7

I'm pretty sure I know the answer to this but I don't know how to implement it.

Trying to setup an ipsec vpn from a Cisco 2811 to a linux box running openswan. So far I can get phase 1 up but phase 2 is having an issue. Its 100% a configuration issue.

What I'm trying to do is push web and some other traffic out the vpn using the internet connection on the other end of that as its gateway to the net. I'm getting cryptomap errors. Here's the setup. 1.1.1.1 being the Cisco. The 2.2.2.2 address is the linux server which only has a single nic.

192.168.x.x/24 ----- 1.1.1.1 -- INTERNET 2.2.2.2 ---->>> Internet

I understand why it can't form the phase 2 tunnel, it can't agree on the map. But I have no idea what the map should be in this case.

I've been testing it with just ICMP for now.

I excluded ICMP from NAT :

ip access-list extended NAT
deny   icmp 192.168.30.0 0.0.0.255 any

Then the "interesting traffic" for the vpn is:

access-list 153 permit icmp 192.168.30.0 0.0.0.255 any

On the openswan side I'm using:

left=2.2.2.2
right=1.1.1.1
rightsubnet=192.168.30.3/24

Well the cisco immediately starts throwing out:

2d11h: map_db_find_best did not find matching map
2d11h: IPSEC(validate_transform_proposal): no IPSEC cryptomap exists for local address 1.1.1.1
2d11h: ISAKMP:(0:26:SW:1): IPSec policy invalidated proposal
2d11h: ISAKMP:(0:26:SW:1): phase 2 SA policy not acceptable! (local 1.1.1.1 remote 2.2.2.2)

I know what I want it to do but I don't know how to set it up. If this were just a simple internal subnet to internal subnet vpn no problem.

Any direction here would be really helpful.

Router config:

version 12.4
service timestamps debug uptime
service timestamps log datetime
service password-encryption
!
hostname Hex-2811
!
boot-start-marker
boot system flash c2800nm-advsecurityk9-mz.124-24.T5.bin
boot-end-marker
!
no logging buffered
aaa new-model
!
!
!
aaa session-id common
clock timezone EST -5
clock summer-time EDT recurring
no ip source-route
!
!
ip cef
!
!
no ip bootp server
ip domain name hexhome.int
ip name-server 192.168.30.8
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
ipv6 unicast-routing
crypto isakmp policy 1
encr aes 192
authentication pre-share
group 5
lifetime 43200
crypto isakmp key ********** address 2.2.2.2
!
!
crypto ipsec transform-set IOFSET2 esp-aes 192 esp-sha-hmac 
!
!
crypto map IOFVPN 1 ipsec-isakmp 
description Isle Of Man
set peer 2.2.2.2
set transform-set IOFSET2 
match address 153
!
! 
!
!
interface FastEthernet0/0
description Internal 192 Network
ip address 192.168.30.1 255.255.255.0
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
duplex full
speed 100
!
interface FastEthernet0/1
ip address dhcp
ip access-group 112 in
no ip redirects
no ip unreachables
ip accounting access-violations
ip nbar protocol-discovery
ip nat outside
ip virtual-reassembly
no ip route-cache cef
no ip mroute-cache
duplex auto
speed auto
no cdp enable
no mop enabled

crypto map IOFVPN
!

ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 174.59.28.1
!
ip flow-export source FastEthernet0/0
ip flow-export version 5
ip flow-export destination 192.168.30.45 3001
no ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000

ip nat inside source route-map POLICY-NAT interface FastEthernet0/1 overload

ip access-list extended NAT
deny   icmp 192.168.30.0 0.0.0.255 any
permit ip any any

access-list 153 permit icmp 192.168.30.0 0.0.0.255 any

route-map POLICY-NAT permit 10
match ip address NAT
!

UPDATE: Fixed the ACL: access-list 153 permit ip 192.168.30.0 0.0.0.255 host 2.2.2.2 and the tunnel comes right up and I can ping through as expected.

Trying to get web traffic through now.. Policy routing not working. I added

route-map VPN_WEB permit 1
match ip address 155
set ip next-hop 2.2.2.2

access-list 155 permit tcp any any eq www

interface FastEthernet0/1
ip address dhcp
ip access-group 112 in
no ip redirects
no ip unreachables
ip accounting access-violations
ip nbar protocol-discovery
ip nat outside
ip virtual-reassembly
no ip route-cache cef
ip policy route-map VPN_WEB
no ip mroute-cache
duplex auto
speed auto
no cdp enable
no mop enabled
crypto map IOFVPN

I can see the route-map match on www traffic but it's not being passed through the tunnel.

  • We can help you more if you post your router configuration. – Ron Trunk Jan 31 '14 at 11:10
  • @Ron I updated with the config. Sorry bout that. – TheEditor Jan 31 '14 at 11:25
  • Openswan is trying to build a tunnel to 1.1.1.1, but there's no corresponding interface address on your router. – Ron Trunk Jan 31 '14 at 12:15
  • @Ron Yes that interface is fa0/1 ( its dhcp but the lease never changes, its a cable connection). – TheEditor Jan 31 '14 at 13:04
  • I think I understand what I'm doing wrong. I can get the tunnel built from 1.1.1.1 to 2.2.2.2. Its my acl thats killing me. Once I build that tunnel then I need to make sure that all port 80 traffic goes over that tunnel. Is that correct. I think I was trying to make it all happen at the same time which won't work, that I'm aware of. Does that sound right? – TheEditor Jan 31 '14 at 13:14
1

I changed the original acl of:

access-list 153 permit icmp 192.168.30.0 0.0.0.255 any

To:

access-list 153 permit icmp 192.168.30.0 0.0.0.255 2.2.2.2 0.0.0.0

As soon as that was changed the maps matched on both ends and the tunnels came up. I've since added an eth0:0 on the openswan side with an address in the 192.168.10.0 range changing the acl to

access-list 153 permit 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255

Tunnel came right up, this just made some things a little easier, now if follows the standard "lan-to-lan" model.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.