OpenSWAN KLIPS不工作

Question

我正在尝试在由IPSec启动的2VM之间设置OpenNebula。我用的是OpenSWAN。这是ipsec.conf文件

config setup        
    oe=off
    interfaces=%defaultroute
    protostack=klips

conn host-to-host

    left=10.141.0.135 # Local IP address
    connaddrfamily=ipv4
    leftrsasigkey=key
    right=10.141.0.132 # Remote IP address
    rightrsasigkey=key
    ike=aes128 # IKE algorithms (AES cipher)
    esp=aes128 # ESP algorithns (AES cipher)
    auto=add
    pfs=yes
    forceencaps=yes
    type=tunnel

我能够建立与netkey的联系，但是klip不起作用。

ipsec barf节目

#71: ERROR: asynchronous network error report on eth0 (sport=500) for message to 10.141.0.132 port 500, complainant 10.141.0.135: No route to host [errno 113, origin ICMP type 3 code 1 (not authenticated)]

Tcpdump显示

22:50:20.592685 IP 10.141.0.132.isakmp > 10.141.0.135.isakmp: isakmp: phase 1 I ident
22:50:25.602182 ARP, Request who-has 10.141.0.135 tell 10.141.0.132, length 46
22:50:26.602082 ARP, Request who-has 10.141.0.135 tell 10.141.0.132, length 46
22:50:27.601985 ARP, Request who-has 10.141.0.135 tell 10.141.0.132, length 46

ipsec eroute节目

0          10.141.0.135/32    -> 10.141.0.132/32    => %trap

有什么问题吗？

Answer 1

根据内核的不同，您可能需要一个修补程序。更新的内核默认支持NETKEY

要只启用NETKEY，请使用protostack=netkey