Re: IPSec troubles

2004-04-02 Thread Richard Bejtlich
Hello, This thread has been very helpful. I'm using FreeBSD 5.2.1 REL with kernels recompiled to support IPSEC. I've found the "trick" to exclude port 500 UDP packets allows ISAKMP traffic to be exchanged, e.g: spdadd 192.168.20.1[500] 192.168.21.1[500] udp -P out none; spdadd 192.168.21.1[500]

Re: IPSec troubles

2004-03-30 Thread Crist J. Clark
On Tue, Mar 30, 2004 at 11:22:08AM +, Bjoern A. Zeeb wrote: > On Mon, 29 Mar 2004, Crist J. Clark wrote: > > > > I have troubles setting up an IPSec Host-to-Host connection between > > > FreeBSD 5.2.1 and MacOS X 10.3.3: > > > > Last I knew, 5.2.1 still had broken IPsec. Specifically, the syst

Re: IPSec troubles

2004-03-30 Thread Bjoern A. Zeeb
On Tue, 30 Mar 2004, Hajimu UMEMOTO wrote: > > On Tue, 30 Mar 2004 13:15:34 + (UTC) > > "Bjoern A. Zeeb" <[EMAIL PROTECTED]> said: > > bzeeb> just for the archives (and to let me sleep well again ;-) can you > bzeeb> please point me to the commit in question ? > > Okay, the commits are

Re: IPSec troubles

2004-03-30 Thread Hajimu UMEMOTO
Hi, > On Tue, 30 Mar 2004 13:15:34 + (UTC) > "Bjoern A. Zeeb" <[EMAIL PROTECTED]> said: bzeeb> just for the archives (and to let me sleep well again ;-) can you bzeeb> please point me to the commit in question ? Okay, the commits are: src/sys/netinet/ip_output.c 1.205

Re: IPSec troubles

2004-03-30 Thread Bjoern A. Zeeb
On Tue, 30 Mar 2004, Hajimu UMEMOTO wrote: Hi, > > On Tue, 30 Mar 2004 12:33:08 + (UTC) > > "Bjoern A. Zeeb" <[EMAIL PROTECTED]> said: > > bzeeb> What I had to do had been "excluding IKE traffic" by doing s.th. > bzeeb> like this (router side config): > bzeeb> spdadd ROUTER[500] NOT

Re: IPSec troubles

2004-03-30 Thread Hajimu UMEMOTO
Hi, > On Tue, 30 Mar 2004 12:33:08 + (UTC) > "Bjoern A. Zeeb" <[EMAIL PROTECTED]> said: bzeeb> What I had to do had been "excluding IKE traffic" by doing s.th. bzeeb> like this (router side config): bzeeb> spdadd ROUTER[500] NOTEBOOK[500] udp bzeeb> -P out none ; bzeeb> spda

Re: IPSec troubles

2004-03-30 Thread Bjoern A. Zeeb
On Tue, 30 Mar 2004, Cyrill Rüttimann wrote: Hi, > > If this is the remaining problem apart from the yet known (where KAME > > people cannot find the time to review at the moment) I may look into > > this; have setup my wireless connection on a 5.2.1 notebook (being > > updated to HEAD soon) to u

Re: IPSec troubles

2004-03-30 Thread Cyrill Rüttimann
Hello, If this is the remaining problem apart from the yet known (where KAME people cannot find the time to review at the moment) I may look into this; have setup my wireless connection on a 5.2.1 notebook (being updated to HEAD soon) to use IPSec lately so I have a 'testbed' now. Please can you

Re: IPSec troubles

2004-03-30 Thread Bjoern A. Zeeb
On Mon, 29 Mar 2004, Crist J. Clark wrote: > > I have troubles setting up an IPSec Host-to-Host connection between > > FreeBSD 5.2.1 and MacOS X 10.3.3: > > Last I knew, 5.2.1 still had broken IPsec. Specifically, the system > tries to apply the IPsec policy to the IKE traffic giving us a chicken

Re: IPSec troubles

2004-03-29 Thread Crist J. Clark
On Mon, Mar 29, 2004 at 12:06:21AM +0200, Cyrill R?ttimann wrote: > Hello, > > I have troubles setting up an IPSec Host-to-Host connection between > FreeBSD 5.2.1 and MacOS X 10.3.3: Last I knew, 5.2.1 still had broken IPsec. Specifically, the system tries to apply the IPsec policy to the IKE tr

IPSec troubles

2004-03-28 Thread Cyrill Rüttimann
Hello, I have troubles setting up an IPSec Host-to-Host connection between FreeBSD 5.2.1 and MacOS X 10.3.3: Network Setup: Cable-Modem-->FreeBSD Box, 192.168.0.1-->Apple Airport Station running in Bridge Mode-->MacOS X Box, 192.168.0.10 /etc/ipsec.conf (FreeBSD) spdadd 192.168.0.1/24 192.16