Darrell, I have setup a basic test environment:
LAN1 192.168.0.65 | 192.168.0.1 SME1 (server) 203.132.1.2 | 203.132.1.1 ROUTER (quasi internet)->10.x.x.x (main LAN)->main SME->inet 203.132.2.1 | 203.132.2.2 SME2 (client) 192.168.1.1 | 192.168.1.65 LAN2 All IPs are static except for the 2 LAN machines which are servered by the relevant SME's DHCP. I can ping from LAN1 all the way to SME2 (203.132.2.2) I can ping from LAN2 all the way to SME1 (203.132.1.2) The ROUTER is NATed between the 10.x.x.x I/F and the other 2. I can get to the internet from the complete test setup. Our goal is to be able to ping from LAN1 to LAN2 and v/v using IPSec as the encrypted tunnel. Having setup the two SMEs as outlined below .... I have no ability to ping (yet) Both SMEs are upgraded with SP2 via the Blade interface Both SMEs have dmc-mitel-ipsec ..... rpm installed. The IPSec config of SME1 is: Remote network 192.168.1.0 Remote router internal IP address: 192.168.1.1 Remote router internal subnet mask 255.255.255.0 Remote router external IP address: 203.132.2.2 Remote router's default gateway IP address: 203.132.2.1 Remote gateway's public encryption key: 0x0103b0e7f3484059d610272c13390f40aadc52883537bab7a49ab9ecc1a6358aca71fcf7cb 420154c4757d6af0cd45aca3ee499a9d0c0049c5906f01f4d1a0a62c59d75aa97d6ef2a7ac58 1c1eea5f2459d43c8f975c0c039a3e09162ffa207d23eb40e76abec7277307f71b1f238ed919 ce01de270bb316208aa2c04a68eb2a2cdc356b49f3e64e5dc008d735390b1ee260a9aa407aba 35e1e59b63e6b9ee6514d2efa808a85f9e8343e7d019109175a121685bf5ec6d3083adc8a2a6 08e9aa3daba8c338b32465dfc5fa9df54a3764c76cd29b601d19af585a337dac734a5d0e655a 4dde36389fce0335dc12921a6b3d33af5f912aae5f100b7cc8897bcbb493b5 Remote network NAT'ed: yes Protect Network to Network traffic: yes Protect Gateway to Gateway traffic: yes Protect Gateway to Network traffic: yes Local machine acts as: server The IPSec config of SME2 is: Remote network 192.168.0.0 Remote router internal IP address: 192.168.0.1 Remote router internal subnet mask 255.255.255.0 Remote router external IP address: 203.132.1.2 Remote router's default gateway IP address: 203.132.1.1 Remote gateway's public encryption key: 0x0103bcbaed2615d8022c33d567ce5942e742c86fe25e11a756381a9b8d04a2c25002995aa3 a230bbd4a0246003bc158bf80b71070e6e1c55669d59f769fab1bc34e7e52eb4a9849bf02615 c4cb1b76a6ef3e6a49b557142cd1e0a2ba524093c452006e0904ef3f74b248269703fb6cc31c 4f61d7339e7fd97ca7d2dd3df35650b23994bc72261727ff075fe1d8eb0c54b809ae9bf92e4e 8b177742dc95199d8710e14a0dc9c25b2e58ecc63fd2212d0cec7b23d74ef2ec9f143d55213e 3ce8fe95bb17e2b5e0f49983b0e976627a1ca733206fdd81a5f1224a69e16764771cce8d2a8a 4a9491ee5f2326c2ed6cdcedf9a9e3118343759bcd6cd83ce2c6f22c4c3dd3 Remote network NAT'ed: yes Protect Network to Network traffic: yes Protect Gateway to Gateway traffic: yes Protect Gateway to Network traffic: yes Local machine acts as: client SME1 ipsec.conf is: [root@sme1 /etc]# cat ipsec.conf #------------------------------------------------------------ # DO NOT MODIFY THIS FILE! It is updated automatically by the # e-smith server and gateway software. Instead, modify the source # template in the /etc/e-smith/templates directory. For more # information, see http://www.e-smith.org. # # copyright (C) 1999, 2000 e-smith, inc. #------------------------------------------------------------ config setup # THIS SETTING MUST BE CORRECT or almost nothing will work; # %defaultroute is okay for most simple cases. interfaces=%defaultroute # Debug-logging controls: "none" for (almost) none, "all" for lots. klipsdebug=none plutodebug=none # Use auto= parameters in conn descriptions to control startup actions. plutoload=%search plutostart=%search # Close down old connection when new one using same ID shows up. uniqueids=yes conn %default # How persistent to be in (re)keying negotiations (0 means very). keyingtries=0 # How to authenticate gateways authby=rsasig ############################################################## conn net.local-net.192.168.1.0 also=net.local.left right=203.132.2.2 rightnexthop=203.132.2.1 rightsubnet=192.168.1.0/255.255.255.0 [EMAIL PROTECTED] rightfirewall=yes rightrsasigkey=0x0103b0e7f3484059d610272c13390f40aadc52883537bab7a49ab9ecc1a 6358aca71fcf7cb420154c4757d6af0cd45aca3ee499a9d0c0049c5906f01f4d1a0a62c59d75 aa97d6ef2a7ac581c1eea5f2459d43c8f975c0c039a3e09162ffa207d23eb40e76abec727730 7f71b1f238ed919ce01de270bb316208aa2c04a68eb2a2cdc356b49f3e64e5dc008d735390b1 ee260a9aa407aba35e1e59b63e6b9ee6514d2efa808a85f9e8343e7d019109175a121685bf5e c6d3083adc8a2a608e9aa3daba8c338b32465dfc5fa9df54a3764c76cd29b601d19af585a337 dac734a5d0e655a4dde36389fce0335dc12921a6b3d33af5f912aae5f100b7cc8897bcbb493b 5 auto=start conn gate.local-gate.192.168.1.0 also=gate.local.left right=203.132.2.2 rightnexthop=203.132.2.1 [EMAIL PROTECTED] rightrsasigkey=0x0103b0e7f3484059d610272c13390f40aadc52883537bab7a49ab9ecc1a 6358aca71fcf7cb420154c4757d6af0cd45aca3ee499a9d0c0049c5906f01f4d1a0a62c59d75 aa97d6ef2a7ac581c1eea5f2459d43c8f975c0c039a3e09162ffa207d23eb40e76abec727730 7f71b1f238ed919ce01de270bb316208aa2c04a68eb2a2cdc356b49f3e64e5dc008d735390b1 ee260a9aa407aba35e1e59b63e6b9ee6514d2efa808a85f9e8343e7d019109175a121685bf5e c6d3083adc8a2a608e9aa3daba8c338b32465dfc5fa9df54a3764c76cd29b601d19af585a337 dac734a5d0e655a4dde36389fce0335dc12921a6b3d33af5f912aae5f100b7cc8897bcbb493b 5 auto=start conn net.local-gate.192.168.1.0 also=net.local.left right=203.132.2.2 rightnexthop=203.132.2.1 [EMAIL PROTECTED] rightrsasigkey=0x0103b0e7f3484059d610272c13390f40aadc52883537bab7a49ab9ecc1a 6358aca71fcf7cb420154c4757d6af0cd45aca3ee499a9d0c0049c5906f01f4d1a0a62c59d75 aa97d6ef2a7ac581c1eea5f2459d43c8f975c0c039a3e09162ffa207d23eb40e76abec727730 7f71b1f238ed919ce01de270bb316208aa2c04a68eb2a2cdc356b49f3e64e5dc008d735390b1 ee260a9aa407aba35e1e59b63e6b9ee6514d2efa808a85f9e8343e7d019109175a121685bf5e c6d3083adc8a2a608e9aa3daba8c338b32465dfc5fa9df54a3764c76cd29b601d19af585a337 dac734a5d0e655a4dde36389fce0335dc12921a6b3d33af5f912aae5f100b7cc8897bcbb493b 5 auto=start conn gate.local-net.192.168.1.0 also=gate.local.left right=203.132.2.2 rightnexthop=203.132.2.1 rightsubnet=192.168.1.0/255.255.255.0 [EMAIL PROTECTED] rightfirewall=yes rightrsasigkey=0x0103b0e7f3484059d610272c13390f40aadc52883537bab7a49ab9ecc1a 6358aca71fcf7cb420154c4757d6af0cd45aca3ee499a9d0c0049c5906f01f4d1a0a62c59d75 aa97d6ef2a7ac581c1eea5f2459d43c8f975c0c039a3e09162ffa207d23eb40e76abec727730 7f71b1f238ed919ce01de270bb316208aa2c04a68eb2a2cdc356b49f3e64e5dc008d735390b1 ee260a9aa407aba35e1e59b63e6b9ee6514d2efa808a85f9e8343e7d019109175a121685bf5e c6d3083adc8a2a608e9aa3daba8c338b32465dfc5fa9df54a3764c76cd29b601d19af585a337 dac734a5d0e655a4dde36389fce0335dc12921a6b3d33af5f912aae5f100b7cc8897bcbb493b 5 auto=start ############################################################## ############################################################## # Attributes for connection # # local net as left # ############################################################## conn net.local.left left=203.132.1.2 leftnexthop=203.132.1.1 leftsubnet=192.168.0.0/255.255.255.0 leftrsasigkey=0x0103bcbaed2615d8022c33d567ce5942e742c86fe25e11a756381a9b8d04 a2c25002995aa3a230bbd4a0246003bc158bf80b71070e6e1c55669d59f769fab1bc34e7e52e b4a9849bf02615c4cb1b76a6ef3e6a49b557142cd1e0a2ba524093c452006e0904ef3f74b248 