How to make racoon generate security policies for all ports?

Question

I am trying to establish an IPsec connection between two systems. I've got racoon setup on both sides. The client is going to have a dynamic IP address, so on the server, passive and generate_policy are on, and proposal_check is set to obey.

With this setup, the server is generating policies, but they are only for port 500. Because of this none the traffic from the server to the client (except that on port 500) is encapsulated. Since the client has a policy that requires esp, that incoming traffic gets ignored.

I believe the policy gets setup based on the client's sainfo stanza, so I've tried changing the identifier from anonymous to specific addresses with ports, and that's not working.

Server racoon.conf:

remote anonymous
{
        exchange_mode aggressive,main;
        generate_policy on;
        passive on;
        verify_cert off;
        ike_frag on;

        my_identifier address;

        lifetime time 2 min;
        proposal_check obey;

        proposal {
                encryption_algorithm blowfish;
                hash_algorithm sha1;
                authentication_method pre_shared_key;
                dh_group 5 ;
        }
}

sainfo anonymous
{
        pfs_group 5;
        lifetime time 2 min;
        encryption_algorithm blowfish ;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
}

Client racoon.conf

path pre_shared_key "/tmp/psk.txt";

remote 172.16.1.1
{
        exchange_mode aggressive,base,main;
        my_identifier keyid tag "client-test";
        verify_cert off;
        nat_traversal on;
        script "/tmp/phase1-up.sh" phase1_up;
        lifetime time 2 min;
        initial_contact on;
        proposal_check obey;

        proposal {
                encryption_algorithm blowfish;
                hash_algorithm sha1;
                authentication_method pre_shared_key;
                dh_group 5 ;
        }
}

sainfo anonymous
{
        pfs_group 5;
        lifetime time 2 min;
        encryption_algorithm blowfish;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
}

Client policies

#! /usr/sbin/setkey -f
flush;
spdflush;
spdadd 172.16.2.1 172.16.1.1 any -P out ipsec
    esp/transport//require;
spdadd 172.16.1.1 172.16.2.1 any -P in ipsec
    esp/transport//require;

Answer 1

You need the corresponding policy on the server as well. Just replace the in and out on the client policy, put it on the server and it should work fine even with remote anonymous.