> а если без опечаток? и что в racoon.conf ?setkey.conf
flush;
spdflush;
spdadd 192.10.10.0/24 192.0.0.0/14 any -P out ipsec esp/tunnel/10.141.43.2-10.136.104.126/require;
spdadd 192.0.0.0/14 192.10.10.0/24 any -P in ipsec esp/tunnel/10.136.104.126-10.141.43.2/require;
spdadd 192.10.2.0/24 192.0.0.0/14 any -P out ipsec esp/tunnel/10.141.43.2-10.136.104.126/require;
spdadd 192.0.0.0/14 192.10.2.0/24 any -P in ipsec esp/tunnel/10.136.104.126-10.141.43.2/require;
racoon.conf
path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
log debug;
log notify;
padding
{
maximum_length 20;# maximum padding length.
randomize off;# enable randomize length.
strict_check off;# enable strict check.
exclusive_tail off;# extract last one octet.
}
listen
{
#isakmp ::1 [7000];
isakmp 10.141.43.2 [500];
#admin [7002];# administrative port for racoonctl.
#strict_address; # requires that all addresses must be bound.
}
# Specify various default timers.
timer
{
# These value can be changed per remote node.
counter 5;# maximum trying count to send.
interval 20 sec;# maximum interval to resend.
persend 1;# the number of packets per send.
# maximum time to wait for completing each phase.
phase1 20 sec;
phase2 20 sec;
}
#remote 10.136.104.126
remote anonymous
{
exchange_mode aggressive,main;
doi ipsec_doi;
my_identifier address 10.141.43.2;
peers_identifier address 10.136.104.126;
initial_contact off;
lifetime time 8 hour;
passive off;
proposal_check obey;
generate_policy off;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2;
lifetime time 28800 sec;
}
}
sainfo anonymous
{
pfs_group 2;
lifetime time 3600 sec;
encryption_algorithm 3des;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
}
