Acontece que o NETKEY não suporta compress = yes.
Removemos a configuração e funcionou bem.
No ClusterA e B eu instalei o pacote "openswan" no Debian Squeeze.
ClusterA ip é 172.16.0.107, B é 172.16.0.108
Quando fazem ping uns aos outros, não chegam ao destino.
/etc/ipsec.conf:
version 2.0 # conforms to second version of ipsec.conf specification
config setup
protostack=netkey
oe=off
conn L2TP-PSK-CLUSTER
type=transport
left=172.16.0.107
right=172.16.0.108
auto=start
ike=aes128-sha1-modp2048
authby=secret
compress=yes
/etc/ipsec.secrets:
172.16.0.107 172.16.0.108 : PSK "L2TPKEY"
172.16.0.108 172.16.0.107 : PSK "L2TPKEY"
Aqui está o resultado da verificação ipsec em ambas as máquinas:
root@cluster2:~# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.28/K2.6.32-5-amd64 (netkey)
Checking for IPsec support in kernel [OK]
NETKEY detected, testing for disabled ICMP send_redirects [OK]
NETKEY detected, testing for disabled ICMP accept_redirects [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [FAILED]
Checking for 'ip' command [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
root@cluster2:~#
Este é o final da saída do ipsec auto --status:
000 "cluster": 172.16.0.108<172.16.0.108>[+S=C]...172.16.0.107<172.16.0.107>[+S=C]; prospective erouted; eroute owner: #0
000 "cluster": myip=unset; hisip=unset;
000 "cluster": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "cluster": policy: PSK+ENCRYPT+COMPRESS+PFS+UP+IKEv2ALLOW+lKOD+rKOD; prio: 32,32; interface: eth0;
000 "cluster": newest ISAKMP SA: #1; newest IPsec SA: #0;
000 "cluster": IKE algorithm newest: AES_CBC_128-SHA1-MODP2048
000
000 #3: "cluster":500 STATE_QUICK_R0 (expecting QI1); EVENT_CRYPTO_FAILED in 298s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate
000 #2: "cluster":500 STATE_QUICK_I1 (sent QI1, expecting QR1); EVENT_RETRANSMIT in 13s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate
000 #1: "cluster":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2991s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate
000
Curiosamente, se eu fizer o ike-scan no servidor, aqui está o que acontece:
Parece não levar em conta minhas configurações do ike
root@cluster1:~# ike-scan -M 172.16.0.108
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.0.108 Main Mode Handshake returned
HDR=(CKY-R=641bffa66ba717b6)
SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00007080)
VID=4f45517b4f7f6e657a7b4351
VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
Ending ike-scan 1.9: 1 hosts scanned in 0.008 seconds (118.19 hosts/sec). 1 returned handshake; 0 returned notify
root@cluster1:~#
Eu não sei dizer o que está acontecendo aqui, essa é a configuração mais simples que eu posso ter, de acordo com os exemplos.