Есть два Линукса, которые являются шлюзоами двух ЛВС.
Сети объеденены GRE туннелем.
Хочу применить ipsec для трафика, который бегает между ЛВС.на первом шлюзе:
flush;
spdflush;
add 192.168.20.1 192.168.9.1 esp 0x201 -m tunnel -E 3des-cbc 0x7aeaca3f87d060a12f4a4487d5a5c3355920fae69a96c831 -A hmac-md5 0xc0291ff014dccdd03874d9e8e4cdf3e6;
add 192.168.9.1 192.168.20.1 esp 0x301 -m tunnel -E 3des-cbc 0xf6ddb555acfd9d77b03ea3843f2653255afe8eb5573965df -A hmac-md5 0x96358c90783bbfa3d7b196ceabe0536b;
spdadd 192.168.20.0/23 192.168.9.0/24 any -P out ipsec esp/tunnel/192.168.20.1-192.168.9.1/require;
spdadd 192.168.20.0/23 192.168.9.1/32 any -P out ipsec esp/tunnel/192.168.20.1-192.168.9.1/require;
spdadd 192.168.20.1/32 192.168.9.1/32 any -P out ipsec esp/tunnel/192.168.20.1-192.168.9.1/require;
spdadd 192.168.20.1/32 192.168.9.0/24 any -P out ipsec esp/tunnel/192.168.20.1-192.168.9.1/require;
spdadd 192.168.9.0/24 192.168.20.0/23 any -P in ipsec esp/tunnel/192.168.9.1-192.168.20.1/require;
spdadd 192.168.9.0/24 192.168.20.1/32 any -P in ipsec esp/tunnel/192.168.9.1-192.168.20.1/require;
spdadd 192.168.9.1/32 192.168.20.0/23 any -P in ipsec esp/tunnel/192.168.9.1-192.168.20.1/require;
spdadd 192.168.9.1/32 192.168.20.1/32 any -P in ipsec esp/tunnel/192.168.9.1-192.168.20.1/require;
на втором:
flush;
spdflush;
add 192.168.20.1 192.168.9.1 esp 0x201 -m tunnel -E 3des-cbc 0x7aeaca3f87d060a12f4a4487d5a5c3355920fae69a96c831 -A hmac-md5 0xc0291ff014dccdd03874d9e8e4cdf3e6;
add 192.168.9.1 192.168.20.1 esp 0x301 -m tunnel -E 3des-cbc 0xf6ddb555acfd9d77b03ea3843f2653255afe8eb5573965df -A hmac-md5 0x96358c90783bbfa3d7b196ceabe0536b;
# Security policies
spdadd 192.168.9.0/24 192.168.20.0/23 any -P out ipsec esp/tunnel/192.168.9.1-192.168.20.1/require;
spdadd 192.168.9.0/24 192.168.20.1/32 any -P out ipsec esp/tunnel/192.168.9.1-192.168.20.1/require;
spdadd 192.168.9.1/32 192.168.20.1/32 any -P out ipsec esp/tunnel/192.168.9.1-192.168.20.1/require;
spdadd 192.168.9.1/32 192.168.20.0/23 any -P out ipsec esp/tunnel/192.168.9.1-192.168.20.1/require;
spdadd 192.168.20.0/23 192.168.9.0/24 any -P in ipsec esp/tunnel/192.168.20.1-192.168.9.1/require;
spdadd 192.168.20.0/23 192.168.9.1/32 any -P in ipsec esp/tunnel/192.168.20.1-192.168.9.1/require;
spdadd 192.168.20.1/32 192.168.9.0/24 any -P in ipsec esp/tunnel/192.168.20.1-192.168.9.1/require;
spdadd 192.168.20.1/32 192.168.9.1/32 any -P in ipsec esp/tunnel/192.168.20.1-192.168.9.1/require;
--------
вывод tcpdump c 1 шлюза:
10:01:10.076296 IP 192.168.9.1 > 192.168.20.1: ESP(spi=0x00000301,seq=0x6c)
10:01:10.076296 IP 192.168.9.1 > 192.168.20.1: icmp 64: echo reply seq 54
10:01:10.129859 IP 192.168.20.1 > 192.168.9.1: ESP(spi=0x00000201,seq=0x6d)
10:01:11.132391 IP 192.168.20.1 > 192.168.9.1: ESP(spi=0x00000201,seq=0x6e)
10:01:11.961762 IP 192.168.9.1 > 192.168.20.1: ESP(spi=0x00000301,seq=0x6e)
10:01:11.961762 IP 192.168.9.1 > 192.168.20.1: icmp 64: echo reply seq 56
10:01:12.142855 IP 192.168.20.1 > 192.168.9.1: ESP(spi=0x00000201,seq=0x6f)
10:01:12.933484 IP 192.168.9.1 > 192.168.20.1: ESP(spi=0x00000301,seq=0x6f)
10:01:12.933484 IP 192.168.9.1 > 192.168.20.1: icmp 64: echo reply seq 57
10:01:13.143354 IP 192.168.20.1 > 192.168.9.1: ESP(spi=0x00000201,seq=0x70)
10:01:13.976598 IP 192.168.9.1 > 192.168.20.1: ESP(spi=0x00000301,seq=0x70)
10:01:13.976598 IP 192.168.9.1 > 192.168.20.1: icmp 64: echo reply seq 58
10:01:14.143725 IP 192.168.20.1 > 192.168.9.1: ESP(spi=0x00000201,seq=0x71)
10:01:14.260912 IP 192.168.9.1 > 192.168.20.1: ESP(spi=0x00000301,seq=0x71)
--------
Вопрос: все ли я правильно сделал?
почему есть не ESP трафик?
Вообще непонятно вот это :
10:01:12.933484 IP 192.168.9.1 > 192.168.20.1: ESP(spi=0x00000301,seq=0x6f)
10:01:12.933484 IP 192.168.9.1 > 192.168.20.1: icmp 64: echo reply seq 57
два пакета в одно итоже время, причем один в ESP другой открыт.
