Дано:
Racoon (Главный 1)
- внешний IP 1.1.1.1
- внутренняя сеть 11.11.11.11
Mikrotik
- внешний IP 2.2.2.2
- внутренняя сеть 22.22.22.22
Задача:
Объеденить сети 11.11.11.11 и 22.22.22.22 IpSec
Решение:
Конфигурация Mikrotik
[admin@MikroTik] /ip ipsec policy> print
1 src-address=22.22.22.0/24
src-port=any
dst-address=11.11.11.0/24
dst-port=any
protocol=ipsec-esp
action=encrypt
level=require
ipsec-protocols=esp
tunnel=yes
sa-src-address=2.2.2.2
sa-dst-address=1.1.1.1
proposal=racoon
priority=0
[admin@MikroTik] /ip ipsec proposal> print
1 name="racoon"
auth-algorithms=sha1
enc-algorithms=blowfish
lifetime=1d
pfs-group=modp614
[admin@MikroTik] /ip ipsec peer> print
0 address=1.1.1.1/32
local-address=2.2.2.2
passive=no
port=500
auth-method=pre-shared-key
secret="pass123"
generate-policy=port-override
policy-template-group=default
exchange-mode=main
send-initial-contact=yes
nat-traversal=yes
proposal-check=obey
hash-algorithm=sha1
enc-algorithm=blowfish
dh-group=modp6144
lifetime=1d
lifebytes=0
dpd-interval=2m
dpd-maximum-failures=5
[admin@MikroTik] /ip firewall filter> print
Flags: X - disabled, I - invalid, D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
1 chain=input action=accept src-address=1.1.1.1 log=no
2 chain=output action=accept dst-address=1.1.1.1 log=no
....
Конфигурация Racoon
# cat /etc/racoon/mikrotik.conf
remote 2.2.2.2 {
#my_identifier address 1.1.1.1;
exchange_mode main;
lifetime time 86400 sec;
proposal_check obey;
initial_contact on;
proposal {
encryption_algorithm blowfish;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group modp6144;
}
generate_policy on;
nat_traversal on;
dpd_delay 120;
dpd_maxfail 5;
}
sainfo address 11.11.11.0/24 any address 22.22.22.0/24 any {
pfs_group modp6144;
encryption_algorithm blowfish;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
lifetime time 86400 sec;
}
#cat /etc/ipsec-tools.d/microtik.conf
flush;
spdflush;
spdadd 11.11.11.0/24 22.22.22.0/24 any -P out ipsec esp/tunnel/1.1.1.-2.2.2.2/require;
spdadd 22.22.22.0/24 11.11.11.0/24 any -P in ipsec esp/tunnel/2.2.2.2-1.1.1.1/require;
# cat /etc/racoon/psk/txt
# mikrotik
2.2.2.2 pass123
# iptables-save |grep 2.2.2.2
-A INPUT -s 2.2.2.2/32 -i ppp0 -p udp -m udp -j ACCEPT
Проблема
Ошибка в Racoon
...
Oct 1 12:51:43 racoon racoon: WARNING: the packet retransmitted in a short time from 2.2.2.2[500]
...
Oct 1 12:51:43 racoon racoon: NOTIFY: the packet is retransmitted by 2.2.2.2[500] (1).
...
