PF + gif + ipsec + racoon + routing problems

Article View: bit.listserv.openbsd-pf

Article #196

Back to bit.listserv.openbsd-pf Previous Next

#196

From: Daniel Duerr
Date: Mon, 13 May 2013 22:04

10 lines
2099 bytes

Hi everyone,

I wrote up a post on the FreeBSD forums about the issue I am having.  It's rather long so I am providing a link to it here: http://forums.freebsd.org/showthread.php?t=39595

In summary, it seems that when the packets are routed in to the gateway from local network hosts, the src and dst addresses are changed to the public IPs of the tunnel -- at least from the perspective of the ipsec stack. This is breaking the ESP encryption in certain cases.  I found a workaround, and while the workaround is fine for scenarios where I control both endpoints, I am trying to integrate a remote endpoint (i.e. Cisco ASA) where I cannot get them to implement an equivalent workaround on their end. Does anyone have any ideas that might help me get ipsec to properly match off of the private src and dst addresses?

(I apologize in advance if I'm breaking a mailing list rule by pointing you all to the forum URL -- I'm somewhat new to the list).

Thanks,
Daniel

Technical Details

Message-ID: <99E08E4E-C0BB-44C7-A08D-18932A8ECB0C@ouido.net>

Path:

arc1-ca.pugleaf.net!p18ni107757wiv.0!nntp.google.com!goblin2!goblin.stu.neva.ru!feeder.erje.net!us.feeder.erje.net!feed.news.qwest.net!mpls-nntp-02.inet.qwest.net!nx02.iad01.newshosting.com!newshosting.com!69.16.185.21.MISMATCH!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn

Show Full Headers

Complete Article Headers

X-Google-Thread: bffa70e3,9572d686d94c86c,start
X-Google-Attributes: gidbffa70e3,public,usenet
X-Google-NewGroupId: yes
X-Google-Language: ENGLISH,ASCII-7-bit
X-Received: by 10.180.10.196 with SMTP id k4mr37277wib.6.1368482681906;
        Mon, 13 May 2013 15:04:41 -0700 (PDT)
Path: arc1-ca.pugleaf.net!p18ni107757wiv.0!nntp.google.com!goblin2!goblin.stu.neva.ru!feeder.erje.net!us.feeder.erje.net!feed.news.qwest.net!mpls-nntp-02.inet.qwest.net!nx02.iad01.newshosting.com!newshosting.com!69.16.185.21.MISMATCH!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn
From: dd@ouido.net (Daniel Duerr)
Newsgroups: bit.listserv.openbsd-pf
Subject: PF + gif + ipsec + racoon + routing problems
Date: 13 May 2013 15:04:40 -0700
Organization: None
Lines: 10
Message-ID: <99E08E4E-C0BB-44C7-A08D-18932A8ECB0C@ouido.net>
NNTP-Posting-Host: c160-dhcp.localdomain
Mime-Version: 1.0 (Mac OS X Mail 6.3 \(1503\))
NNTP-Posting-Date: 13 May 2013 22:04:41 GMT
X-Received-Bytes: 1556
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit