проблемы с IPsec

Обсуждение настройки и работы сервисов, резервирования, сетевых настроек и вопросов безопасности ОС.

Модераторы: SLEDopit, Модераторы разделов

arturnet
Сообщения: 2

проблемы с IPsec

Сообщение arturnet »

SLES 11 Kernel 2.6 Возникла необходимость поднять VPN. Для этого был выбран пакет openswan.
Т.к. по умолчанию в ядро встроен netkey пришлось пропатчить ядро для поддержки klips.
После настройки ipsec.conf был поднят туннель. Но в логах появились ошибки:

Informational Exchange is for an unknown (expired?) SA with MSGID: 0x....
и
PROTO_IPSEC_ESP SA (0x...) not found

Код: Выделить всё

Sep 15 11:03:38 motor ipsec_setup: Starting Openswan IPsec 2.6.21...
Sep 15 11:03:38 motor ipsec_setup: Using KLIPS/legacy stack
Sep 15 11:03:38 motor kernel: padlock: VIA PadLock not detected.
Sep 15 11:03:38 motor kernel: padlock: VIA PadLock Hash Engine not detected.
Sep 15 11:03:38 motor kernel: padlock: VIA PadLock not detected.
Sep 15 11:03:38 motor kernel: padlock: VIA PadLock Hash Engine not detected.
Sep 15 11:03:38 motor ipsec_setup: KLIPS debug `none'
Sep 15 11:03:38 motor kernel:
Sep 15 11:03:38 motor ipsec_setup: KLIPS ipsec0 on eth1 172.16.132.82/255.255.255.252 broadcast 172.16.132.83
Sep 15 11:03:38 motor ipsec__plutorun: Starting Pluto subsystem...
Sep 15 11:03:38 motor pluto: adjusting ipsec.d to /etc/ipsec.d
Sep 15 11:03:38 motor pluto[11401]: Starting Pluto (Openswan Version 2.6.21; Vendor ID OE~q\177kZNr}Wk) pid:11401
Sep 15 11:03:38 motor pluto[11401]: Setting NAT-Traversal port-4500 floating to off
Sep 15 11:03:38 motor pluto[11401]:    port floating activation criteria nat_t=0/port_float=1
Sep 15 11:03:38 motor pluto[11401]:   KLIPS does not have NAT-Traversal built in (see /proc/net/ipsec/natt)
Sep 15 11:03:38 motor pluto[11401]:    including NAT-Traversal patch (Version 0.6c) [disabled]
Sep 15 11:03:38 motor pluto[11401]: using /dev/urandom as source of random entropy
Sep 15 11:03:38 motor pluto[11401]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC_SSH: Ok (ret=0)
Sep 15 11:03:38 motor pluto[11401]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0)
Sep 15 11:03:38 motor pluto[11401]: ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0)
Sep 15 11:03:38 motor pluto[11401]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
Sep 15 11:03:38 motor ipsec_setup: ...Openswan IPsec started
Sep 15 11:03:39 motor pluto[11401]: ike_alg_register_enc(): Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0)
Sep 15 11:03:39 motor pluto[11401]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)
Sep 15 11:03:39 motor pluto[11401]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)
Sep 15 11:03:38 motor ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d
Sep 15 11:03:39 motor pluto[11401]: starting up 1 cryptographic helpers
Sep 15 11:03:39 motor pluto[11401]: started helper pid=11409 (fd:7)
Sep 15 11:03:39 motor pluto[11401]: Using KLIPS IPsec interface code on 2.6.27.29-0.1-pae
Sep 15 11:03:39 motor pluto[11409]: using /dev/urandom as source of random entropy
Sep 15 11:03:39 motor pluto[11401]: Changed path to directory '/etc/ipsec.d/cacerts'
Sep 15 11:03:39 motor pluto[11401]: Could not change to directory '/etc/ipsec.d/aacerts': /var/log
Sep 15 11:03:39 motor pluto[11401]: Could not change to directory '/etc/ipsec.d/ocspcerts': /var/log
Sep 15 11:03:39 motor pluto[11401]: Changing to directory '/etc/ipsec.d/crls'
Sep 15 11:03:39 motor pluto[11401]:   Warning: empty directory
Sep 15 11:03:39 motor pluto[11401]: added connection description "Gorod-Region"
Sep 15 11:03:39 motor ipsec__plutorun: 002 added connection description "Gorod-Region"
Sep 15 11:03:39 motor pluto[11401]: listening for IKE messages
Sep 15 11:03:39 motor pluto[11401]: adding interface ipsec0/eth1 172.16.132.82:500
Sep 15 11:03:39 motor pluto[11401]: loading secrets from "/etc/ipsec.secrets"
Sep 15 11:03:39 motor pluto[11401]: loaded private key for keyid: PPK_RSA:AQPAeJ1lw
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: initiating Main Mode
Sep 15 11:03:40 motor ipsec__plutorun: 104 "Gorod-Region" #1: STATE_MAIN_I1: initiate
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: received Vendor ID payload [Openswan (this version) 2.6.21 ]
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: received Vendor ID payload [Dead Peer Detection]
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: STATE_MAIN_I2: sent MI2, expecting MR2
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: received Vendor ID payload [CAN-IKEv2]
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: Main mode peer ID is ID_IPV4_ADDR: '172.16.132.86'
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=aes_128 prf=oakley_sha group=modp2048}
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #2: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW {using isakmp#1 msgid:1da06870 proposal=defaults pfsgroup=OAKLEY_GROUP_MODP2048}
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
Sep 15 11:03:40 motor pluto[11401]: "Gorod-Region" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xbe87e352 <0x0cd89019 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}
Sep 15 11:03:57 motor pluto[11401]: "Gorod-Region" #1: ignoring Delete SA payload: PROTO_IPSEC_ESP SA(0xbe87e351) not found (maybe expired)
Sep 15 11:03:57 motor pluto[11401]: "Gorod-Region" #1: received and ignored informational message



