www.zeroshell.net

[nicfide]

Ciao,

stò tentando di instaurare una VPN IpSec tra ZeroShell ed un firewall basato su OpenSwan. Questo il modello:

LanSedeA
192.168.64.0/24
|
| ETH00 IpPrivatoLanSedeA
192.168.64.1
ZeroShell
| ETH01 pPrivato2SedeA
192.168.1.250\ipPubblicoSedeA
|
| IpPrivato1SedeA
192.168.64.1.1
Router Adsl
| IpPubblicoSedeA
xx.xx.xx.xx
|
Internet
|
| IpPubblicoSedeB
yy.yy.yy.yy
Router Adsl
| IpPrivato1SedeB
192.168.1.201
|
| ETH01 pPrivato2SedeB
192.168.1.200\ipPubblicoSedeB
ZeroShell
| ETH00 IpPrivatoLanSedeB
192.168.16.1
|
LanSedeB
192.168.16.0/24


Questo il conf di OpenSwan:
conn VPN1
auth=esp
authby=secret
auto=start
esp=3des-md5
ike=3des-md5
keyexchange=ike
left=192.168.1.200
leftid=192.168.1.200
leftsubnet=192.168.16.0/24
pfs=no
right=xx.xx.xx.xx
rightid=xx.xx.xx.xx
rightsubnet=192.168.64.0/24

ipsec.secret:

192.168.16.200 xx.xx.xx.xx: PSK "VPNProva"

Questa la conf di racoon:
path include "/Database/etc/racoon";
path pre_shared_key "/Database/etc/racoon/pskey.conf";

listen {
isakmp 192.168.1.250 [500];
isakmp_natt 192.168.1.250 [4500];
}
remote yy.yy.yy.yy {
exchange_mode aggressive,main;
my_identifier address 192.168.1.250;
initial_contact off;
nat_traversal on;
proposal {
encryption_algorithm 3des;
hash_algorithm md5;
authentication_method pre_shared_key;
dh_group 2;
}
}
sainfo address 192.168.64.0/24 any address 192.168.16.0/24 any
{
# pfs_group 2;
encryption_algorithm 3des;
authentication_algorithm hmac_md5;
compression_algorithm deflate;
lifetime time 86400 sec;
}

setkey.conf:
flush;
spdflush;
spdadd 192.168.16.0/24 192.168.64.0/24 any -P in ipsec esp/tunnel/yy.yy.yy.yy-192.168.1.250 /require;
spdadd 192.168.64.0/24 192.168.16.0/24 any -P out ipsec esp/tunnel/192.168.1.250-yy.yy.yy.yy /require;

pskey.conf:
yy.yy.yy.yy VPNProva

Non riesco ad instaurare la connessione. questa è la parte di log più significativa:

2015-02-05 13:55:49: DEBUG: decrypted payload, but not trimed.
2015-02-05 13:55:49: DEBUG:
8a79d130 16766182 a61b419b 30a84f06 a3ee04aa c41a7aa2 14acba8e 5ede0024
2015-02-05 13:55:49: DEBUG: padding len=37
2015-02-05 13:55:49: DEBUG: skip to trim padding.
2015-02-05 13:55:49: DEBUG: decrypted.
2015-02-05 13:55:49: DEBUG:
e4843171 6933649a 47155482 1fe4541f 05100201 00000000 0000003c 8a79d130
16766182 a61b419b 30a84f06 a3ee04aa c41a7aa2 14acba8e 5ede0024
2015-02-05 13:55:49: DEBUG: begin.
2015-02-05 13:55:49: DEBUG: seen nptype=5(id)
2015-02-05 13:55:49: DEBUG: invalid length of payload

Grazie per il supporto.