Return to FAQ CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / ipsec-tools / src / racoon / doc

Annotation of embedaddon/ipsec-tools/src/racoon/doc/FAQ, revision 1.1

1.1     ! misho       1: This document is derived from the KAME racoon FAQ. Some answers do not
        !             2: apply to ipsec-tools (they are obsolete or not up to date). They are
        !             3: tagged [KAME]
        !             4: 
        !             5: Q: With what other IKE/IPsec implementation racoon is known to be interoperable?
        !             6: 
        !             7: A: [KAME]
        !             8:        See "IMPLEMENTATION" document supplied with KAME kit, or:
        !             9:        http://www.kame.net/dev/cvsweb.cgi/kame/IMPLEMENTATION
        !            10:        As we have tested/got test reports in the past, and our end and
        !            11:        the other end may have changed their implemenations, we are not sure
        !            12:        if we can interoperate with them today (we hope them to interoperate,
        !            13:        but we are not sure).
        !            14:        Also note that, IKE interoperability highly depends on configuration
        !            15:        on both ends.  You must configure both ends exactly the same.
        !            16: 
        !            17: Q: How can I make racoon interoperate with <IKE/IPsec implementation>?
        !            18: 
        !            19: A:
        !            20:        Configure both ends exactly the same.  With just a tiny little
        !            21:        difference, you will be in trouble.
        !            22: 
        !            23: Q: How to build racoon on my platform?
        !            24: 
        !            25: A: 
        !            26:        As usual: configure && make && make install
        !            27:        ipsec-tools is also available as a package in the NetBSD pkgsrc
        !            28: 
        !            29: Q: Describe me the options to "configure".
        !            30: 
        !            31: A:
        !            32:        --enable-adminport:
        !            33:                Lets racoon to listen to racoon admin port, which is to
        !            34:                be contacted by racoonctl(8).
        !            35:        --enable-natt:
        !            36:                Enable NAT-Traversal. This needs kernel support, which is
        !            37:                available on Linux. On NetBSD, NAT-Traversal kernel support
        !            38:                has not been integrated yet, you can get it from here:
        !            39:                http://ipsec-tools.sourceforge.net/netbsd_nat-t.diff
        !            40:                If you live in a country where software patents are legal,
        !            41:                using NAT-Traversal might infringe a patent. 
        !            42:        --enable-broken-natt:
        !            43:                When ipsec-tools is built with --enable-natt, racoon 
        !            44:                sets IKE ports in SAD and SPD so that the kernel is 
        !            45:                able to ditinguish peers hidden behind the same NAT.
        !            46:                Some kernel will not cope with that ports. Use that
        !            47:                option to force the ports to 0 in SAD ans SPD. Of 
        !            48:                course this means that you cannot have multiple peers
        !            49:                behind the same NAT.
        !            50:        --enable-frag:
        !            51:                Enable IKE fragmentation, which is a workaround for 
        !            52:                broken routers that drop fragmented packets
        !            53:        --enable-hybrid:
        !            54:                Enable hybrid authentication, and ISAKMP mode config and
        !            55:                Xauth as well. Note that plain Xauth (without hybrid auth)
        !            56:                is not implemented.
        !            57:        --with-libradius:
        !            58:                Enable the use of RADIUS with hybrid authentication on the
        !            59:                server side. RADIUS is used for authentication, configuration
        !            60:                and accounting.
        !            61:        --with-libpam:
        !            62:                Enable the use of PAM with hybrid authentication on the 
        !            63:                server side. PAM can be used for authentication and accounting.
        !            64:        --enable-gssapi:
        !            65:                Enable GSS-API, for Kerberos V support.
        !            66:        --enable-stats: 
        !            67:                Enable statistics logging function.
        !            68:        --enable-samode-unspec: 
        !            69:                Enable to use unspecified a mode of SA.
        !            70:        --enable-ipv6:
        !            71:                Enable IPv6 support.
        !            72:        --with-kernel-headers:
        !            73:                Supply the location of Linux kernel headers.
        !            74:        --with-readline:
        !            75:                Support readline input (yes by default).
        !            76:        --with-openssl:
        !            77:                Specify OpenSSL directory.
        !            78:        --sysconfdir:
        !            79:                Where racoon config file goes. Default is /etc, which means
        !            80:                that racoon will look for /etc/racoon.conf
        !            81:        --localstatedir:
        !            82:                Where is the directory where racoon stores the control socket
        !            83:                (when using --enable-adminport). Default is /var, which 
        !            84:                means racoon will use /var/racoon/racoon.sock
        !            85:        --prefix:
        !            86:                Where racoon gets installed. 
        !            87: 
        !            88: Q: How can I get help?
        !            89: 
        !            90: A: 
        !            91:        Always identify your operating system platforms, the versions you are
        !            92:        using (like "ipsec-tools-0.5"), and information to repeat the
        !            93:        problem.  The more revelant information you supply, the better your 
        !            94:        chances of getting help are. Useful informations include, depending
        !            95:        of the problem: 
        !            96:        - version identification
        !            97:        - trace from racoon, taken by "racoon -d 0xffffffff"
        !            98:                (maximum debug level)
        !            99:        - configuration file you are using
        !           100:        - probabaly, tcpdump trace
        !           101:        http://orange.kame.net/dev/send-pr.html has the guideline.
        !           102: 
        !           103:        If your question is not confidential, send your questions to:
        !           104:        <ipsec-tools-devel@lists.sourceforge.net>
        !           105: 
        !           106:        If your question is confidential, send your questions to:
        !           107:        <ipsec-tools-core@lists.sourceforge.net>
        !           108: 
        !           109: Q: Other documents to look at?
        !           110: 
        !           111: A:
        !           112:        http://www.NetBSD.org/docs/network/ipsec/
        !           113:        http://www.kame.net/
        !           114:        http://www.kame.net/newsletter/