Thanks for your reply, Aaron.<br>
<br>
Since I log into these hosts from VNC, when I copied out the screen from
the
VNC, some strings messed up on VNC(I have manually edited them, but it
seems I didn't correct them all) , but I'm sure that is not a
error. The Plugins are loaded successfully from
the log, and CHILD SA set up successfully, the data
transmitting between this 2 peers are also wrapped in ESP protocol, it seems
IPsec
works well, but I'm not sure whether this "netlink error" is absolute
harmless. <br>
<br>
I checked the kernel modules dependence info from
<a href="http://wiki.strongswan.org/wiki/1/KernelModules" target="_blank">http://wiki.strongswan.org/wiki/1/KernelModules</a>,
I found my hosts
doesn't build with CONFIG_IP_ADVANCED_ROUTER and
CONFIG_IP_MULTIPLE_TABLES, I wonder whether this is the reason. <br><br>I
grep
some info from Internet, says that CONFIG_IP_ADVANCED_ROUTER and
CONFIG_IP_MULTIPLE_TABLES are for "Tunnel"
mode, but if I doesn't suppose to support "Tunnel" mode, I just wish to
support "Transport" mode, whether is still need to build kernel with
CONFIG_IP_ADVANCED_ROUTER and
CONFIG_IP_MULTIPLE_TABLES? Whether the "netlink error" caused by
missing these modules?<br><br><br><div class="gmail_quote">2010/4/1 Aaron Zhang <span dir="ltr"><<a href="mailto:azhang@sonicwall.com">azhang@sonicwall.com</a>></span><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div link="blue" vlink="purple" lang="ZH-CN"><div><div class="im"><p class="MsoNormal"><span lang="EN-US">strongswan.conf:<br>charon {<br><br> # number of worker threads in charon<br> threads = 16<br><br> # plugins to load in charon<br>
load =curl aes des sha1 md5 sha2 pem pkcs1 gmp random x509 hmac stroke kk<br>ernel-netlink updown<br>}</span></p><p class="MsoNormal"><span lang="EN-US"> </span></p></div><p class="MsoNormal"><span lang="EN-US">kk<br>
ernel-netlink may be kernel-netlink not kkernel-netlink</span></p><p class="MsoNormal"><span lang="EN-US"> </span></p><p class="MsoNormal"><span lang="EN-US"><br><br></span><span style="font-size: 11pt;" lang="EN-US"></span></p>
<p class="MsoNormal"><span style="font-size: 11pt;" lang="EN-US"> </span></p><p class="MsoNormal"><b><span style="font-size: 10pt;" lang="EN-US">From:</span></b><span style="font-size: 10pt;" lang="EN-US"> users-bounces+bzhang=<a href="http://sonicwall.com" target="_blank">sonicwall.com</a>@<a href="http://lists.strongswan.org" target="_blank">lists.strongswan.org</a> [mailto:<a href="mailto:users-bounces%2Bbzhang" target="_blank">users-bounces+bzhang</a>=<a href="http://sonicwall.com" target="_blank">sonicwall.com</a>@<a href="http://lists.strongswan.org" target="_blank">lists.strongswan.org</a>] <b>On Behalf Of </b>MingM Xia<br>
<b>Sent:</b> 2010</span><span style="font-size: 10pt;">Äê</span><span style="font-size: 10pt;" lang="EN-US">4</span><span style="font-size: 10pt;">ÔÂ</span><span style="font-size: 10pt;" lang="EN-US">1</span><span style="font-size: 10pt;">ÈÕ</span><span style="font-size: 10pt;" lang="EN-US"> 14:43<br>
<b>To:</b> <a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a><br><b>Subject:</b> [strongSwan] On PPC: netlink error, unable to create IPv4 routing table rule</span></p><div><div></div>
<div class="h5"><p class="MsoNormal"><span lang="EN-US"> </span></p><p class="MsoNormal" style="margin-bottom: 12pt;"><span lang="EN-US">Hi,<br><br>I'm Running strongSwan 4.3.6rc2 on 2 PPC hosts to accomplish IKEv2 using Charon (transport mode).<br>
<br># uname -a <br>Linux hapWibbSc2 2.6.27.39 #5 SMP PREEMPT Fri Feb 26 18:33:03 CST 2010 ppc ppc ppc GNU/Linux<br><br><br>I met 2 issues:<br><br>1. There are some “netlink error" info:<br><br>Feb 19 15:37:00 localhost charon: 00[KNL] received netlink error: Operation not <br>
supported (95)<br>Feb 19 15:37:00 localhost charon: 00[KNL] unable to create IPv4 routing table ruu<br>le<br>Feb 19 15:37:00 localhost charon: 00[KNL] received netlink error: Operation not <br>supported (95)<br>Feb 19 15:37:00 localhost charon: 00[KNL] unable to create IPv6 routing table ruu<br>
