<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Yeah, im really sure that i need AH+ESP. AH provides another
level of integrity check, at least it does not not let to change
IP src,dst or some ip header values.</p>
<p>I did manage to make it work but only with IKEv1. When i prompt
ikev2=insist, then it stucks in this messages:</p>
<p>000 #1: "test-conf":500 STATE_PARENT_I1 (sent v2I1, expected
v2R1); EVENT_v2_RETRANSMIT in 22s; idle; import:local rekey<br>
000 #1: pending Phase 2 for "test-conf" replacing #0<br>
</p>
<p>In tcpdump i see:<br>
18:23:19.498595 IP remote-host.isakmp > local-host.isakmp:
isakmp: phase 1 I ident<br>
18:23:22.076667 IP remote-host.isakmp > local-host.isakmp:
isakmp: phase 1 I ident<br>
18:23:22.426342 IP local-host.isakmp > remote-host.isakmp:
isakmp: parent_sa ikev2_init[I]<br>
18:23:22.498534 IP remote-host.isakmp > local-host.isakmp:
isakmp: phase 1 I ident<br>
18:23:25.076666 IP remote-host.isakmp > local-host.isakmp:
isakmp: phase 1 I ident<br>
18:23:28.076644 IP remote-host.isakmp > local-host.isakmp:
isakmp: phase 1 I ident<br>
<br>
</p>
<p><br>
</p>
<pre class="moz-signature" cols="72">------
WBR
Kuznetsov Konstantin, Engineer
e-mail: <a class="moz-txt-link-abbreviated" href="mailto:kkuznetsov@web.1tv.ru">kkuznetsov@web.1tv.ru</a>
mobile: +7 905 7111332</pre>
<div class="moz-cite-prefix">01.12.2016 16:46, Paul Wouters пишет:<br>
</div>
<blockquote
cite="mid:alpine.LRH.2.20.1612010844270.26956@bofh.nohats.ca"
type="cite">On Thu, 1 Dec 2016, Кузнецов Константин wrote:
<br>
<br>
<blockquote type="cite">Sorry, forget to mention that transport
mode is using.
<br>
</blockquote>
<br>
<blockquote type="cite"> Hi! I have a Centos 6 and i REALLY
NEED to make AH+ESP on libreswan-3.15-5.3.el6.x86_64
<br>
<br>
Is there any way to do it? I m trying to make 2 conf files
one fpr ah and one for esp and in this way only AH works, if i
delete
<br>
ah.conf, then esp conf works perfectly. But both AH and
ESP does not work.
<br>
</blockquote>
<br>
If you provide two configurations with the only difference being
<br>
type=esp versus type=ah, then you are creating two conflicting
<br>
configurations and the result is undefined.
<br>
<br>
People often mistakenly think they need AH+ESP. Libreswan does not
<br>
support ESP without authentication, so it is always authenticated
<br>
but it is not via AH+ESP. Only some very old racoon daemons are
<br>
still known to use AH+ESP.
<br>
<br>
So the important question is, are you really really sure you mean
<br>
AH+ESP?
<br>
<br>
Paul
<br>
<br>
<br>
</blockquote>
<br>
</body>
</html>