Hi, I am trying to establish ESP tunnel between GW1 and GW2 and my ipsec pre-shared key configuration on GW1 and GW2 is as follows: When I ping the far end interface on Host A from Host B, I notice that ICMP packets are not ESP encrypted and also ipsec status on both GW1 and GW2 reports no SA associations. Could somebody please tell me if I am missing something in here ? I am using strongswan ver 4.6.2 on both the gateways. My kernel version on Gateway 1 is: [root@ex-target ~]# uname -a<br>
Linux ex-target 2.6.23.1-42.fc8 #1 SMP Tue Oct 30 13:55:12 EDT 2007 i686 i686 i386 GNU/Linux<br><br>and on Gateway 2, kernel version is:<br>root@gateway2:~# uname -a<br>Linux gateway2 2.6.32-40-server #87-Ubuntu SMP Tue Mar 6 02:10:02 UTC 2012 x86_64 GNU/Linux<br>
root@gateway2:~#<br><br>root@gateway2:~# ipsec status<br>Security Associations (0 up, 0 connecting):<br> none<br>root@gateway2:~#<br><br>HostA------------GW1==============GW2---------------HostB<br><div id=":up"><br>HostA:<br>
ipadress: <a href="http://192.167.2.2/24" target="_blank">192.167.2.2/24</a><br><br>GW1:<br>
ipaddress <br> etho: <a href="http://192.167.2.180/24" target="_blank">192.167.2.180/24</a><br>
eth1: <a href="http://192.167.21.1/24" target="_blank">192.167.21.1/24</a></div><br>GW2:<br> ipaddress<br> eth1: <a href="http://192.167.21.2/24">192.167.21.2/24</a><br> eth0: <a href="http://192.167.1.180/24">192.167.1.180/24</a><br>
<br>HostB:<br> ipaddress <a href="http://192.167.1.69/24">192.167.1.69/24</a><br><br><b>ipsec configuration on GW1:</b><br> [root@ex-target etc]# more /usr/local/etc/ipsec.conf<br>#!/usr/sbin/setkey -f<br><br># Flush the SAD and SPD<br>
flush;<br>spdflush;<br><br># ESP SAs doing encryption using 192 bit long keys (168 + 24 parity)<br># and authentication using 128 bit long keys<br>add 192.167.2.180 192.167.1.180 esp 0x201 -m tunnel -E 3des-cbc<br>0x7aeaca3f87d060a12f4a4487d5a5c3355920fae69a96c831<br>
-A hmac-md5 0xc0291ff014dccdd03874d9e8e4cdf3e6;<br><br>add 192.167.1.180 192.167.2.180 esp 0x301 -m tunnel -E 3des-cbc<br>0xf6ddb555acfd9d77b03ea3843f2653255afe8eb5573965df<br>-A hmac-md5 0x96358c90783bbfa3d7b196ceabe0536b;<br>
<br># Security policies<br>spdadd <a href="http://172.16.1.0/24">172.16.1.0/24</a> <a href="http://172.16.2.0/24">172.16.2.0/24</a> any -P in ipsec<br> esp/tunnel/192.168.1.172-192.168.31.141/require;<br><br>spdadd <a href="http://172.16.2.0/24">172.16.2.0/24</a> <a href="http://172.16.1.0/24">172.16.1.0/24</a> any -P out ipsec<br>
esp/tunnel/192.168.32.141-192.168.1.172/require;<br><br><br>spdadd <a href="http://172.16.1.0/24">172.16.1.0/24</a> <a href="http://172.16.2.0/24">172.16.2.0/24</a> any -P fwd ipsec<br> esp/tunnel/192.168.1.172-192.168.31.141/require;<br>
<br>spdadd <a href="http://172.16.2.0/24">172.16.2.0/24</a> <a href="http://172.16.1.0/24">172.16.1.0/24</a> any -P rev ipsec<br> esp/tunnel/192.168.32.141-192.168.1.172/require;<br><br><br>spdadd <a href="http://192.167.2.0/24">192.167.2.0/24</a> <a href="http://192.167.1.0/24">192.167.1.0/24</a> any -P out ipsec<br>
