mode
Sep 15 11:03:40 motor ipsec__plutorun: 104 "Gorod-Region" #1: STATE_MAIN_I1: initiate
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: received Vendor ID payload [Openswan (this version) 2.6.21 ]
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: received Vendor ID payload [Dead Peer Detection]
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: STATE_MAIN_I2: sent MI2, expecting MR2
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: received Vendor ID payload [CAN-IKEv2]
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: Main mode peer ID is ID_IPV4_ADDR: '172.16.132.86'
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=aes_128 prf=oakley_sha group=modp2048}
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #2: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW {using isakmp#1 msgid:1da06870 proposal=defaults pfsgroup=OAKLEY_GROUP_MODP2048}
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xbe87e352 <0x0cd89019 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}
Sep 15 11:03:57 motor pluto[11401]: "Gorod-Region" #1: ignoring Delete SA payload: PROTO_IPSEC_ESP SA(0xbe87e351) not found (maybe expired)
Sep 15 11:03:57 motor pluto[11401]: "Gorod-Region" #1: received and ignored informational messageПричем пинг на удаленную подсеть проходит
помогите разобраться!!!