Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: vpnc: devel

vpnc-nortel can establish connection but doesn't receive any traffic

 

 

vpnc devel RSS feed   Index | Next | Previous | View Threaded


dick at mrns

Sep 15, 2009, 12:07 PM

Post #1 of 6 (661 views)
Permalink
vpnc-nortel can establish connection but doesn't receive any traffic

Hi all,

I've just compiled and installed vpnc from svn, everthing works except
that I don't receive any data from the tunnel.

- vpnc seems to start correct:
# vpnc
VPNC started in background (pid: 13967)...

- I've added a manual route and started pinging a address which should
be reachable by this VPN, but it don't get any replies, RX packets is
still 0:
# ip ro add 1.2.3.4/32 dev tun0
# ping 1.2.3.4/32 dev tun0 &
# tcpdump -ni tap0
tcpdump: WARNING: arptype 65534 not supported by libpcap - falling back
to cooked socket
tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode
listening on tun0, link-type LINUX_SLL (Linux cooked), capture size 96
bytes
20:44:50.563888 IP 10.0.0.57 > 1.2.3.4: ICMP echo request, id 64308, seq
6, length 64
20:44:51.563873 IP 10.0.0.57 > 1.2.3.4: ICMP echo request, id 64308, seq
7, length 64
20:44:52.563843 IP 10.0.0.57 > 1.2.3.4: ICMP echo request, id 64308, seq
8, length 64
20:44:53.563833 IP 10.0.0.57 > 1.2.3.4: ICMP echo request, id 64308, seq
9, length 64
# ifconfig tun0
tun0 Link encap:UNSPEC HWaddr
00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.0.0.57 P-t-P:10.0.0.57 Mask:255.255.248.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:41 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 b) TX bytes:5000 (4.8 KiB)

- When I look at the logging of vpnc I see data is transmitted

- I get ping replies using the Widnows Nortel client

Could someone please help me?

Thanks in advance,
Dick

_______________________________________________
vpnc-devel mailing list
vpnc-devel[at]unix-ag.uni-kl.de
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/


dick at mrns

Sep 21, 2009, 12:49 PM

Post #2 of 6 (593 views)
Permalink
Re: vpnc-nortel can establish connection but doesn't receive any traffic [In reply to]

I still have the same error (can connect but I can't get any traffic through my
VPN, I've configured the routes correctly and when I change the credentials I
get a message about incorrect credentials.

$ vpnc --debug 2 --no-detach

vpnc version 0.5.3

S1 init_sockaddr
[2009-09-21 21:47:25]

S2 make_socket
[2009-09-21 21:47:25]

S3 setup_tunnel
[2009-09-21 21:47:25]
using interface tun0

S4 do_phase1_am
[2009-09-21 21:47:25]

S4.1 create_nonce
[2009-09-21 21:47:25]

S4.2 dh setup
[2009-09-21 21:47:25]

S4.3 AM packet_1
[2009-09-21 21:47:25]

S4.4 AM_packet2
[2009-09-21 21:47:25]
(unknown)
(DPD)
IKE SA selected psk-3des-sha1
peer is DPD capable (RFC3706)
NAT status: no NAT-T VID seen

S4.5 AM_packet3
[2009-09-21 21:47:25]

S4.6 cleanup
[2009-09-21 21:47:25]

S5 do_phase2_xauth [1]
[2009-09-21 21:47:25]

S5.1 xauth_request
[2009-09-21 21:47:25]

S5.2 notice_check
[2009-09-21 21:47:25]

S5.3 type-is-xauth check
[2009-09-21 21:47:25]

S5.4 xauth type check
[2009-09-21 21:47:25]

S5.5 do xauth reply
[2009-09-21 21:47:25]

S5.2 notice_check
[2009-09-21 21:47:25]

S5.3 type-is-xauth check
[2009-09-21 21:47:25]

S5.6 process xauth set
[2009-09-21 21:47:25]

