PF + gif + ipsec + racoon + routing problems

Thread View: bit.listserv.openbsd-pf

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by ECEG / Daniel Duerr Mon, 13 May 2013 22:07

#197

Author: ECEG / Daniel Duerr
Date: Mon, 13 May 2013 22:07

10 lines
1959 bytes

Hi everyone,

I wrote up a post on the FreeBSD forums about the issue I am having.  It's rather long so I am providing a link to it here: http://forums.freebsd.org/showthread.php?t=39595

In summary, it seems that when the packets are routed in to the gateway from local network hosts, the src and dst addresses are changed to the public IPs of the tunnel -- at least from the perspective of the ipsec stack. This is breaking the ESP encryption in certain cases.  I found a workaround, and while the workaround is fine for scenarios where I control both endpoints, I am trying to integrate a remote endpoint (i.e. Cisco ASA) where I cannot get them to implement an equivalent workaround on their end. Does anyone have any ideas that might help me get ipsec to properly match off of the private src and dst addresses?

(I apologize in advance if I'm breaking a mailing list rule by pointing you all to the forum URL -- I'm somewhat new to the list).

Thanks,
Daniel

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads