IPSec gond

Sziasztok,

Debianon szeretnék egy IPSec-et beállítani. A másik oldal egy Draytek router. Haladok is vele szépen, viszont most elakadtam:


Oct 14 10:03:24 virtual1 racoon: DEBUG: begin decryption.
Oct 14 10:03:24 virtual1 racoon: DEBUG: encryption(3des)
Oct 14 10:03:24 virtual1 racoon: DEBUG: IV was saved for next processing:
Oct 14 10:03:24 virtual1 racoon: DEBUG: #012fda70f52 543fb532
Oct 14 10:03:24 virtual1 racoon: DEBUG: encryption(3des)
Oct 14 10:03:24 virtual1 racoon: DEBUG: with key:
Oct 14 10:03:24 virtual1 racoon: DEBUG: #012d25d8f37 513dc9d6 6c943542 81c6ffeb b90151f3 3c3ef306
Oct 14 10:03:24 virtual1 racoon: DEBUG: decrypted payload by IV:
Oct 14 10:03:24 virtual1 racoon: DEBUG: #012c0bad00b ed772895
Oct 14 10:03:24 virtual1 racoon: DEBUG: decrypted payload, but not trimed.
Oct 14 10:03:24 virtual1 racoon: DEBUG: #012abc54ce4 bfe2f93c 44613fa9 f0c184e7 7122148b 73a92577 73cf3c0e e6f08408#012e2ad5747 a47321d8 7bbd0e85 46fb5db6 67d1b75f 9749bd4a 104c5e38 55f6cc37
Oct 14 10:03:24 virtual1 racoon: DEBUG: padding len=56
Oct 14 10:03:24 virtual1 racoon: DEBUG: skip to trim padding.
Oct 14 10:03:24 virtual1 racoon: DEBUG: decrypted.
Oct 14 10:03:24 virtual1 racoon: DEBUG: #012575e6264 66e7a809 c374735f ae704244 05100201 00000000 0000005c abc54ce4#012bfe2f93c 44613fa9 f0c184e7 7122148b 73a92577 73cf3c0e e6f08408 e2ad5747#012a47321d8 7bbd0e85 46fb5db6 67d1b75f 9749bd4a 104c5e38 55f6cc37
Oct 14 10:03:24 virtual1 racoon: DEBUG: begin.
Oct 14 10:03:24 virtual1 racoon: DEBUG: seen nptype=5(id)
Oct 14 10:03:24 virtual1 racoon: DEBUG: invalid length of payload


"Oct 14 10:03:24 virtual1 racoon: DEBUG: invalid length of payload"

Ilyet ír ki. Tűzfal shorewall, és Racoon-al próbálom meg az IPSec-et. Neten nem nagyon találtam semmit sajnos. Ha kellenek konfigok, szóljatok, betolom.

Köszi előre is.

Balázs

szerk:

rájöttem, hogy semmi konkrétumot nem írtam le, szóval a konfigok:

racoon.conf:



path pre_shared_key "/etc/racoon/psk.txt" ;
log debug2;

listen
{
isakmp 84.2.x.x;
}

remote 91.120.x.x
{
exchange_mode main;

# phase 1 proposal (for ISAKMP SA)
proposal {
encryption_algorithm 3des;
hash_algorithm md5;
authentication_method pre_shared_key ;
dh_group 2 ;
lifetime time 28800 sec ; # sec,min,hour

}

# proposal_check strict;
}

sainfo address 10.20.0.0/24 any address 10.1.1.0/24 any
{
pfs_group 2;
lifetime time 3600 sec ;
encryption_algorithm 3des ;
authentication_algorithm hmac_md5 ;
compression_algorithm deflate ;
pfs_group modp1024 ;
}

sainfo address 84.2.x.x any address 10.1.1.0/24 any
{
pfs_group 2;
lifetime time 3600 sec ;
encryption_algorithm 3des ;
authentication_algorithm hmac_md5 ;
compression_algorithm deflate ;
pfs_group modp1024 ;
}

sainfo address 84.2.x.x any address 91.120.x.x any
{
pfs_group 2;
lifetime time 3600 sec ;
encryption_algorithm 3des ;
authentication_algorithm hmac_md5 ;
compression_algorithm deflate ;
pfs_group modp1024 ;
}

sainfo address 10.20.0.0/24 any address 91.120.x.x any
{
pfs_group 2;
lifetime time 3600 sec ;
encryption_algorithm 3des ;
authentication_algorithm hmac_md5 ;
compression_algorithm deflate ;
pfs_group modp1024 ;
}

psk.txt:



91.120.x.x hosszúkulcs

setkey.conf:



#!/sbin/setkey -f
# First of all flush the SPD and SAD databases
spdflush;
flush;

spdadd 10.20.0.0/24 10.1.1.0/24 any -P out ipsec
esp/tunnel/84.2.x.x-91.120.x.x/require;
spdadd 10.1.1.0/24 10.20.0.0/24 any -P in ipsec
esp/tunnel/91.120.x.x-84.2.x.x/require;

Remélem ez így elég információ