S5.8 xauth done
[2009-09-21 21:47:25]

S6 do_phase2_config [1]
[2009-09-21 21:47:25]

S6.2 phase2_config receive modecfg
[2009-09-21 21:47:25]
unknown attribute 6 / 0x6
unknown attribute 16392 / 0x4008
unknown attribute 16395 / 0x400B
unknown attribute 16396 / 0x400C
unknown attribute 16398 / 0x400E
unknown attribute 16397 / 0x400D
unknown attribute 16403 / 0x4013
unknown attribute 16400 / 0x4010
got address 10.137.0.24

S6 do_phase2
[2009-09-21 21:47:25]

do_phase2: S7.5 QM_packet2 check reject offer
[2009-09-21 21:47:25]

do_phase2: S7.6 QM_packet2 check and process proposal
[2009-09-21 21:47:25]
got ipsec lifetime attributes: 28800 seconds
IPSEC SA selected 3des-md5

do_phase2: S7.1 QM_packet1
[2009-09-21 21:47:25]

do_phase2: S7.7 QM_packet3 sent - run script
[2009-09-21 21:47:25]

S7 setup_link (phase 2 + main_loop)
[2009-09-21 21:47:25]

S7.0 run interface setup script
[2009-09-21 21:47:25]

S7.8 setup ipsec tunnel
[2009-09-21 21:47:25]

S7.9 main loop (receive and transmit ipsec packets)
[2009-09-21 21:47:25]
remote -> local spi: 0xa5fe3fb6
local -> remote spi: 0x9304602
VPNC started in foreground...
lifetime status: 0 of 28800 seconds used, 0|0 of 0 kbytes used
got late ike packet: 84 bytes
got r-u-there ack
lifetime status: 5 of 28800 seconds used, 0|0 of 0 kbytes used
lifetime status: 5 of 28800 seconds used, 0|0 of 0 kbytes used
lifetime status: 5 of 28800 seconds used, 0|0 of 0 kbytes used
lifetime status: 5 of 28800 seconds used, 0|0 of 0 kbytes used
lifetime status: 5 of 28800 seconds used, 0|0 of 0 kbytes used
lifetime status: 6 of 28800 seconds used, 0|0 of 0 kbytes used
lifetime status: 7 of 28800 seconds used, 0|0 of 0 kbytes used
lifetime status: 7 of 28800 seconds used, 0|0 of 0 kbytes used
lifetime status: 7 of 28800 seconds used, 0|0 of 0 kbytes used
lifetime status: 7 of 28800 seconds used, 0|0 of 0 kbytes used
lifetime status: 7 of 28800 seconds used, 0|1 of 0 kbytes used
lifetime status: 8 of 28800 seconds used, 0|1 of 0 kbytes used
lifetime status: 8 of 28800 seconds used, 0|1 of 0 kbytes used
lifetime status: 8 of 28800 seconds used, 0|1 of 0 kbytes used
lifetime status: 8 of 28800 seconds used, 0|1 of 0 kbytes used
lifetime status: 8 of 28800 seconds used, 0|1 of 0 kbytes used
lifetime status: 9 of 28800 seconds used, 0|1 of 0 kbytes used
lifetime status: 9 of 28800 seconds used, 0|1 of 0 kbytes used
lifetime status: 9 of 28800 seconds used, 0|1 of 0 kbytes used
lifetime status: 9 of 28800 seconds used, 0|1 of 0 kbytes used
lifetime status: 9 of 28800 seconds used, 0|2 of 0 kbytes used


_______________________________________________
vpnc-devel mailing list
vpnc-devel[at]unix-ag.uni-kl.de
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/


dick at mrns

Sep 22, 2009, 12:31 PM

Post #3 of 6 (588 views)
Permalink
Re: vpnc-nortel can establish connection but doesn't receive any traffic [In reply to]

I did some more debugging and I'm afraid ESP traffic is blocked at the
concentrator. I've tried --natt-mode cisco-udp and --natt-mode force-natt but
vpnc keep sending ESP packets (I found this by using tcpdump).

