On Wed, 2008-11-12 at 13:17 -0800, Julian Elischer wrote: > Stephen Clark wrote: > > Julian Elischer wrote: > > >> you will need to define the setup and question better. > > thanks.. cleaning it up a bit more... > > 10.0.129.1 FreeBSD workstation > ^ > | > | ethernet > | > v > 10.0.128.1 Freebsd FW "A" > ^ > | > | gre / ipsec > | > v > 192.168.3.1 FreeBSD FW "B" > ^ > | > | ethernet > | > v > 192.168.3.86 linux workstation
How are you mapping packets onto the gre? If firewall B doesn't know how to reach the FreeBSD workstation directly, you will see the issue that you describe. Can you ping 10.0.129.1 from Firewall B? The ttl expired will be generated by Firewall B. robert. > > $ sudo traceroute 192.168.3.86 > > traceroute to 192.168.3.86 (192.168.3.86), 64 hops max, 40 byte packets > > 1 HQFirewallRS.com (10.0.128.1) 0.575 ms 0.423 ms 0.173 ms > > 2 * * * > > 3 192.168.3.86 (192.168.3.86) 47.972 ms 45.174 ms 49.968 ms > > > > No response from the FreeBSD "B" box. > > > > When I do a tcpdump on "B" of the gre interface I see UDP packets > > with a TTL of 1 but no ICMP response packets being sent back. > > > > > If I do the traceroute from the linux workstation 192.168.3.86 I get > > similar results - I don't see a response from the FreeBSD "A" box. > > could you try using just GRE encasulation? > (i.e. turn off IPSEC for now) > > I think that is much more likely to be where the problem is.. > > > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "[EMAIL PROTECTED]"
signature.asc
Description: This is a digitally signed message part