le<br>Feb 19 15:37:00 localhost charon: 00[LIB] plugin 'kernel-netlink': loaded success<br>sfully<br><br>2. <br>root#ipsec up host-host<br>initiating IKE_SA host-host[2] to 10.19.156.194<br>generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>
sending packet: from 10.19.156.242[500] to 10.19.156.194[500]<br>received packet: from 10.19.156.194[500] to 10.19.156.242[500]<br>parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>authentication of '10.19.156.242' (myself) with pre-shared key<br>
establishing CHILD_SA host-host<br>generating IKE_AUTH request 1 [ IDi IDr AUTH N(USE_TRANSP) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(EAP_ONLY) ]<br>
sending packet: from 10.19.156.242[4500] to 10.19.156.194[4500]<br>retransmit 1 of request with message ID 1<br>sending packet: from 10.19.156.242[4500] to 10.19.156.194[4500]<br>retransmit 2 of request with message ID 1<br>
sending packet: from 10.19.156.242[4500] to 10.19.156.194[4500]<br>retransmit 3 of request with message ID 1<br>sending packet: from 10.19.156.242[4500] to 10.19.156.194[4500]<br>retransmit 4 of request with message ID 1<br>
sending packet: from 10.19.156.242[4500] to 10.19.156.194[4500]<br>retransmit 5 of request with message ID 1<br>sending packet: from 10.19.156.242[4500] to 10.19.156.194[4500]<br>giving up after 5 retransmits<br>peer not responding, trying again (2/3)<br>
root# netstat -nlp | grep 4500<br>udp 0 0 <a href="http://0.0.0.0:4500" target="_blank">0.0.0.0:4500</a> 0.0.0.0:* 7698/charon <br>root# netstat -nlp | grep 500 <br>
udp 0 0 <a href="http://0.0.0.0:4500" target="_blank">0.0.0.0:4500</a> 0.0.0.0:* 7698/charon <br>udp 0 0 <a href="http://0.0.0.0:500" target="_blank">0.0.0.0:500</a> 0.0.0.0:* 7698/charon <br>
<br>I find it has something to do with my Firewall, when I disable the firewall for both hosts, Child SA is created successfully even it's still with the “netlink error" mentioned above.<br><br><br>I'm kindly confused about "leftfirewall=yes" configuration and "charon.routing_table”,<br>
<br>About "left|rightfirewall=yes"</span>£¬<span lang="EN-US"> I used to think, with this configuration, strongSwan will insert the rule to IPTABLES for the connection at the very beginning, obviously I'm wrong, from the log of successful case, I find the firewall script "_updown" is for CHILD SA, it will be implemented after CHILD SA set up, not at the very beginning. So we still need to make sure the port used IKE is not blocked on both peers, for IKE v2, by default, there will be UDP port 500 and 4500, we need make sure our firewall open UDP port 500 and UDP port 4500, am I right?<br>
<br>About "charon.routing_table”, is this by default enabled for IKEv2? I checked the code of "kernel_netlink_net_create", the print of "netlink error" tells me "this->routing_table" is true, but actually I didn't configure it in strongswan.conf. I'm not so clear about the purpose of this "routing table", anybody can give some explanation about this "routing table" purpose? And anybody have some idea with this "unable to create IPv4 routing table rule" on my PPC hosts? <br>
<br>It seems like even with this "unable to create IPv4 routing table rule", the IPsec (transport mode) works well on my 2 PPC hosts, is there any potential failure I haven't realized with "netlink error" ?<br>
<br><br>ipsec.conf:<br>config setup<br> # plutodebug=all<br> # crlcheckinterval=600<br> # strictcrlpolicy=yes<br> # cachecrls=yes<br> # nat_traversal=yes<br> # charonstart=no<br> # plutostart=no<br>
plutostart=no<br> plutodebug=all<br> charonstart=yes<br> charondebug="dmn 3,mgr 3,ike 3,chd 3,job 3,cfg 3,knl 3,net 3,enc 1,lib 3"<br><br>conn host-host-bcu3<br> authby=psk<br>
left=10.19.156.194<br> leftfirewall=yes<br> right=10.19.156.242<br> type=transport<br> ike=aes128-sha256-modp2048!<br> keyexchange=ikev2<br> esp=aes128-sha256-modp2048!<br>
auto=add<br><br>strongswan.conf:<br>charon {<br><br> # number of worker threads in charon<br> threads = 16<br><br> # plugins to load in charon<br> load =curl aes des sha1 md5 sha2 pem pkcs1 gmp random x509 hmac stroke kk<br>
ernel-netlink updown<br>}<br><br><br>Best regards,<br><br>Mac</span></p></div></div></div></div></blockquote></div><br>