I'm creating an IPSec tunnel from a Linux box to a SonicWall firewall running standard firmware. The tunnel seems to be getting created just fine, but packets from the Linux box to the remote network are not being routed into the tunnel. Packets from the remote network seem to be fine. Attempts to ping from the Linux box to the secure remote network get routed via the normal routing table.
Looking at the routing table and cache, there are no entries for 192.168.1.0 (the remote network). My expectation from the docs is that the tunnel policy would insert the route.
Any ideas appriciated.
Here's my conf script:
#!/sbin/setkey -f # Configuration for 172.16.89.100 # Flush the SAD and SPD flush; spdflush; add 172.16.89.100 172.20.241.2 ah 0x200 -m tunnel -A hmac-sha1 0xredacted00000000000000000000000000000000; add 172.20.241.2 172.16.89.100 ah 0x300 -m tunnel -A hmac-sha1 0xredacted00000000000000000000000000000000; add 172.16.89.100 172.20.241.2 esp 0x201 -m tunnel -E 3des-cbc 0xredacted0000000000000000000000000000000000000000; add 172.20.241.2 172.16.89.100 esp 0x301 -m tunnel -E 3des-cbc 0xredacted0000000000000000000000000000000000000000; # Security policies spdadd 10.114.89.0/24 192.168.1.0/24 any -P out ipsec esp/tunnel/172.16.89.100-172.20.241.2/require ah/tunnel/172.16.89.100-172.20.241.2/require; spdadd 192.168.1.0/24 10.114.89.0/24 any -P in ipsec esp/tunnel/172.20.241.2-172.16.89.100/require ah/tunnel/172.20.241.2-172.16.89.100/require; #Forward Policy #DOH! iptools > 0.5 do this automatically. #spdadd 192.168.1.0/24 10.114.89.0/24 any -P fwd ipsec # esp/tunnel/172.20.241.2-172.16.89.100/require # ah/tunnel/172.20.241.2-172.16.89.100/require;