Re: Internet satellite link.

["John A. Sullivan III" <john.sullivan@nexusmgmt.com>]

On Wed, 2004-05-05 at 08:43, Alistair Tonner wrote:
> On May 5, 2004 05:29 am, Carles Xavier Munyoz Baldó wrote:
> > Hi,
> > I have two lilnux boxes with FreeS/WAN and NAT-Traversal compiled in.
> > One of them is behind a NAT router that connects to the Internet using a
> > satellite link, and the other has its own public IP behind a DSL router.
> >
> > I have tried the connection of the NATed linux box using a DSL router and
> > all goes fine, but when I use the satellite link router, I get the errors:
> > [...]
> > May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: received
> > Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
> >
> > May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignoring
> > Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
> >
> > May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignori
> > ng Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
> >
> > May  4 13:54:21 FW1 [16116]: "vpn1"[9] 81.47.250.201:1623 #40: responding
> > to Main Mode from unknown peer 81.47.250.201:1623
> >
> > May  4 13:54:22 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40:
> > NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
> >
> > May  4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40: max
> > number of retransmissions (2) reached STATE_MAIN_R2
> >
> > May  4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623: deleting
> > connection "vpn1" instance with peer 81.47.250.201 {isakmp=3D#0/ipsec=3D#0}
> > [...]
> >
> > I believe that there is no difference between the DSL NAT router and the
> > satellite link NAT router, isn't it ?
> > Which may be the problem ?
> 
> 	
> 	I sincerely doubt the two work identically on a mechanical level, however if 
> they are both connected to the iptables hosts with ethernet cable, the 
> product should be the same.  Keep in mind that routers/switches between you 
> and the internet can indeed mangle/NAT/alter/twist/bend/fold/mutilate packets 
> based on their objectives.  As I've been given to understand, this can indeed 
> cause havoc with VPN tunnels.  At a guess, the connecting VPN client is 
> behind a NAT itself, and -THAT- appears to be the problem -- There are 
> FAR more experienced VPN people on this list than I, but I believe that there 
> are patches that make this possible.
> 
> 	Alistair.
<snip>
This is probably better posted to one of the *swan mailing lists.  There
are some issues with Satellite but they are usually related to
performance rather than establishing a connection.  There is typically
high latency on a satellite link.  Many satellite providers compensate
for this by spoofing the tcp ACKs (I believe) but since the real packets
cannot be seen in the ESP encapsulation, the spoofing doesn't work and
one must live with the real latency.  This can really kill latency
sensitive (ping-pongy) applications but should not prevent connection.

It would be helpful to see what the logs look like on the other side to
see what the complaints are there - John
> > ---
-- 
John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
john.sullivan@nexusmgmt.com
---
If you are interested in helping to develop a GPL enterprise class
VPN/Firewall/Security device management console, please visit
http://iscs.sourceforge.net