tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Testing racoon

I saw your comment, Buck Rogers, when you made the racoon2
package compile again in the 25th century!

I will have some time to debug it and try to find out why IKEv1 isn't
working in the next few weeks. It will probably take me a little
while to learn how to setup the configuration files in racoon2.

I looked at the racoon2 project page. The most recent version is
8 years old. Oh My!


On 06/13/2018 12:22 PM, Christos Zoulas wrote:
On Jun 13, 11:23am, (Chuck Zmudzinski) wrote:
-- Subject: Re: Testing racoon

Thanks for all the feedback and testing!

| The problem was fixed by a reboot of the whole system, and then racoon
| started normally again.

There might be still an issue with buffer space in current, but we explicitly
bumped the limits for syslogd and kernel sockets. I am not sure what went
on here and the ipsec related socket buffers got full.

| I think it would be great to get racoon2 working with IKEv2, so that we
| could
| use NetBSD as a server for built in Windows, ios, and android IKEv2 VPN
| clients. From what I have read so far from Windows support pages and some
| sample configurations of Strongswan IKEv2 VPN servers, it appears those
| clients still use L2TP tunnels, but I think also it is IPsec tunnel
| mode, not
| transport mode as in the case of L2TP/IPsec clients that use IKEv1.
| According to
| RFC 3948, fixing NAT-T in IPsec tunnel mode does not require the
| checksum fix
| but instead requires careful verification of the IP addresses of the
| tunnelled
| traffic.
| I plan on experimenting with the pkgsrc racoon2 with NetBSD current. We
| might need to verify the kernel can implement RFC 3948 for tunnel mode.
| I think it is working now for transport mode, but not yet optimal because of
| the way we are fixing the tcp/udp checksums.

Yes, I'd like that very much too. I got it to compile as I mentioned, but
did not have time to work on it more. Perhaps we should just move it to
a github repository or something and work on it together.


Home | Main Index | Thread Index | Old Index