Ok I have 2 Astaro 4 boxes and am trying to establish network connectivity.... It seems as both the hosts have established IPSec after IKE... Routing looks right, I cannot for the life of me figure out why I cannot connect from 172.16.1.0/24 to 172.16.2.0/24 or vice-versa
I have tried it with NAT Traversal and without.... connectivity looks like its set up but i can't ping anything between the segments.
Under IPsec connections I have the following
Standard 3Des
EndPoint Def
WAN ==> Home
Subnet Def
LAN(172.16.1.0/24) ===> Home (172.16.2.0/24)
Authentication PSK
000
000 "default_1": 172.16.1.0/24===x.x.x.x...y.y.y.y===172.16.2.0/24
000 "default_1": ike_life: 7800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "default_1": policy: PSK+ENCRYPT+TUNNEL; interface: eth1; erouted
000 "default_1": newest ISAKMP SA: #7; newest IPsec SA: #10; eroute owner: #10
000 "default_1": IKE algorithms wanted: 5_000-1-5, flags=-strict
000 "default_1": IKE algorithms found: 5_192-1_128-5,
000 "default_1": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1536 (extension)
000 "default_1": ESP algorithms wanted: 3_000-1, ; pfsgroup=2; flags=-strict
000 "default_1": ESP algorithms loaded: 3_168-1_128,
000 "default_1": ESP algorithm newest: 3DES_0-HMAC_MD5; pfsgroup=
000
000 #9: "default_1" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 2701s
000 #9: "default_1" esp.7adbacea@x.x.x.x esp.4c1123fa@x.x.x.x tun.1006@x.x.x.x tun.1005@y.y.y.y
000 #8: "default_1" STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 6901s
000 #10: "default_1" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 2384s; newest IPSEC; eroute owner
000 #10: "default_1" esp.7adbaceb@x.x.x.x esp.4c1123fb@x.x.x.x tun.1008@x.x.x.x tun.1007@y.y.y.y
000 #7: "default_1" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 6406s; newest ISAKMP
000
Routing 172.16.1.0/24 -> 172.16.2.0/24 => tun0x1008@x.x.x.x
Packet Filter is
LAN Any remote_lan Allow
remote_lan Any LAN Allow
The 2nd Hosts config is
Standard 3Des
EndPoint Def
Wan ==> remote
Subnet Def
LAN(172.16.2.0/24) ===> Remote (172.16.2.0/24)
Authentication PSK
000
000 "default_1": 172.16.2.0/24===y.y.y.y...x.x.x.x===172.16.1.0/24
000 "default_1": ike_life: 7800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "default_1": policy: PSK+ENCRYPT+TUNNEL; interface: eth1; erouted
000 "default_1": newest ISAKMP SA: #3; newest IPsec SA: #4; eroute owner: #4
000 "default_1": IKE algorithms wanted: 5_000-1-5, flags=-strict
000 "default_1": IKE algorithms found: 5_192-1_128-5,
000 "default_1": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1536 (extension)
000 "default_1": ESP algorithms wanted: 3_000-1, flags=-strict
000 "default_1": ESP algorithms loaded: 3_168-1_128,
000 "default_1": ESP algorithm newest: 3DES_0-HMAC_MD5; pfsgroup=
000
000 #2: "default_1" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 1556s
000 #2: "default_1" esp.4c1123fa@x.x.x.x esp.7adbacea@y.y.y.y tun.1002@x.x.x.x tun.1001@y.y.y.y
000 #1: "default_1" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 5427s
000 #4: "default_1" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 2033s; newest IPSEC; eroute owner
000 #4: "default_1" esp.4c1123fb@y.y.y.y esp.7adbaceb@24.90.212.9 tun.1004@y.y.y.y tun.1003@x.x.x.x
000 #3: "default_1" STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 6233s; newest ISAKMP
000
Routing
0 172.16.2.0/24 -> 172.16.1.0/24 => tun0x1004@y.y.y.y
Packet Filter
LAN Any remote_lan Allow edit del move
remote_lan Any LAN Allow
This thread was automatically locked due to age.
