Red Hat

Hi,

I am trying to set a policy between 2 machines for all the ports except for 22 i.e. for tcp - basically I want to bypass ssh. But my policy doesn't seem to work. Here are the entries

Code:

spdadd 1.2.3.4[any] 4.3.2.1[any] any -P out prio 100 ipsec esp/transport//require ah/transport//require;
spdadd 4.3.2.1[any] 1.2.3.4[any] any -P in prio 100 ipsec esp/transport//require ah/transport//require;
spdadd 0.0.0.0[22] 0.0.0.0[22] tcp -P out prio 1000 none;
spdadd 0.0.0.0[22] 0.0.0.0[22] tcp -P in prio 1000 none;

Security associations are also there and they are fine. I am able to see the packets from 4.3.2.1 to 1.2.3.4 are encrypted through tcpdump. Not able to ssh from 4.3.2.1 to 1.2.3.4

1.2.3.4 => Linux ( Issue is in the Linux machine. ssh from solaris to linux is not working )
4.3.2.1 => Solaris ( Bypass for ssh is enabled in ipsecconf )

I tried with priority, without prio - nothing helps.

One thing I noticed is that, if I give specific ports in the ipsec policy then ssh is bypassed. eg

Code:

spdadd 1.2.3.4[20] 4.3.2.1[20] any -P out prio 100 ipsec esp/transport//require ah/transport//require;
spdadd 4.3.2.1[20] 1.2.3.4[20] any -P in prio 100 ipsec esp/transport//require ah/transport//require;
spdadd 0.0.0.0[22] 0.0.0.0[22] tcp -P out prio 1000 none;
spdadd 0.0.0.0[22] 0.0.0.0[22] tcp -P in prio 1000 none;

But If I give [any] for the port in ipsec policy then it is not bypassing the ssh.
I also tried inserting the bypass policy before ipsec, after ipsec. Didn't work

Any info on this will be of great help.

Thank You

Ahamed.

---------- Post updated at 03:20 AM ---------- Previous update was at 03:18 AM ----------

Figured out the issue!!!

We need not specify the port 22 for the source IP.

Corrected Policy

Code:

spdadd 1.2.3.4[any] 4.3.2.1[any] any -P out ipsec esp/transport//require ah/transport//require;
spdadd 4.3.2.1[any] 1.2.3.4[any] any -P in ipsec esp/transport//require ah/transport//require;
spdadd 0.0.0.0[22] 0.0.0.0 tcp -P out none;
spdadd 0.0.0.0 0.0.0.0[22] tcp -P in none;

regards,
Ahamed