Internet satellite link.

Internet satellite link.

[Carles Xavier Munyoz Baldó]

Hi,
I have two lilnux boxes with FreeS/WAN and NAT-Traversal compiled in.
One of them is behind a NAT router that connects to the Internet using a 
satellite link, and the other has its own public IP behind a DSL router.

I have tried the connection of the NATed linux box using a DSL router and all 
goes fine, but when I use the satellite link router, I get the errors:
[...]
May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: received
Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]

May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignoring
Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]

May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignori
ng Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]

May  4 13:54:21 FW1 [16116]: "vpn1"[9] 81.47.250.201:1623 #40: responding to 
Main Mode from unknown peer 81.47.250.201:1623

May  4 13:54:22 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40: 
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed

May  4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40: max number 
of retransmissions (2) reached STATE_MAIN_R2

May  4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623: deleting 
connection "vpn1" instance with peer 81.47.250.201 {isakmp=3D#0/ipsec=3D#0}
[...]

I believe that there is no difference between the DSL NAT router and the 
satellite link NAT router, isn't it ?
Which may be the problem ?

Greetings.
---
Carles Xavier Munyoz Baldó
carles@unlimitedmail.org
http://www.unlimitedmail.net/
---

Re: Internet satellite link.

[Alistair Tonner]

On May 5, 2004 05:29 am, Carles Xavier Munyoz Baldó wrote:
> Hi,
> I have two lilnux boxes with FreeS/WAN and NAT-Traversal compiled in.
> One of them is behind a NAT router that connects to the Internet using a
> satellite link, and the other has its own public IP behind a DSL router.
>
> I have tried the connection of the NATed linux box using a DSL router and
> all goes fine, but when I use the satellite link router, I get the errors:
> [...]
> May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: received
> Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
>
> May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignoring
> Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
>
> May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignori
> ng Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
>
> May  4 13:54:21 FW1 [16116]: "vpn1"[9] 81.47.250.201:1623 #40: responding
> to Main Mode from unknown peer 81.47.250.201:1623
>
> May  4 13:54:22 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40:
> NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
>
> May  4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40: max
> number of retransmissions (2) reached STATE_MAIN_R2
>
> May  4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623: deleting
> connection "vpn1" instance with peer 81.47.250.201 {isakmp=3D#0/ipsec=3D#0}
> [...]
>
> I believe that there is no difference between the DSL NAT router and the
> satellite link NAT router, isn't it ?
> Which may be the problem ?

	
	I sincerely doubt the two work identically on a mechanical level, however if 
they are both connected to the iptables hosts with ethernet cable, the 
product should be the same.  Keep in mind that routers/switches between you 
and the internet can indeed mangle/NAT/alter/twist/bend/fold/mutilate packets 
based on their objectives.  As I've been given to understand, this can indeed 
cause havoc with VPN tunnels.  At a guess, the connecting VPN client is 
behind a NAT itself, and -THAT- appears to be the problem -- There are 
FAR more experienced VPN people on this list than I, but I believe that there 
are patches that make this possible.

	Alistair.

	


>
> Greetings.
> ---
> Carles Xavier Munyoz Baldó
> carles@unlimitedmail.org
> http://www.unlimitedmail.net/
> ---

Re: Internet satellite link.

[John A. Sullivan III]

On Wed, 2004-05-05 at 08:43, Alistair Tonner wrote:
> On May 5, 2004 05:29 am, Carles Xavier Munyoz Baldó wrote:
> > Hi,
> > I have two lilnux boxes with FreeS/WAN and NAT-Traversal compiled in.
> > One of them is behind a NAT router that connects to the Internet using a
> > satellite link, and the other has its own public IP behind a DSL router.
> >
> > I have tried the connection of the NATed linux box using a DSL router and
> > all goes fine, but when I use the satellite link router, I get the errors:
> > [...]
> > May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: received
> > Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
> >
> > May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignoring
> > Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
> >
> > May  4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignori
> > ng Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
> >
> > May  4 13:54:21 FW1 [16116]: "vpn1"[9] 81.47.250.201:1623 #40: responding
> > to Main Mode from unknown peer 81.47.250.201:1623
> >
> > May  4 13:54:22 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40:
> > NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
> >
> > May  4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40: max
> > number of retransmissions (2) reached STATE_MAIN_R2
> >
> > May  4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623: deleting
> > connection "vpn1" instance with peer 81.47.250.201 {isakmp=3D#0/ipsec=3D#0}
> > [...]
> >
> > I believe that there is no difference between the DSL NAT router and the
> > satellite link NAT router, isn't it ?
> > Which may be the problem ?
> 
> 	
> 	I sincerely doubt the two work identically on a mechanical level, however if 
> they are both connected to the iptables hosts with ethernet cable, the 
> product should be the same.  Keep in mind that routers/switches between you 
> and the internet can indeed mangle/NAT/alter/twist/bend/fold/mutilate packets 
> based on their objectives.  As I've been given to understand, this can indeed 
> cause havoc with VPN tunnels.  At a guess, the connecting VPN client is 
> behind a NAT itself, and -THAT- appears to be the problem -- There are 
> FAR more experienced VPN people on this list than I, but I believe that there 
> are patches that make this possible.
> 
> 	Alistair.
<snip>
This is probably better posted to one of the *swan mailing lists.  There
are some issues with Satellite but they are usually related to
performance rather than establishing a connection.  There is typically
high latency on a satellite link.  Many satellite providers compensate
for this by spoofing the tcp ACKs (I believe) but since the real packets
cannot be seen in the ESP encapsulation, the spoofing doesn't work and
one must live with the real latency.  This can really kill latency
sensitive (ping-pongy) applications but should not prevent connection.

It would be helpful to see what the logs look like on the other side to
see what the complaints are there - John
> > ---
-- 
John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
john.sullivan@nexusmgmt.com
---
If you are interested in helping to develop a GPL enterprise class
VPN/Firewall/Security device management console, please visit
http://iscs.sourceforge.net