269703fb6cc31c4f61d7339e7fd97ca7d2dd3df35650b23994bc72261727ff075fe1d8eb0c54 b809ae9bf92e4e8b177742dc95199d8710e14a0dc9c25b2e58ecc63fd2212d0cec7b23d74ef2 ec9f143d55213e3ce8fe95bb17e2b5e0f49983b0e976627a1ca733206fdd81a5f1224a69e167 64771cce8d2a8a4a9491ee5f2326c2ed6cdcedf9a9e3118343759bcd6cd83ce2c6f22c4c3dd3 [EMAIL PROTECTED] leftfirewall=yes ############################################################## # Attributes for connection # # local gate as left # ############################################################## conn gate.local.left left=203.132.1.2 leftnexthop=203.132.1.1 leftrsasigkey=0x0103bcbaed2615d8022c33d567ce5942e742c86fe25e11a756381a9b8d04 a2c25002995aa3a230bbd4a0246003bc158bf80b71070e6e1c55669d59f769fab1bc34e7e52e b4a9849bf02615c4cb1b76a6ef3e6a49b557142cd1e0a2ba524093c452006e0904ef3f74b248 269703fb6cc31c4f61d7339e7fd97ca7d2dd3df35650b23994bc72261727ff075fe1d8eb0c54 b809ae9bf92e4e8b177742dc95199d8710e14a0dc9c25b2e58ecc63fd2212d0cec7b23d74ef2 ec9f143d55213e3ce8fe95bb17e2b5e0f49983b0e976627a1ca733206fdd81a5f1224a69e167 64771cce8d2a8a4a9491ee5f2326c2ed6cdcedf9a9e3118343759bcd6cd83ce2c6f22c4c3dd3 [EMAIL PROTECTED] ############################################################## # Attributes for connection # # local net as right # ############################################################## conn net.local.right right=203.132.1.2 rightnexthop=203.132.1.1 rightsubnet=192.168.0.0/255.255.255.0 rightrsasigkey=0x0103bcbaed2615d8022c33d567ce5942e742c86fe25e11a756381a9b8d0 4a2c25002995aa3a230bbd4a0246003bc158bf80b71070e6e1c55669d59f769fab1bc34e7e52 eb4a9849bf02615c4cb1b76a6ef3e6a49b557142cd1e0a2ba524093c452006e0904ef3f74b24 8269703fb6cc31c4f61d7339e7fd97ca7d2dd3df35650b23994bc72261727ff075fe1d8eb0c5 4b809ae9bf92e4e8b177742dc95199d8710e14a0dc9c25b2e58ecc63fd2212d0cec7b23d74ef 2ec9f143d55213e3ce8fe95bb17e2b5e0f49983b0e976627a1ca733206fdd81a5f1224a69e16 764771cce8d2a8a4a9491ee5f2326c2ed6cdcedf9a9e3118343759bcd6cd83ce2c6f22c4c3dd 3 [EMAIL PROTECTED] rightfirewall=yes ############################################################## # Attributes for connection # # local gate as right # ############################################################## conn gate.local.right right=203.132.1.2 rightnexthop=203.132.1.1 rightrsasigkey=0x0103bcbaed2615d8022c33d567ce5942e742c86fe25e11a756381a9b8d0 4a2c25002995aa3a230bbd4a0246003bc158bf80b71070e6e1c55669d59f769fab1bc34e7e52 eb4a9849bf02615c4cb1b76a6ef3e6a49b557142cd1e0a2ba524093c452006e0904ef3f74b24 8269703fb6cc31c4f61d7339e7fd97ca7d2dd3df35650b23994bc72261727ff075fe1d8eb0c5 4b809ae9bf92e4e8b177742dc95199d8710e14a0dc9c25b2e58ecc63fd2212d0cec7b23d74ef 2ec9f143d55213e3ce8fe95bb17e2b5e0f49983b0e976627a1ca733206fdd81a5f1224a69e16 764771cce8d2a8a4a9491ee5f2326c2ed6cdcedf9a9e3118343759bcd6cd83ce2c6f22c4c3dd 3 [EMAIL PROTECTED] #------------------------------------------------------------ # TEMPLATE END #------------------------------------------------------------ I'm writing this at home. My test setup is at work, and as yet I have not setup any way to contact the test machines from my home connection. Tomorrow I'll try: PPTP to the main SME (gets me into my LAN), then port forwarding through the ROUTER to SSH on SME1 and SME2. It might work .... **** bugger !! I didn't email myself SME2 ipsec.conf ***** AND I SHOULD HAVE EMAILED MYSELF SNIPPETS OF THE LOGS But the above is at least a start .... Hugh -- Please report bugs to [EMAIL PROTECTED] Please mail [EMAIL PROTECTED] (only) to discuss security issues Support for registered customers and partners to [EMAIL PROTECTED] To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] Archives by mail and http://www.mail-archive.com/devinfo%40lists.e-smith.org
