Matthias Apitz wrote:
> Philippe WEILL <(E-Mail Removed)> writes:
>
> Thanks for your quick and kind answer;
>
>
>>Matthias Apitz wrote:
>>
> ...
>
>>>1.
>>>All IPsec pages I've read, for example in Google, to bring IPsec
>>>through a firewall say something about the UDP 500 port but also
>>>about two more protocols 50 (ESP) and 51 (AH); I thought I will
>>>never get IPsec to work with my type of firewall because I've no
>>>idea how to bring ESP and AH through; but it works without these
>>>and I also can't see any traffic for these protocols in the tcpdump
>>>below; can someone bring a bit light into it?
>>>
>
>
>>When you have NAT it use udp on port 4500 ( Ipsec Nat Traversal ) for
>>transport and not ESP ( Encapsulated Security Payload ) or AH (
>>Authentication Header)
>
>
> On my site there is no router-NAT involved; the VPNclient is connecting
> the inner NIC of my firewall and 'udprelay' put all UDP 500 and 4500
> to the remote side. I don't have any information about the remote
> end. In the config file of the VPNclient there is a line saying:
>
> EnableNat=1
This line say that the client should use ESP encapsulation over UDP
http://www.osronline.com/ddkx/network/209offl_4tev.htm
>
> perhaps this triggers the use of NAT by the VPNclient; after establishing
> the VPN it says something like:
This line say that the client should use ESP encapsulation over UDP
this setup allow ipsec to work over most network setup you could find
for the client
>
> VPN tunnel information.
> Client address: xxx.xxx.xxx.xxx
> Server address: 193.31.10.90
>
> and xxx.xxx.xxx.xxx belongs to the same class-C network as the real
> remote destination; but I can't see any interface or any routing
> localy;
>
>
>>>3.
>>>The tcpdump shows the startup of the VPN and later I was pinging
>>>an addr over there:
>>>
>>>- What kind of package are these 'isakmp'?
>
>
>>ISAKMP is used for Key exange
>
>
> I've read a the docs of FreeS/WAN and it seems that ESP and AH
> can be tunneled through UDP 500 and the daemon 'pluto' of FreeS/WAN
> is doing that;
>
> This is my main concern: Will it be enough for FreeS/WAN to have
> UDP 500 open to the remote side?
it's depend on the config
>
>
>>>- When I do the ping for the addr xxx.xxx.xxx.xxx at remote site,
>>> I can see the outgoing pkg as ICMP and the incoming as UDP on
>>> port 4500, why I can't see both ICMP and both UDP (as result of
>>> the transport of the ICMP in IPsec tunnel)?
>
>
>>to see traffic in the tunnel you need to make your tcpdump on the tunnel
>>interface (ipsec0) not on the real interface
in cisco client it's perhaps tun0
>
>
> I don't have an interface ipsec0
>
> matthias
When you have work with ipsec, you find after that OpenVPN is a great
thing ;-)
Similar Threads
Linear Mode
