Re: Internet satellite link.

[Alistair Tonner <Alistair@nerdnet.ca>]

On May 5, 2004 05:29 am, Carles Xavier Munyoz Baldó wrote:
> Hi,
> I have two lilnux boxes with FreeS/WAN and NAT-Traversal compiled in.
> One of them is behind a NAT router that connects to the Internet using a
> satellite link, and the other has its own public IP behind a DSL router.
>
> I have tried the connection of the NATed linux box using a DSL router and
> all goes fine, but when I use the satellite link router, I get the errors:
> [...]
> May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: received
> Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
>
> May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignoring
> Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
>
> May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignori
> ng Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
>
> May  4 13:54:21 FW1 [16116]: "vpn1"[9] 81.47.250.201:1623 #40: responding
> to Main Mode from unknown peer 81.47.250.201:1623
>
> May  4 13:54:22 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40:
> NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
>
> May  4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40: max
> number of retransmissions (2) reached STATE_MAIN_R2
>
> May  4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623: deleting
> connection "vpn1" instance with peer 81.47.250.201 {isakmp=3D#0/ipsec=3D#0}
> [...]
>
> I believe that there is no difference between the DSL NAT router and the
> satellite link NAT router, isn't it ?
> Which may be the problem ?

	
	I sincerely doubt the two work identically on a mechanical level, however if 
they are both connected to the iptables hosts with ethernet cable, the 
product should be the same.  Keep in mind that routers/switches between you 
and the internet can indeed mangle/NAT/alter/twist/bend/fold/mutilate packets 
based on their objectives.  As I've been given to understand, this can indeed 
cause havoc with VPN tunnels.  At a guess, the connecting VPN client is 
behind a NAT itself, and -THAT- appears to be the problem -- There are 
FAR more experienced VPN people on this list than I, but I believe that there 
are patches that make this possible.

	Alistair.

	


>
> Greetings.
> ---
> Carles Xavier Munyoz Baldó
> carles@unlimitedmail.org
> http://www.unlimitedmail.net/
> ---