
legege at legege
Nov 29, 2009, 9:19 PM
Post #8 of 12
(2423 views)
Permalink
|
|
Re: vpnc-nortel can establish connection but doesn't receive any traffic
[In reply to]
|
|
I've traced in/out packets on my router. Clearly, the VPN gateway is not responding when ESP is used. With the Windows Nortel Client, UDP packets are used. (See below for the trace) Now, the question: How difficult is it to get vpnc-nortel working in NATed mode? Thanks! --- Trace --- 10.100.100.10: My public IP 10.200.200.20: My VPN gateway ==== vpnc-nortel r414 on Linux ==== root [at] ddwr:~# tcpdump -n -i vlan1 | grep 10.200.200.20 00:02:00.854834 IP 10.100.100.10.500 > 10.200.200.20.500: isakmp: phase 1 I agg 00:02:00.954368 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 1 R agg 00:02:01.172691 IP 10.100.100.10.500 > 10.200.200.20.500: isakmp: phase 1 I agg[E] 00:02:01.194171 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 2/others R #6[E] 00:02:01.230531 IP 10.100.100.10.500 > 10.200.200.20.500: isakmp: phase 2/others I #6[E] 00:02:03.231377 IP 10.100.100.10.500 > 10.200.200.20.500: isakmp: phase 2/others I #6[E] 00:02:03.488041 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 2/others ? inf[E] 00:02:03.499181 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 2/others R #6[E] 00:02:03.548139 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 2/others R #6[E] 00:02:03.630286 IP 10.100.100.10.500 > 10.200.200.20.500: isakmp: phase 2/others I #6[E] 00:02:03.679085 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 2/others R oakley-quick[E] 00:02:04.108653 IP 10.100.100.10.500 > 10.200.200.20.500: isakmp: phase 2/others I oakley-quick[E] 00:02:04.162987 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 2/others R oakley-quick[E] 00:02:04.362873 IP 10.100.100.10.500 > 10.200.200.20.500: isakmp: phase 2/others I inf[E] 00:02:04.381353 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 2/others R inf[E] These ESP packets are sent for a ping to an internal IP. 00:02:35.845094 IP 10.100.100.10 > 10.200.200.20: ESP(spi=0x6021d0fa,seq=0x1), length 132 00:02:36.862163 IP 10.100.100.10 > 10.200.200.20: ESP(spi=0x6021d0fa,seq=0x2), length 132 00:02:37.862601 IP 10.100.100.10 > 10.200.200.20: ESP(spi=0x6021d0fa,seq=0x3), length 132 00:02:38.864417 IP 10.100.100.10 > 10.200.200.20: ESP(spi=0x6021d0fa,seq=0x4), length 132 00:02:39.865646 IP 10.100.100.10 > 10.200.200.20: ESP(spi=0x6021d0fa,seq=0x5), length 132 ... 00:02:44.902217 IP 10.100.100.10 > 10.200.200.20: ESP(spi=0x6021d0fa,seq=0xa), length 132 00:07:04.909075 IP 10.200.200.20.500 > 10.200.200.20.500: isakmp: phase 2/others I inf[E] 00:07:04.940858 IP 10.200.200.20.500 > 10.200.200.20.500: isakmp: phase 2/others R inf[E] ==== On Windows ==== root [at] ddwr:~# tcpdump -n -i vlan1 | grep 10.200.200.20 00:13:25.921621 IP 10.100.100.10.500 > 10.200.200.20.500: isakmp: phase 1 I agg 00:13:26.021601 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 1 R agg 00:13:26.090461 IP 10.100.100.10.500 > 10.200.200.20.500: isakmp: phase 1 I agg[E] 00:13:26.110404 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 2/others R #6[E] 00:13:26.114200 IP 10.100.100.10.500 > 10.200.200.20.500: isakmp: phase 2/others I #6[E] 00:13:28.291430 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 2/others R #6[E] 00:13:28.311178 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 2/others R #6[E] 00:13:29.438547 IP 10.100.100.10.500 > 10.200.200.20.500: isakmp: phase 2/others I #6[E] 00:13:29.487780 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 2/others R oakley-quick[E] 00:13:29.578506 IP 10.100.100.10.500 > 10.200.200.20.500: isakmp: phase 2/others I oakley-quick[E] 00:13:29.632277 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 2/others R oakley-quick[E] 00:13:33.861443 IP 10.100.100.10.2041 > 10.200.200.20.10001: UDP, length 124 00:13:34.602744 IP 10.100.100.10.2041 > 10.200.200.20.10001: UDP, length 124 00:13:34.817048 IP 10.100.100.10.2041 > 10.200.200.20.10001: UDP, length 76 ... 00:13:55.706720 IP 10.100.100.10.2041 > 10.200.200.20.10001: UDP, length 100 00:13:55.731153 IP 10.200.200.20.10001 > 10.100.100.10.2041: UDP, length 156 00:14:00.057760 IP 10.100.100.10.500 > 10.200.200.20.500: isakmp: phase 2/others I oakley-quick[E] 00:14:00.076620 IP 10.200.200.20.500 > 10.100.100.10.500: isakmp: phase 2/others R inf[E] -- Georges-Etienne Legendre, Eng. On 2009-11-29, at 10:44 PM, Georges-Etienne Legendre wrote: > I have a similar situation here. Packets are sent, but nothing is received. > > My Internet connection is NATed. > -- > Georges-Etienne Legendre, Eng. > > > > On 2009-09-26, at 3:54 AM, Dick wrote: > >> Hi all, >> >> I've tried connecting using the Windows Nortel Client from an un-nat-ed Internet >> connection but it keeps using (UDP) NAT Traversal. When I try to firewall all >> UDP traffic except dport isakmp the connection is made but no ESP packets are >> send. (Windows client tells me it is still using NAT Traversal and the >> connection times out) >> >> Would it be difficult to enable vpnc to use an UDP/NAT connection in the Nortel >> case? >> >> TIA, >> Dick >> >> _______________________________________________ >> vpnc-devel mailing list >> vpnc-devel [at] unix-ag >> https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel >> http://www.unix-ag.uni-kl.de/~massar/vpnc/ > > > _______________________________________________ > vpnc-devel mailing list > vpnc-devel [at] unix-ag > https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel > http://www.unix-ag.uni-kl.de/~massar/vpnc/ _______________________________________________ vpnc-devel mailing list vpnc-devel [at] unix-ag https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel http://www.unix-ag.uni-kl.de/~massar/vpnc/
|