VPN/Racoon as IPsec client for Zywall

Zywall comes with a Windows IPSEC client sporting a nice interface and many great features. I wanted to see if I can use any of the IP implementations on Linux to connect to a Zywall I had all the credentials and configuration parameters.

Prerequisites

• A Zywall router
• A configured Windows Zywall IPsec client or the *.tbp configuration file
• An operating system with the Racoon IPsec implementation.

Windows client configuration

This is just to show the configuraion on the Windows host that was used to create the configuration on Linux. The below exerpt is a configuration file (<ConnectionName>.tgb) produced by vpnconf.exe which is part of the Zywall IPsec Client.

# Do not edit this file. It is overwritten by VpnConf.
# SIGNATURE MD5 = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# Creation Date : 2008-05-13 at 09:50:11
# Written by VpnConf 4.10
#

[General]
Shared-SADB = Defined
Retransmits = 2
Exchange-max-time = 15
Default-phase-1-lifetime = 3600,360:28800
Bitblocking = 0
Xauth-interval = 60
DPD-interval = 30
DPD_retrans = 5
DPD_wait = 15

[Default-phase-2-lifetime]
LIFE_TYPE = SECONDS
LIFE_DURATION = 3600,300:28800

# ==================== PHASES 1 ====================

[Phase 1]
<IPsecGatewayAddress> = <ConnectionName>-P1

[<ConnectionName>-main-mode]
DOI = IPSEC
EXCHANGE_TYPE = ID_PROT
Transforms = DES-MD5-GRP1

[<ConnectionName>-P1]
Phase = 1
Address = <IPsecGatewayAddress>
Transport = udp
Configuration = <IPsecGatewayAddress>-main-mode
Authentication = "<PreSharedKey>"

# ==================== PHASES 2 ====================

[Phase 2]
Manual-connections = <ConnectionName>-<TunnelName>-P2

[<ConnectionName>-<TunnelName>-P2]
Phase = 2
ISAKMP-peer = <ConnectionName>-P1
Remote-ID = <TunnelName>-remote-addr
Configuration = <TunnelName>-quick-mode
AutoStart = 0
USBStart = 0

# ==================== Ipsec ID ====================

[<TunnelName>-remote-addr]
ID-type = IPV4_ADDR
Address = <RemoteTargetIP>

# ==================== TRANSFORMS ====================

[<TunnelName>-quick-mode]
DOI = IPSEC
EXCHANGE_TYPE = QUICK_MODE
Suites = <TunnelName>-quick-mode-suite

[<TunnelName>-quick-mode-suite]
Protocols = TGBQM-ESP-DES-SHA-TUN

[TGBQM-ESP-DES-SHA-TUN]
PROTOCOL_ID = IPSEC_ESP
Transforms = TGBQM-ESP-DES-SHA-TUN-XF

[TGBQM-ESP-DES-SHA-TUN-XF]
TRANSFORM_ID = DES
AUTHENTICATION_ALGORITHM = HMAC_SHA
ENCAPSULATION_MODE = TUNNEL
Life = Default-phase-2-lifetime

# ==================== CERTIFICATES ====================

Linux client configuration

This is example is based on the Debian / Ubuntu layout.

Software install

First step is to install racoon and ipsec-tools

sudo apt-get install racoon ipsec-tools

Racoon config

For this example a pre-shared-key (PSK) is used. Hence we have to edit both the /etc/racoon/racoon.conf and the /etc/racoon/psk.txt files.

racoon.conf

#
#
# Also read the Linux IPSEC Howto up at
# http://www.ipsec-howto.org/t1.html
#
log notify;
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";

remote <IPsecGatewayAddress> {
        exchange_mode main,aggressive;
        proposal {
                encryption_algorithm des;
                hash_algorithm md5;
                authentication_method pre_shared_key;
                dh_group 1;
        }
        generate_policy on;
        nat_traversal on;
}

sainfo anonymous address <RemoteTargetIP> any {
        #pfs_group none;
        lifetime time 3600 seconds;
        encryption_algorithm des;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
}

psk.txt

# IPv4/v6 addresses
10.160.94.3     mekmitasdigoat
172.16.1.133    0x12345678
194.100.55.1    whatcertificatereally
3ffe:501:410:ffff:200:86ff:fe05:80fa    mekmitasdigoat
3ffe:501:410:ffff:210:4bff:fea2:8baa    mekmitasdigoat
# USER_FQDN
foo@kame.net    mekmitasdigoat
# FQDN
foo.kame.net    hoge
#
<IPsecGatewayAddress>     <PreSharedKey>

SA configuration

Once the racoon files are in place the SA needs to be set via the /etc/ipsec-tools.conf file.

