Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to setup IPSec between 2 VM launched by OpenNebula. I'm using OpenSWAN for that. This is the ipsec.conf file

config setup        
    oe=off
    interfaces=%defaultroute
    protostack=klips

conn host-to-host

    left=10.141.0.135 # Local IP address
    connaddrfamily=ipv4
    leftrsasigkey=key
    right=10.141.0.132 # Remote IP address
    rightrsasigkey=key
    ike=aes128 # IKE algorithms (AES cipher)
    esp=aes128 # ESP algorithns (AES cipher)
    auto=add
    pfs=yes
    forceencaps=yes
    type=tunnel

I'm able to establish the connection with netkey but klips doesnt work.

ipsec barf shows

#71: ERROR: asynchronous network error report on eth0 (sport=500) for message to 10.141.0.132 port 500, complainant 10.141.0.135: No route to host [errno 113, origin ICMP type 3 code 1 (not authenticated)]

Tcpdump shows

22:50:20.592685 IP 10.141.0.132.isakmp > 10.141.0.135.isakmp: isakmp: phase 1 I ident
22:50:25.602182 ARP, Request who-has 10.141.0.135 tell 10.141.0.132, length 46
22:50:26.602082 ARP, Request who-has 10.141.0.135 tell 10.141.0.132, length 46
22:50:27.601985 ARP, Request who-has 10.141.0.135 tell 10.141.0.132, length 46

ipsec eroute shows

0          10.141.0.135/32    -> 10.141.0.132/32    => %trap

What could be the problem?

share|improve this question

1 Answer 1

Depending on your kernel you might need a patch. Newer kernels come with NETKEY support by default

To enable only NETKEY use protostack=netkey

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.