☰

racoon.conf 上的 IPsec isakmp_natt 问题

tag-icon • tag-icon vpn freebsd ipsec racoon
racoon.conf 上的 IPsec isakmp_natt 问题

我遇到了一个奇怪的问题，racoon 抱怨以下错误：

WARNING: NAT-T is enabled in at least one remote{} section, but no 'isakmp_natt' address was specified!

不过我已经指定了 isakmp_natt。这是我的 racoon.conf：

path pre_shared_key "/var/etc/psk.txt";

path certificate  "/var/etc";

listen
{
    isakmp 172.17.69.69 [500];
    isakmp_natt 172.17.69.69 [4500];
}


mode_cfg
{
    auth_source system;
    group_source system;
    pool_size 125;
    network4 172.19.3.1;
    netmask4 255.255.255.128;
}


remote 172.17.43.43
{
    ph1id 1;
    exchange_mode aggressive;
    my_identifier address 172.17.69.69;
    peers_identifier address 172.17.43.43;
    ike_frag on;
    generate_policy = off;
    initial_contact = on;
    nat_traversal on;

    dpd_delay = 10;
    dpd_maxfail = 5;
    support_proxy on;
    proposal_check claim;

    proposal
    {
        authentication_method pre_shared_key;
        encryption_algorithm 3des;
        hash_algorithm sha1;
        dh_group 2;
        lifetime time 28800 secs;
    }
}

sainfo subnet 192.168.168.0/24 any subnet 10.234.34.0/24 any
{
    remoteid 1;
    encryption_algorithm aes 256, aes 192, aes 128, blowfish 256, blowfish 248, blowfish 240, blowfish 232, blowfish 224, blowfish 216, blowfish 208, blowfish 200, blowfish 192, blowfish 184, blowfish 176, blowfish 168, blowfish 160, blowfish 152, blowfish 144, blowfish 136, blowfish 128, 3des, cast128;
    authentication_algorithm hmac_sha1,hmac_md5;
    compression_algorithm deflate;

    lifetime time 3600 secs;
}

谢谢！

[ 西蒙.CPU ]

答案1

您可能需要重新编译内核，并options IPSEC_NAT_T在内核配置中进行设置。

相关内容