IPSec Woes...

[Felipe Alfaro Solana]

On 4 Mar 2005, at 14:38, Scott Ryan wrote:

> Having followed this documentation over and over again:
> http://www.redhat.com/docs/manuals/enterprise/RHEL-3-Manual/security- 
> guide/s1-ipsec-host2host.html
>
> One machine is FC3 the other RHEL4 (pretty similar)
>
> I cannot get these 2 hosts that are on the same network to pass any  
> traffic to
> each other. I see that the tunnel is established,
>
> Mar  4 17:40:09 saturn racoon: INFO: unsupported PF_KEY message  
> REGISTER
> Mar  4 17:40:25 saturn racoon: INFO: respond new phase 1 negotiation:
> 192.168.0.200[500]<=>192.168.0.203[500]
> Mar  4 17:40:25 saturn racoon: INFO: begin Aggressive mode.
> Mar  4 17:40:25 saturn racoon: NOTIFY: couldn't find the proper pskey,  
> try to
> get one by the peer's address.
> Mar  4 17:40:25 saturn racoon: INFO: ISAKMP-SA established  
> 192.168.0.200
> [500]-192.168.0.203[500] spi:e4dc7a800a339f4a:f2247856aa9a0c57
> Mar  4 17:40:26 saturn racoon: INFO: respond new phase 2 negotiation:
> 192.168.0.200[0]<=>192.168.0.203[0]
> Mar  4 17:40:27 saturn racoon: INFO: IPsec-SA established: AH/Transport
> 192.168.0.203->192.168.0.200 spi=54093889(0x3396841)
> Mar  4 17:40:27 saturn racoon: INFO: IPsec-SA established:  
> ESP/Transport
> 192.168.0.203->192.168.0.200 spi=44115096(0x2a12498)
> Mar  4 17:40:27 saturn racoon: INFO: IPsec-SA established: AH/Transport
> 192.168.0.200->192.168.0.203 spi=264377756(0xfc2159c)
> Mar  4 17:40:27 saturn racoon: INFO: IPsec-SA established:  
> ESP/Transport
> 192.168.0.200->192.168.0.203 spi=232232718(0xdd7970e)
>
>  but then when I try to connect from one machine to the other i get:
>
> # telnet 192.168.0.200 389
> Trying 192.168.0.200...
> telnet: connect to address 192.168.0.200: Resource temporarily  
> unavailable
> telnet: Unable to connect to remote host: Resource temporarily  
> unavailable
>
> Is this a bug?

Yes. Linux IPSec stack, when instructed to use IKE (racoon), always  
discards the first IP datagram when initially setting up the IPSEC SA  
between two hosts. Before telnetting, try first pinging the other peer  
in order to set the SA up: you'll see the first ICMP Echo Request  
packet is lost. However, subsequent ICMP Echo Request packets should  
get delivered properly.