Subject: Re: ipsec tunnels
To: Simas Mockevicius <symka@NetBSD.org>
From: Greg Troxel <gdt@ir.bbn.com>
List: netbsd-help
Date: 03/10/2005 08:45:45
  when I ping from B router C routers internal ip, packets comes to
  C but did'nt back to B, and netstat -p ipsec shows:

  3518 inbound packets with no SA available

Assuming that's on B, it means that IPsec packets arrived and when the
SPI was looked up in the SA database it was not found.

You didn't explain how you were doing key management.
If racoon, use 'setkey -D' to see if the right SAs exist.  If manual,
check for typos in both B and C's /etc/ipsec.conf for the C->B
direction.
Also, run tcpdump and look at the packets and the SPI values.

An issue can be source address selection on the far side in replying
to ICMP.  Typically the 'external' IP addresses aren't covered by the
SPD entries.

I think you'll have to post more details, and investigate further as
suggested above before anyone will be able to help you more.

(If terms are unfamiliar, I suggest you read RFC2401.)
-- 
        Greg Troxel <gdt@ir.bbn.com>