I'm using the following config:
IPSec gateway 1.2.3.4
IPSec ID 1234
IPSec secret 5678
IKE Authmode gpassword
Xauth username 9012.3456[at]abc.de
Xauth password 7890
Vendor nortel

Could someone please tell me what I'm doing wrong?

Thanks in advance,
Dick

_______________________________________________
vpnc-devel mailing list
vpnc-devel[at]unix-ag.uni-kl.de
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/


borneo.antonio at gmail

Sep 22, 2009, 9:44 PM

Post #4 of 6 (589 views)
Permalink
Re: vpnc-nortel can establish connection but doesn't receive any traffic [In reply to]

Hi,

since vpnc succeed in connecting, this means the concentrator is
configured to accept ESP.
Are you sure ESP is blocked at concentrator and not at your side
(provider, adsl modem, wireless router, firewall, ...)?
Do you have any possibility to test from another internet connection?
Could you try disabling iptables or whatever firewall you have?

Today all the natt options of vpnc are not working and ignored in the
Nortel case.

Best Regards
Antonio Borneo

On Wed, Sep 23, 2009 at 3:31 AM, Dick <dick[at]mrns.nl> wrote:
> I did some more debugging and I'm afraid ESP traffic is blocked at the
> concentrator. I've tried --natt-mode cisco-udp and --natt-mode force-natt but
> vpnc keep sending ESP packets (I found this by using tcpdump).
>
> I'm using the following config:
> IPSec gateway 1.2.3.4
> IPSec ID 1234
> IPSec secret 5678
> IKE Authmode gpassword
> Xauth username 9012.3456[at]abc.de
> Xauth password 7890
> Vendor nortel
>
> Could someone please tell me what I'm doing wrong?
>
> Thanks in advance,
> Dick
>
> _______________________________________________
> vpnc-devel mailing list
> vpnc-devel[at]unix-ag.uni-kl.de
> https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
> http://www.unix-ag.uni-kl.de/~massar/vpnc/
>
_______________________________________________
vpnc-devel mailing list
vpnc-devel[at]unix-ag.uni-kl.de
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/


dick at mrns

Sep 23, 2009, 2:05 AM

Post #5 of 6 (584 views)
Permalink
Re: vpnc-nortel can establish connection but doesn't receive any traffic [In reply to]

Antonio,

Thank you very much for your reply! Can confirm ESP isn't firewalled at the vpnc
side, I've tried hping3 -H 50 -0 1.2.3.4 (from another host) and I can see
incoming ESP packets (by using tcpdump). My next try will be to connect by using
the Windows Nortel client from an un-nat-ed internet connection. I'm wondering
if that connection will fail or keep using UDP/NAT.
Would it be difficult to enable vpnc to use an UDP/NAT connection in the Nortel
case?

Thanks in advance,
Dick

_______________________________________________
vpnc-devel mailing list
vpnc-devel[at]unix-ag.uni-kl.de
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/


dick at mrns

Sep 26, 2009, 12:54 AM

Post #6 of 6 (557 views)
Permalink
Re: vpnc-nortel can establish connection but doesn't receive any traffic [In reply to]

Hi all,

I've tried connecting using the Windows Nortel Client from an un-nat-ed Internet
connection but it keeps using (UDP) NAT Traversal. When I try to firewall all
UDP traffic except dport isakmp the connection is made but no ESP packets are
send. (Windows client tells me it is still using NAT Traversal and the
connection times out)

Would it be difficult to enable vpnc to use an UDP/NAT connection in the Nortel
case?

TIA,
Dick

_______________________________________________
vpnc-devel mailing list
vpnc-devel[at]unix-ag.uni-kl.de
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

vpnc devel RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact lists@gossamer-threads.com
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.