On Wed, 2008-09-24 at 12:24 -0300, Matheus Cucoloto wrote: > Bom dia. > > Estou erguendo uma VPN com Ipsec usando ISAKMP. O Cenário é: > > FreeBSD(ISAKMP) -> CheckPoint > > O que foi definido: > > Fase1: > Cripto AES256 > Hash: sha1 > > Fase2 > Cripto: AES128 > Hash: md5 > > Chave=123456 > > Rede1= 192.168.254.0 > Rede2= 192.168.210.0 > > Peer Freebsd=100.1.1.1 > Peer CheckPoint=100.1.1.2 > > Analisando os pacotes com tcpdump o checkpoint me manda o seguinte: > > -------------------------------------------------------------------------------------------------- > > 12:04:07.792500 00:19:e0:73:9b:0a > 00:00:5e:00:01:0b, ethertype IPv4 > (0x0800), length 174: (tos 0x0, ttl 60, id 61431, offset 0, flags > [DF], proto: UDP (17), length: 160) 100.1.1.2.500 > 100.1.1.1.500: > [udp sum ok] isakmp 1.0 msgid cookie ->: phase 1 I ident: > (sa: doi=ipsec situation=identity > (p: #1 protoid=isakmp transform=1 > (t: #1 id=ike (type=enc value=aes)(type=keylen > value=0100)(type=hash value=sha1)(type=auth > value=preshared)(type=group desc value=modp1024)(type=lifetype > value=sec)(type=lifeduration len=4 value=00015180)))) > (vid: len=40 > f4ed19e0c114eb516faaac0ee37daf2807b4381f000000010000138d48da54a20000000018200000) > > -------------------------------------------------------------------------------------------------- > > E o FreeBSD retorna: > > -------------------------------------------------------------------------------------------------- > > 11:57:35.663230 00:60:97:0c:5d:10 > 00:00:5e:00:01:0a, ethertype IPv4 > (0x0800), length 82: (tos 0x0, ttl 64, id 47232, offset 0, flags > [none], proto: UDP (17), length: 68) 100.1.1.1.500 > 100.1.1.2..500: > [udp sum ok] isakmp 1.0 msgid cookie ->: phase 1 I inf: > (n: doi=ipsec proto=isakmp type=NO-PROPOSAL-CHOSEN) > > -------------------------------------------------------------------------------------------------- > > No Debug do ISAKMP eu tenho apenas o seguinte: > > -------------------------------------------------------------------------------------------------- > 115703.724192 Default dropped message from 100.1.1.2 port 500 due to > notification type NO_PROPOSAL_CHOSEN > -------------------------------------------------------------------------------------------------- > > O que tem de errado?????? > > Vejam as minhas configurações: > > -------------------------------------------------------------------------------------------------- > # cat isakmpd.conf > Retransmits= 5 > Exchange-max-time= 120 > Listen-on= 100.1.1.1 > > [Phase 1] > 100.1.1.2= ISAKMP-peer-checkpoint > > [ISAKMP-peer-checkpoint] > Phase= 1 > Transport= udp > Local-address= 100.1.1.1 > Address= 100.1.1.2 > Configuration= Conf-fase1 > Authentication= 123456 > > [Phase 2] > Connections= VPN-freebsd-checkpoint > > [VPN-freebsd-checkpoint] > Phase= 2 > ISAKMP-peer= ISAKMP-peer-checkpoint > Configuration= Conf-fase2 > Local-ID= rede-freebsd-192.168.254.0/255.255.255.0 > Remote-ID= rede-checkpoint-192.168.210.0/255.255.255.0 > > [rede-freebsd-192.168.254.0/255.255.255.0] > ID-type= IPV4_ADDR_SUBNET > Network= 192.168.254.0 > Netmask= 255.255.255.0 > > [rede-checkpoint-192.168.210.0/255.255.255.0] > ID-type= IPV4_ADDR_SUBNET > Network= 192.168.210.0 > Netmask= 255.255.255.0 > > [Conf-fase1] > DOI= IPSEC > EXCHANGE_TYPE= ID_PROT > Transforms= CRIPTO-FASE1 > > [Conf-fase2] > DOI= IPSEC > EXCHANGE_TYPE= QUICK_MODE > Suites= QM-ESP-AES-MD5-PFS-SUITE > > [CRIPTO-FASE1] > ENCRYPTION_ALGORITHM= AES > HASH_ALGORITHM= SHA > AUTHENTICATION_METHOD= PRESHARED > GROUP_DESCRIPTION= modp1024 > Life= TEMPO > > [TEMPO] > LIFE_TYPE= SECONDS > LIFE_DURATION= 86400,79200:93600 > -------------------------------------------------------------------------------------------------- > > > > -- > Matheus Cucoloto > System Admin. > Net Admin. > ------------------------- > Histórico: http://www.fug.com.br/historico/html/freebsd/ > Sair da lista: https://www.fug.com.br/mailman/listinfo/freebsd
Matheus, Voce tem que usar o mesmo esquema de criptografia em ambos os lados, bem como a psk. A mensagem "NO_PROPOSAL_CHOSEN" esta informando que as propostas de criptografia ou informacoes de rede configuradas em uma das pontas nao conferem. Informe, se possivel, as configuracoes do VPN1 e compare os timers, eles tambem influenciam no start da VPN. []s Sergio Lima ------------------------- Histórico: http://www.fug.com.br/historico/html/freebsd/ Sair da lista: https://www.fug.com.br/mailman/listinfo/freebsd