#!/usr/sbin/setkey -f

flush;
spdflush;
spdadd <LocalIPorSubnet> <RemoteTargetIP> any -P out ipsec
    esp/tunnel/<LocalGateway>-<IPsecGatewayAddress>/require;
spdadd <RemoteTargetIP> <LocalIPorSubnet> any -P in ipsec
    esp/tunnel/<IPsecGatewayAddress>-<LocalGateway>/require;

Enable configuration

Either use the following commands

setkey -f /etc/ipsec-conf.txt
racoonctl reload-config 

or restart the services

/etc/init.d/setkey restart
/etc/init.d/racoon restart

Bring up the tunnel

racoonctl vpn-connect <IPsecGatewayAddress>

Confirm connection

# ping -c 3 <IPsecGatewayAddress>
PING <IPsecGatewayAddress> (<IPsecGatewayAddress>) 56(84) bytes of data.
64 bytes from <IPsecGatewayAddress>: icmp_req=1 ttl=127 time=49.7 ms
64 bytes from <IPsecGatewayAddress>: icmp_req=2 ttl=127 time=50.5 ms
64 bytes from <IPsecGatewayAddress>: icmp_req=3 ttl=127 time=50.5 ms

--- <IPsecGatewayAddress> ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 49.734/50.297/50.583/0.398 ms

Troubleshooting

This is a very brief overview of commands to help with troubleshooting.

Phase 1

Check if Phase 1 is up and running with racoonctl show-sa isakmp

# racoonctl show-sa isakmp
Destination                      Cookies                           Created
<IPsecGatewayAddress>.500        177d11554e3e18aa:276cab39052f7850 2012-06-05 16:47:11

Phase 2

Check if Phase 2 is up and running with racoonctl show-sa esp or setkey -DH

# setkey -DH
00000000: 02 0a 00 00 02 00 00 00 00 00 00 00 58 15 00 00
<LocalGateway> <IPsecGatewayAddress>
        esp mode=tunnel spi=1540133473(0x5bcc9261) reqid=0(0x00000000)
        E: des-cbc  4180bb88 26dcf85d
        A: hmac-sha1  247c6472 bd5431f1 2d2e9c46 b567e6e4 a38cd518
        seq=0x00000000 replay=4 flags=0x00000000 state=mature
        created: Jun  5 19:19:03 2012   current: Jun  5 19:22:54 2012
        diff: 231(s)    hard: 3600(s)   soft: 2880(s)
        last: Jun  5 19:19:04 2012      hard: 0(s)      soft: 0(s)
        current: 420(bytes)     hard: 0(bytes)  soft: 0(bytes)
        allocated: 5    hard: 0 soft: 0
        sadb_seq=1 pid=5464 refcnt=0
<IPsecGatewayAddress> <LocalGateway>
        esp mode=tunnel spi=98033518(0x05d7df6e) reqid=0(0x00000000)
        E: des-cbc  664ce469 ae2ff311
        A: hmac-sha1  66b6c9f2 73c61747 23ca88d4 f2bd61a5 d2c89381
        seq=0x00000000 replay=4 flags=0x00000000 state=mature
        created: Jun  5 19:19:03 2012   current: Jun  5 19:22:54 2012
        diff: 231(s)    hard: 3600(s)   soft: 2880(s)
        last: Jun  5 19:19:04 2012      hard: 0(s)      soft: 0(s)
        current: 420(bytes)     hard: 0(bytes)  soft: 0(bytes)
        allocated: 5    hard: 0 soft: 0
        sadb_seq=0 pid=5464 refcnt=0

Racoon debugging

Enable debugging in the racoon.conf configuration file and watch the syslog output under /var/log/{syslog,messages} for errors.

log debug2;