Michael Robinson wrote: > > >2) What kind of key generation do I need for pipsecd? > > I use: > > % cat /dev/random | od -X I should then be using a 30-character octal random string, yes? I had to use urandom. > That gives you one key per line, once you remove the formatting. I assume you mean the tabs, which gives 1 40-char octal string per line. > pipsecd uses symmetric keys for security associations (if you've ever used > RADIUS secrets, it's the same sort of thing). So, the same octal string needs to be used on each side, for auth, right? > >4) Have any of you used pipsecd? Good? Bad? Ugly? > > Fantastic, great, but almost completely undocumented. Once you figure it out, > though, it works flawlessly (at least under FreeBSD 3.x). I will be writing a HOWTO (for the clueless, like me) once I get this working. > It's the way to go. If your PPP addresses come out of a pool, you have to > use the magic "0.0.0.0" address, which means "whatever the real ip address > of the interface happens to be right now". I am using static on both ends. > The other thing you need to know is that the destination IP address for > remote entries floats automatically: > > >sa ipah spi=1000 auth=hmac-md5-96 akey=0102030405060708090a0b0c0d0e0f > dest=1.2.3.4 > > So, for this Security Parameter Index (spi), if pipsecd receives an > Encapsulating Security Payload (esp) packet from a remote host that > authenticates against this key, it will replace the old destinatation address > with the new IP address (instead of 1.2.3.4). If the keepalive fails, then > it will revert to the old destination address. > > So, you need at least one system in your VPN that has a known IP address. > All the floating IP's connect to the fixed IP address, using it as a hub. > > You then set up the routing accordingly. ok, what we are doing is NATing 2 private networks, so this will be set up on the NAT boxes. 192.168.2.x->nat-<-->Internet<-->-nat<-10.x.x.x Here's the error I am seeing: Nov 10 13:45:26 fornax pipsecd[488]: pipsecd starting Nov 10 13:45:26 fornax pipsecd[488]: local address for 63.195.71.106 is 209.24.64.3 Nov 10 13:45:26 fornax pipsecd[488]: local address for 63.195.71.106 is 209.24.64.3 Nov 10 13:45:28 fornax pipsecd[488]: HMAC mismatch from 63.195.71.106 And the config files (note: [STRINGx] is actually a 30-char octal string...) -- HOST 1 -- sa ipah spi=1000 auth=hmac-md5-96 akey=[STRING1] dest=[HOST2] sa ipah spi=1000 auth=hmac-md5-96 akey=[STRING2] if /dev/tun0 local_spi=1000 remote_spi=1000 -- HOST 1 -- -- HOST 2 -- sa ipah spi=1000 auth=hmac-md5-96 akey=[STRING1] dest=[HOST1] sa ipah spi=1000 auth=hmac-md5-96 akey=[STRING2] if /dev/tun0 local_spi=1000 remote_spi=1000 -- HOST 2 -- I also tried swapping strings on one of the config files, and using the same string in all 4 fields. I am now trying with ipesp. Thanks a lot for all your help. -- Brian Nelson Network Minion mailto:[EMAIL PROTECTED] PocketScience, Inc. * I believe the technical term is "Oops!"
begin:vcard n:Nelson;Brian x-mozilla-html:FALSE org:PocketScience, Inc;Network Operations adr:;;;;;; version:2.1 email;internet:[EMAIL PROTECTED] title:Network Daemon x-mozilla-cpt:;0 fn:Brian Nelson end:vcard
