1

I have two system with fedora12 installed

  • Host1 IP address - 10.1.0.1
  • Host2 IP address - 10.1.0.2

Then configured IPsec in both machines as below Host 1 config (/etc/ipsec-tools.conf)

#Host 1 /etc/ipsec-tools.conf
# Flush the SAD(security association db) and SPD(security policy db) to remove previous entries
flush;
spdflush;

# ESP SAs
add 10.1.0.1 10.1.0.2 esp 0x201 -E 3des-cbc 
            0x7aeaca3f87d060a12f4a4487d5a5c3355920fae69a96c831;
add 10.1.0.2 10.1.0.1 esp 0x301 -E 3des-cbc 
            0xf6ddb555acfd9d77b03ea3843f2653255afe8eb5573965df;

# Security policies
spdadd 10.1.0.1 10.1.0.2 any -P out ipsec
           esp/transport//require;

spdadd 10.1.0.2 10.1.0.1 any -P in ipsec
           esp/transport//require;

In system two

#Host 2 /etc/ipsec-tools.conf
# Flush the SAD(security association db) and SPD(security policy db) to remove previous entries
flush;
spdflush;

# ESP SAs
add 10.1.0.1 10.1.0.2 esp 0x201 -E 3des-cbc 
            0x7aeaca3f87d060a12f4a4487d5a5c3355920fae69a96c831;
add 10.1.0.2 10.1.0.1 esp 0x301 -E 3des-cbc 
            0xf6ddb555acfd9d77b03ea3843f2653255afe8eb5573965df;

# Security policies
spdadd 10.1.0.2 10.1.0.1 any -P in ipsec
           esp/transport//require;

spdadd 10.1.0.1 10.1.0.2 any -P out ipsec
           esp/transport//require;

Try to ping from h1 to h2 ( ping does not work, gets stuck and I could see the packet loss). If the spd is removed the ping works successfully.

Can you please advise me where I am going wrong?

  • Maybe you should try your setup with different subnets so it will be easier to understand what is going on. – Nikolai Apr 16 '15 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.