Identification IPSEC en nomade

Forum traitant de la distribution sécurisée montante nommée IP cop et basée sur la distribution Smoothwall. C'est à l'heure actuelle le forum le plus actif du site.

Modérateur: modos Ixus

Identification IPSEC en nomade

Messagepar maxime31 » 17 Fév 2005 16:52

Bonjour à tous

Voilà le probleme de que je rencontre, je suis actuellement entrain de faire des tests sur deux réseaux locaux, je souhaiterais faire communiquer un poste qui se situe sur le réseau local B à mon réseau local A, pour celà je met en place un VPN géré par ipcop.
Ma configuration est la suivante :
Réseau A
plage:192.168.0.0/255.255.255.0
adresse GREEN:192.168.0.200

Réseau B
poste nomade 10.0.0.2/255.255.255.0 et 124.124.124.10/255.255.255.0 (poste avec 2 ip)
adresse RED:10.0.0.1
VpnClient : SSH Sentinel

-----------------------
ipsec.conf sur IpCop
-----------------------
config setup
interfaces="ipsec0=eth1"
klipsdebug=none
plutodebug=none
plutoload=%search
plutostart=%search
uniqueids=yes
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.0.0/255.255.255.0

conn %default
keyingtries=0
disablearrivalcheck=no

conn VPNTS
left=10.0.0.1
compress=no
leftsubnet=192.168.0.0/255.255.255.0
right=%any
pfs=yes
authby=secret
auto=add

----------------------------
ipsec.secrets sur IpCop
----------------------------
10.0.0.1 %any : PSK "test"

----------------------
Chargement IPSEC
----------------------
Starting Openswan IPsec 1.0.7...
KLIPS debug `none'
KLIPS ipsec0 on eth1 10.0.0.1/255.255.255.0 broadcast 10.0.0.255
ipsec__plutorun: Starting Pluto subsystem...
pluto[672]: Starting Pluto (Openswan Version 1.0.7)
pluto[672]: including X.509 patch with traffic selectors (Version 0.9.42)
pluto[672]: including NAT-Traversal patch (Version 0.6)
pluto[672]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
pluto[672]: ike_alg_register_enc(): Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0)
pluto[672]: ike_alg_register_enc(): Activating OAKLEY_CAST_CBC: Ok (ret=0)
pluto[672]: ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0)
pluto[672]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)
pluto[672]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)
pluto[672]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0)
pluto[672]: ike_alg_register_enc(): Activating OAKLEY_SSH_PRIVATE_65289: Ok (ret=0)
pluto[672]: Changing to directory '/etc/ipsec.d/cacerts'
ipsec_setup: ...Openswan IPsec started
pluto[672]: Warning: empty directory
pluto[672]: Changing to directory '/etc/ipsec.d/crls'
pluto[672]: Warning: empty directory
pluto[672]: OpenPGP certificate file '/etc/pgpcert.pgp' not found
fcron[699]: fcron[699] 2.0.2 started
fcron[699]: updating configuration from /var/spool/cron
fcron[699]: adding file root
pluto[672]: | from whack: got --esp=3des
pluto[672]: | from whack: got --ike=3des
pluto[672]: added connection description "VPNTS"
pluto[672]: listening for IKE messages
pluto[672]: adding interface ipsec0/eth1 10.0.0.1
pluto[672]: adding interface ipsec0/eth1 10.0.0.1:4500
pluto[672]: loading secrets from "/etc/ipsec.secrets"

--------------------------------------------------------------------------------------------------------------------
On en vient donc maitenant à mon probleme lors de la tentative de connection au tunnel VPN, voilà le log que j'ai :

pluto[672]: packet from 10.0.0.2:500: ignoring Vendor ID payload [SSH Communications Security IPSEC Express version 4.1.0]
pluto[672]: "VPNTS"[1] 10.0.0.2 #1: responding to Main Mode from unknown peer 10.0.0.2
pluto[672]: "VPNTS"[1] 10.0.0.2 #1: transition from state (null) to state STATE_MAIN_R1
pluto[672]: "VPNTS"[1] 10.0.0.2 #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
pluto[672]: "VPNTS"[1] 10.0.0.2 #1: ignoring informational payload, type IPSEC_INITIAL_CONTACT
pluto[672]: "VPNTS"[1] 10.0.0.2 #1: Main mode peer ID is ID_IPV4_ADDR: '124.124.124.10'
pluto[672]: "VPNTS"[2] 10.0.0.2 #1: deleting connection "VPNTS" instance with peer 10.0.0.2
pluto[672]: "VPNTS"[2] 10.0.0.2 #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
pluto[672]: "VPNTS"[2] 10.0.0.2 #1: sent MR3, ISAKMP SA established
pluto[672]: "VPNTS"[2] 10.0.0.2 #1: cannot respond to IPsec SA request because no connection is known for 0.0.0.0/0===10.0.0.1:17/67...10.0.0.2[124.124.124.10]:17/68===124.124.124.10/32
pluto[672]: "VPNTS"[2] 10.0.0.2 #1: sending encrypted notification INVALID_ID_INFORMATION to 10.0.0.2:500


C'est surement tout bête mais je débute un peu dans le domaine et j'aurai bien besoin d'un petit coup de pouce. Merci d'avance.
maxime31
Matelot
Matelot
 
Messages: 4
Inscrit le: 17 Fév 2005 10:39

Retour vers IPCop

Qui est en ligne ?

Utilisateur(s) parcourant actuellement ce forum : Aucun utilisateur inscrit et 1 invité

cron