vpn+ipcop 1.3

[kinkey]

re les gars... <BR>j'ai un soucis avec la mise en place d'un vpn en ipcop et des clients ipsec XP et 2000 sp3. j'ai utilise la methode pour les road warrior. <BR> <BR>pour info je suis connecte directe sur le switch, ca ressemble a ca : <BR> <BR> <BR>-------------------- ----------------------------------- ----------------------- <BR>|98 192.168.5.62|-------| Ipcop 192.168.5.254 / 6.254|--------| xp 192.168.6.251 | <BR>-------------------- ----------------------------------- ----------------------- <BR> <BR>dc rien de particulie, j'ai n'ai pas touche a la config du firewall, le proxy est pas active. <BR>voila un cat /var/log/secure juste apres avoir redemarre le service VPN : <BR>Jul 24 14:55:25 svfirw ipsec__plutorun: Starting Pluto subsystem... <BR>Jul 24 14:55:25 svfirw pluto[1768]: Starting Pluto (FreeS/WAN Version super-freeswan-1.99_kb2c) <BR>Jul 24 14:55:25 svfirw pluto[1768]: including X.509 patch (Version 0.9.15) <BR>Jul 24 14:55:25 svfirw pluto[1768]: including NAT-Traversal patch (Version 0.5a) [disabled] <BR>Jul 24 14:55:25 svfirw pluto[1768]: ike_alg_register_enc: Activating OAKLEY_AES_CBC: Ok (ret=0) <BR>Jul 24 14:55:25 svfirw pluto[1768]: ike_alg_register_enc: Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0) <BR>Jul 24 14:55:25 svfirw pluto[1768]: ike_alg_register_enc: Activating OAKLEY_CAST_CBC: Ok (ret=0) <BR>Jul 24 14:55:25 svfirw pluto[1768]: ike_alg_register_enc: Activating OAKLEY_SERPENT_CBC: Ok (ret=0) <BR>Jul 24 14:55:25 svfirw pluto[1768]: ike_alg_register_hash: Activating OAKLEY_SHA2_256: Ok (ret=0) <BR>Jul 24 14:55:25 svfirw pluto[1768]: ike_alg_register_hash: Activating OAKLEY_SHA2_512: Ok (ret=0) <BR>Jul 24 14:55:25 svfirw pluto[1768]: ike_alg_register_enc: Activating OAKLEY_TWOFISH_CBC: Ok (ret=0) <BR>Jul 24 14:55:25 svfirw pluto[1768]: ike_alg_register_enc: Activating OAKLEY_SSH_PRIVATE_65289: Ok (ret=0) <BR>Jul 24 14:55:25 svfirw pluto[1768]: Changing to directory '/etc/ipsec.d/cacerts' <BR>Jul 24 14:55:25 svfirw pluto[1768]: Warning: empty directory <BR>Jul 24 14:55:25 svfirw pluto[1768]: Changing to directory '/etc/ipsec.d/crls' <BR>Jul 24 14:55:25 svfirw pluto[1768]: Warning: empty directory <BR>Jul 24 14:55:25 svfirw pluto[1768]: could not open my default X.509 cert file '/etc/x509cert.der' <BR>Jul 24 14:55:25 svfirw pluto[1768]: OpenPGP certificate file '/etc/pgpcert.pgp' not found <BR>Jul 24 14:55:26 svfirw pluto[1768]: listening for IKE messages <BR>Jul 24 14:55:26 svfirw pluto[1768]: no public interfaces found <BR>Jul 24 14:55:26 svfirw pluto[1768]: loading secrets from "/etc/ipsec.secrets" <BR> <BR> <BR>ce qui m'inquiete c les warning ? <BR> <BR>voila ma config sur l'ipcop : <BR>- ipsec.conf : <BR>config setup <BR> interfaces=%defaultroute <BR> klipsdebug=none <BR> plutodebug=none <BR> plutoload=%search <BR> plutostart=%search <BR> uniqueids=yes <BR> <BR>conn %default <BR> keyingtries=0 <BR> <BR>conn roadwarrior <BR> left=192.168.5.254 <BR> compress=yes <BR> leftsubnet=192.168.5.0/24 <BR> leftnexthop=%defaultroute <BR> right=192.168.6.254 <BR> rightsubnet=192.168.6.0/24 <BR> rightnexthop=%defaultroute <BR> auto=start <BR> <BR>- ipsec.secrets : <BR>192.168.6.254 0.0.0.0 : PSK "abcdef" <BR>192.168.6.254 %any : PSK "abcdef" <BR> <BR>voila si quelqu'un a une idee, je prend <IMG SRC="images/smiles/icon_biggrin.gif"> <BR>