Причем пинг на удаленную подсеть проходит
помогите разобраться!!!
Спасибо сказали:
DSS
Сообщения: 390

Re: проблемы с IPsec

Сообщение DSS »

http://osdir.com/ml/network.openswan.user/...9/msg00042.html

Попробуйте половить протокол ESP tcpdump'ом на интерфейсе, где поднят IPsec, и поглядеть, с какими spi бегают пакетики.
То, что написано по ссылке выше вполне может оказаться правдой - приходит сообщение на разрыв туннеля, который уже разорван.
Спасибо сказали:
arturnet
Сообщения: 2

Re: проблемы с IPsec

Сообщение arturnet »

tcpdump -i eth1 -vv -n -p ip proto 50

выдала следующее:

Код: Выделить всё

09:38:55.102876 IP (tos 0x0, ttl 62, id 9846, offset 0, flags [none], proto ESP (50), length 248) 172.16.132.86 > 172.16.132.82: ESP(spi=0x17bb24cd,seq=0x283bd), length 228
09:38:55.103154 IP (tos 0x0, ttl 64, id 6989, offset 0, flags [none], proto ESP (50), length 264) 172.16.132.82 > 172.16.132.86: ESP(spi=0x67c639af,seq=0x1bac3), length 244
09:38:55.107387 IP (tos 0x0, ttl 62, id 9847, offset 0, flags [none], proto ESP (50), length 232) 172.16.132.86 > 172.16.132.82: ESP(spi=0x17bb24cd,seq=0x283be), length 212
09:38:55.107602 IP (tos 0x0, ttl 64, id 6990, offset 0, flags [none], proto ESP (50), length 264) 172.16.132.82 > 172.16.132.86: ESP(spi=0x67c639af,seq=0x1bac4), length 244
09:38:55.110799 IP (tos 0x0, ttl 62, id 9848, offset 0, flags [none], proto ESP (50), length 296) 172.16.132.86 > 172.16.132.82: ESP(spi=0x17bb24cd,seq=0x283bf), length 276
09:38:55.111043 IP (tos 0x0, ttl 64, id 6991, offset 0, flags [none], proto ESP (50), length 152) 172.16.132.82 > 172.16.132.86: ESP(spi=0x67c639af,seq=0x1bac5), length 132
09:38:55.113961 IP (tos 0x0, ttl 62, id 9849, offset 0, flags [none], proto ESP (50), length 152) 172.16.132.86 > 172.16.132.82: ESP(spi=0x17bb24cd,seq=0x283c0), length 132
09:38:55.115356 IP (tos 0x0, ttl 64, id 6992, offset 0, flags [none], proto ESP (50), length 216) 172.16.132.82 > 172.16.132.86: ESP(spi=0x67c639af,seq=0x1bac6), length 196
09:38:55.118333 IP (tos 0x0, ttl 62, id 9850, offset 0, flags [none], proto ESP (50), length 152) 172.16.132.86 > 172.16.132.82: ESP(spi=0x17bb24cd,seq=0x283c1), length 132


похоже трафик шифруется

пробовал ловить tcpdump обмен ike на 500 порту - периодически происходят
может просто забить на нее?
Спасибо сказали: