Testing the installation

Securing and Optimizing Linux: RedHat Edition -A Hands on Guide
Prev | Chapter 25. Linux FreeS/WAN VPN | Next

# 25.10. Testing the installation

Reboot the both gateways to get FreeS/WAN started. Examine the `/var/log/messages` file for any signs of trouble. If all goes well you should see something like this in the `/var/log/messages` file:

    Feb  2 05:22:35 deep ipsec_setup: Starting FreeS/WAN IPSEC snap2000jan31b...
    Feb  2 05:22:35 deep ipsec_setup: KLIPS debug `none'
    Feb  2 05:22:35 deep ipsec_setup: KLIPS ipsec0 on eth0 192.168.1.1/255.255.255.0 broadcast 192.168.1.255
    Feb  2 05:22:36 deep ipsec_setup: Disabling core dumps:
    Feb  2 05:22:36 deep ipsec_setup: Starting Pluto (debug `none'):
    Feb  2 05:22:37 deep ipsec_setup: Loading Pluto database `deep-mail':
    Feb  2 05:22:37 deep ipsec_setup: Enabling Pluto negotiation:
    Feb  2 05:22:37 deep ipsec_setup: Routing for Pluto conns `deep-mail':
    Feb  2 05:22:37 deep ipsec_setup: Initiating Pluto tunnel `deep-mail':
    Feb  2 05:22:39 deep ipsec_setup: 102 "deep-mail" #1: STATE_MAIN_I1: initiate
    Feb  2 05:22:39 deep ipsec_setup: 104 "deep-mail" #1: STATE_MAIN_I2: from STATE_MAIN_I1; sent MI2, expecting MR2
    Feb  2 05:22:39 deep ipsec_setup: 106 "deep-mail" #1: STATE_MAIN_I3: from STATE_MAIN_I2; sent MI3, expecting MR3
    Feb  2 05:22:39 deep ipsec_setup: 004 "deep-mail" #1: STATE_MAIN_I4: SA established
    Feb  2 05:22:39 deep ipsec_setup: 110 "deep-mail" #2: STATE_QUICK_I1: initiate
    Feb  2 05:22:39 deep ipsec_setup: 004 "deep-mail" #2: STATE_QUICK_I2: SA established
    Feb  2 05:22:39 deep ipsec_setup: ...FreeS/WAN IPSEC started

Examine the `/var/log/secure` file for any signs of trouble. If all goes well you should see something like the following:

    Feb 21 14:45:42 deep Pluto[432]: Starting Pluto (FreeS/WAN Version 1.3)
    Feb 21 14:45:43 deep Pluto[432]: added connection description "deep-mail"
    Feb 21 14:45:43 deep Pluto[432]: listening for IKE messages
    Feb 21 14:45:43 deep Pluto[432]: adding interface ipsec0/eth0 192.168.1.1
    Feb 21 14:45:43 deep Pluto[432]: loading secrets from "/etc/ipsec.secrets"
    Feb 21 14:45:43 deep Pluto[432]: "deep-mail" #1: initiating Main Mode
    Feb 21 14:45:44 deep Pluto[432]: "deep-mail" #1: ISAKMP SA established
    Feb 21 14:45:44 deep Pluto[432]: "deep-mail" #2: initiating Quick Mode POLICY_RSASIG+POLICY_ENCRYPT+POLICY_AUTHENTICATE+POLICY_TUNNEL+POLICY_PFS
    Feb 21 14:45:46 deep Pluto[432]: "deep-mail" #2: sent QI2, IPsec SA established
    Feb 21 14:45:47 deep Pluto[432]: "deep-mail" #3: responding to Main Mode
    Feb 21 14:45:49 deep Pluto[432]: "deep-mail" #3: sent MR3, ISAKMP SA established
    Feb 21 14:45:49 deep Pluto[432]: "deep-mail" #4: responding to Quick Mode
    Feb 21 14:45:50 deep Pluto[432]: "deep-mail" #4: IPsec SA established

On both gateways, the following entries should now exist in the `/proc/net/` directory:

    [root@deep] /# ls -l /proc/net/ipsec_*

    -r--r--r--   1 root     root            0 Feb  2 05:30 /proc/net/ipsec_eroute
    -r--r--r--   1 root     root            0 Feb  2 05:30 /proc/net/ipsec_klipsdebug
    -r--r--r--   1 root     root            0 Feb  2 05:30 /proc/net/ipsec_spi
    -r--r--r--   1 root     root            0 Feb  2 05:30 /proc/net/ipsec_spigrp
    -r--r--r--   1 root     root            0 Feb  2 05:30 /proc/net/ipsec_spinew
    -r--r--r--   1 root     root            0 Feb  2 05:30 /proc/net/ipsec_tncfg
    -r--r--r--   1 root     root            0 Feb  2 05:30 /proc/net/ipsec_version

The IPSEC interfaces should be attached on top of the specified physical interfaces. Confirm that with:

    [root@deep] /# cat /proc/net/ipsec_tncfg

    ipsec0 -> eth0 mtu=16260 -> 1500
    ipsec1 -> NULL mtu=0 -> 0
    ipsec2 -> NULL mtu=0 -> 0
    ipsec3 -> NULL mtu=0 -> 0

Now execute the following command to show minimal debugging information and see if the output looks something like this:

    [root@deep] /# ipsec look

    deep.openna.com Fri Feb  4 17:25:17 EST 2000
    ============-============
    192.168.1.1/32     -> 192.168.1.2/32     => tun0x106@192.168.1.2 esp0x4450894d@192.168.1.2 ah0x4450894c@192.168.1.2
    ------------=------------
    ah0x3350f551@192.168.1.1 AH_HMAC_MD5: dir=in ooowin=32 seq=115 bit=0xffffffff alen=128 aklen=16 life(c,s,h)=bytes(16140,0,0)add(51656,0,0)use(54068,0,0)packets(115,0,0) idle=499
    ah0x4450894c@192.168.1.2 AH_HMAC_MD5: dir=out ooowin=32 seq=2828 alen=128 aklen=16 life(c,s,h)=bytes(449488,0,0)add(51656,0,0)use(51656,0,0)packets(2828,0,0) idle=6
    esp0x3350f552@192.168.1.1 ESP_3DES: dir=in ooowin=32 seq=115 bit=0xffffffff eklen=24 life(c,s,h)=bytes(13380,0,0)add(51656,0,0)use(54068,0,0)packets(115,0,0) idle=499
    esp0x4450894d@192.168.1.2 ESP_3DES: dir=out ooowin=32 seq=2828 eklen=24 life(c,s,h)=bytes(381616,0,0)add(51656,0,0)use(51656,0,0)packets(2828,0,0) idle=6
    tun0x105@192.168.1.1 IPIP: dir=in 192.168.1.2 -> 192.168.1.1 life(c,s,h)=add(51656,0,0)
    tun0x106@192.168.1.2 IPIP: dir=out 192.168.1.1 -> 192.168.1.2 life(c,s,h)=bytes(327581,0,0)add(51656,0,0)use(51656,0,0)packets(2828,0,0) idle=6
    192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0
    192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 ipsec0
    192.168.1.1     0.0.0.0         255.255.255.255 UH        0 0          0 eth0
    192.168.1.2     192.168.1.2     255.255.255.255 UGH       0 0          0 ipsec0
    Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface

Try pinging `192.168.1.2` from the `192.168.1.1` client. If this works then you have set it up correctly. If it does not work check your network to make sure `208.164.186.1` can reach `208.164.186.2`, and that TCP-IP forwarding is enabled, and make sure that no firewall rules are blocking the packets, or trying to masquerade them before the rules allowing IPSec related traffic. For this test to work, it is important to use pings that go from one subnet to the other.

      208.164.186.1 ---- 205.151.222.250 ---- 205.151.222.251 ---- 208.164.186.2
      |		   					  |
      192.168.1.0/24     		     			     192.168.1.0/24
      |						          |
      192.168.1.1					  	     192.168.1.2

A last note about testing the installation of FreeSWAN IPSEC, if you encounter a problem that you are unable to resolve, you can use the following command to view a collection of debugging information, contents of files, selections from logs, etc. Anything related to the IPSEC encryption/authentication system that you should send to the Linux-IPSEC Mailing List `<linux-ipsec@clinet.fi>` to help you. Use the following command to make an output of a collection of debugging information:

    [root@deep] /# ipsec barf > result

This command is primarily provided as a convenience for remote debugging; A single command which packages up -and labels all information that might be relevant to diagnosing a problem in IPSEC.

Prev | Home | Next
Required network setup for IPSec | Up | Further documentation