esp/tunnel/192.167.21.1-192.167.21.2/require;<br><br>spdadd <a href="http://192.167.1.0/24">192.167.1.0/24</a> <a href="http://192.167.2.0/24">192.167.2.0/24</a> any -P in ipsec<br> esp/tunnel/192.167.21.2-192.167.21.1/require;<br>
<br><br>spdadd <a href="http://192.167.2.0/24">192.167.2.0/24</a> <a href="http://192.167.1.0/24">192.167.1.0/24</a> any -P fwd ipsec<br> esp/tunnel/192.167.21.1-192.167.21.2/require;<br><br>spdadd <a href="http://192.167.1.0/24">192.167.1.0/24</a> <a href="http://192.167.2.0/24">192.167.2.0/24</a> any -P rev ipsec<br>
esp/tunnel/192.167.21.2-192.167.21.1/require;<br><br># config setup<br># cachecrli=yes<br># strictcrlpolicy=yes<br># plutostart=no<br><br>conn net-net<br> leftsubnet=<a href="http://192.167.2.0/24">192.167.2.0/24</a><br>
right=192.167.21.2<br> rightsubnet=<a href="http://192.167.1.0/24">192.167.1.0/24</a><br> auto=add <br>[root@ex-target etc]#<br><br>[root@ex-target etc]# more /usr/local/etc/ipsec.secrets<br>: PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL<br>
[root@ex-target etc]#<br><br><b>ipsec configuration on GW2:</b><br>root@gateway2:~# more /usr/local/etc/ipsec.conf<br># Flush the SAD and SPD<br>flush;<br>spdflush;<br><br># ESP SAs doing encryption using 192 bit long keys (168 + 24 parity)<br>
# and authentication using 128 bit long keys<br>add 192.167.21.2 192.167.21.1 esp 0x201 -m tunnel -E 3des-cbc<br>0x7aeaca3f87d060a12f4a4487d5a5c3355920fae69a96c831<br>-A hmac-md5 0xc0291ff014dccdd03874d9e8e4cdf3e6;<br><br>
add 192.167.21.1 192.167.21.2 esp 0x301 -m tunnel -E 3des-cbc<br>0xf6ddb555acfd9d77b03ea3843f2653255afe8eb5573965df<br>-A hmac-md5 0x96358c90783bbfa3d7b196ceabe0536b;<br><br>spdadd <a href="http://192.167.1.0/24">192.167.1.0/24</a> <a href="http://192.167.2.0/24">192.167.2.0/24</a> any -P out ipsec<br>
esp/tunnel/192.167.21.2-192.167.21.1/require;<br><br>spdadd <a href="http://192.167.2.0/24">192.167.2.0/24</a> <a href="http://192.167.1.0/24">192.167.1.0/24</a> any -P in ipsec<br> esp/tunnel/192.167.21.1-192.167.21.2/require;<br>
<br><br>spdadd <a href="http://192.167.1.0/24">192.167.1.0/24</a> <a href="http://192.167.2.0/24">192.167.2.0/24</a> any -P fwd ipsec<br> esp/tunnel/192.167.21.2-192.167.21.1/require;<br><br>spdadd <a href="http://192.167.2.0/24">192.167.2.0/24</a> <a href="http://192.167.1.0/24">192.167.1.0/24</a> any -P rev ipsec<br>
esp/tunnel/192.167.21.1-192.167.21.2/require;<br><br>conn net-net<br> leftsubnet=<a href="http://192.167.1.0/24">192.167.1.0/24</a><br> right=192.167.21.1<br> rightsubnet=<a href="http://192.167.2.0/24">192.167.2.0/24</a><br>
auto=add<br>root@gateway2:~#<br>root@gateway2:~# more /usr/local/etc/ipsec.secrets<br>: PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL<br>root@gateway2:~#<br><br> <br><br>