[kinkey]

hehe encore un peu d'info : <BR>j'ai ete dans le journal sur le http et IPSEC voila un truc qui m'etonne : <BR> <BR> <BR>15:08:52 ipsec_setup Starting FreeS/WAN IPsec super-freeswan-1.99_kb2c... <BR>15:08:53 ipsec_setup Using /lib/modules/2.4.20/kernel/net/ipsec/ipsec.o <BR>15:08:53 ipsec_setup KLIPS debug `none' <BR>15:08:53 ipsec_setup no default route, %defaultroute cannot cope!!! <BR>15:08:53 ipsec_setup ...FreeS/WAN IPsec started <BR>15:08:53 ipsec__plutorun: ipsec_auto: fatal error in "roadwarrior" %defaultroute requested but not known <BR>15:08:53 ipsec__plutorun 003 no public interfaces found <BR>15:08:53 ipsec__plutorun 021 no connection named "roadwarrior" <BR>15:08:53 ipsec__plutorun ...could not route conn "roadwarrior" <BR>15:08:53 ipsec__plutorun 021 no connection named "roadwarrior" <BR>15:08:53 ipsec__plutorun ...could not start conn "roadwarrior" <BR>

[kinkey]

j'en rajoute encore un peu, bon si je lance ipsec.exe sur la machine xp (192.168.6.251) ca marche, si je fait un ping 192.168.5.254 sois l'interface green d'ipcop ca me dit que l'hote n'est pas joingnable, au contraire si sur mon xp je rajoute une ligne a la table de routage <BR> <BR>route add 192.168.5.0 mask 255.255.255.0 192.168.6.254 <BR> <BR>je refais un ping apres, ca me dit negociation de la securite ip, mais bon ca fait 5 mn que ca tourne comme ca <IMG SRC="images/smiles/icon_frown.gif"> et si je vais dans l'interface http, il m'indique que le canal est ferme <IMG SRC="images/smiles/icon_frown.gif">

[kinkey]

bon j'ai trouve comme un grand, c'etait une erreur de config cote xp, et il faut bien ajoute un route cote xp a la table de routage. <BR> <BR>maintenant autre soucis... je ping la red de l'ipcop (192.168.5.254) au contraire je passe pas derriere, par exemple la .10 hote introuvable. j'ai ete voir dans le journal du firewall... <BR> <BR>16:02:03|OUTPUT|eth1|ICMP|192.168.6.251|ICMP|192.168.5.10|ICMP <BR>16:02:09|OUTPUT|eth1|ICMP|192.168.6.251|ICMP|192.168.5.10|ICMP <BR> <BR>je dirais que ca bloque... alors j'ai voulu utilise ipchains -L.... horreur bash: ipchains: command not found.... je fais quoi la, je saute par la fenetre ??? <BR>

[kinkey]

oups la boulette !! <BR>c pas ipchains -L mais iptables -L.. aie aie pas la tete !! <BR>bon voila le resultat de iptables -L | grep -i icmp <BR> <BR>ACCEPT|icmp|--|anywhere|anywhere <BR>LOG| icmp|--|anywhere|anywhere|limit: avg 10/min burst 5 LOG level warning prefix `ICMP Scan? ' <BR>

[musael]

salut voila g le meme probleme que toi alors j'aimerais savoir comment tu as fait pour le resoudre . explique moi comment tu as fais pour mettre une route sur xp moi c un 2000 mais soi dois etre la meme chose. <BR> <BR> <BR>voila mon probleme: <BR> <BR>28 11:56:16 vpn ipsec__plutorun: ipsec_auto: fatal error in "packetdefault": %defaultroute requested but not known <BR> <BR>Jan 28 11:56:17 vpn ipsec__plutorun: ipsec_auto: fatal error in "block": %defaultroute requested but not known <BR> <BR>Jan 28 11:56:17 vpn ipsec__plutorun: ipsec_auto: fatal error in "roadwarrior-net": (/etc/ipsec.conf, line 28) duplicated parameter "leftsubnet" <BR> <BR>Jan 28 11:56:17 vpn ipsec__plutorun: ...could not add conn "roadwarrior-net" <BR> <BR>Jan 28 11:56:17 vpn ipsec__plutorun: ipsec_auto: fatal error in "clear-or-private": %defaultroute requested but not known <BR> <BR>Jan 28 11:56:17 vpn ipsec__plutorun: ipsec_auto: fatal error in "clear": %defaultroute requested but not known <BR> <BR>Jan 28 11:56:18 vpn ipsec__plutorun: ipsec_auto: fatal error in "private-or-clear": %defaultroute requested but not known <BR> <BR>Jan 28 11:56:18 vpn ipsec__plutorun: ipsec_auto: fatal error in "private": %defaultroute requested but not known <BR> <BR>Apparement j'ai un leger probleme avec pluto mais je ne sais pas comment le resoudre alors si vous avez une idee je suis preneur! <BR> <BR>je suis sous fedora avec freeswan 2.04 <BR> <BR>merci d'avance <BR>