IPSec VPN tunel HITAN problem!!!!imam problem nadam se da mi neko moze pomoci...
naime...
digli smo VPN tunel izmedju naseg linux (mandriva) servera i poslovnog partnera...
sve je lepo radilo dok druga strana nije zatrazila promenu peer IP adrese...
promena je uradjena ali nakon nje tunel je poceo da se 'rusi' nakon odredjenog vremena...
prilazem racoon.conf file gde su podesavanja:
(izmisljene ip adrese)
# Racoon IKE daemon configuration file.
# See 'man racoon.conf' for a description of the format and entries.
path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
# Specification of default various timer.
timer
{
# These value can be changed per remote node.
counter 5; # maximum trying count to send.
interval 20 sec; # maximum interval to resend.
persend 1; # the number of packets per a send.
# timer for waiting to complete each phase.
phase1 90 sec;
phase2 90 sec;
}
{
lifetime time 28800 sec ;
authentication_algorithm hmac_md5;
encryption_algorithm 3des;
compression_algorithm deflate ;
}
remote 123.456.789.0 {
doi ipsec_doi;
situation identity_only;
proposal_check obey;
my_identifier address 0.987.654.321;
exchange_mode main;
initial_contact off;
support_proxy off;
proposal {
encryption_algorithm 3des;
hash_algorithm md5;
authentication_method pre_shared_key;
lifetime time 86400 sec;
dh_group 2;
}
}
buduci da je nastao problem obratio sam se partnerima za pomoc, dobio sam sledeci podatak:
Pretpostavljam da je problem u ne usklajenim vremenima trajanja ipsec sa
odnosno iskmp sa. Za prvu fazu ( ISAKMP SA ) 86400s , a za drugu ( IPSEC
SA ) 28800s. Imate pristup ka serverima (IP ADRESA), (IP ADRESA),
(IP ADRESA) sa vaseg servera koji je ujedno i peer 0.987.654.321.
Transform set 3DES MD5, iskljucen PFS. Polisa za ISAKMP podrazumeva DH
group 2 takodje 3DES i MD5.
moze li neko pomoci?
probao sam da radim ping ka jednom od njihovih servera na svakih 5 min ali nakon 10-20 sati tunel se opet srusi... ponovo proradi nakon pokretanja: setkey -f /etc/ipsec.conf ali to ne traje dugo...
Informišite se... http://www.svest.rs
