Re: IPSEC problems with GRE.

[James Morris <jmorris@intercode.com.au>]

On 16 Jun 2003, Julian Blake Kongslie wrote:

> Hi there.
> 
> I've been playing around with IPSec, and I came across a problem with
> encrypting data sent directly by the kernel.
> 
> Specifically, attempts to encrypt a GRE or IPIP tunnel with ipsec in
> transport mode result in one of:
> 	1) No data sent.
> 	2) Data sent, ignored by peer.
> 	3) Kernel panic, with no SysRq.
> 
> Numbers 1 and 2 might be configuration problems on my part, but I have
> other ipsec setups running fine, and can't see anything different for
> these. Number 3 is a big problem.

I've not been able to reproduce the panic, but there is a potential issue
with path mtu which could explain (1) and (2):  the transport mode SAs 
between the gateways are not aware of the gre tunnel.

You need to lower the mtu on the gre tunnel at each end to take the ipsec
overhead into account.  This will cause the gateways to generate
appropriate icmp pmtu messages.

This is handled automatically for tunnel mode ipsec configurations.


- James
-- 
James Morris
<jmorris@intercode.com.au>