{"id":200,"date":"2010-03-11T11:22:49","date_gmt":"2010-03-11T16:22:49","guid":{"rendered":"http:\/\/www.networkjack.info\/blog\/?p=200"},"modified":"2010-03-11T11:22:49","modified_gmt":"2010-03-11T16:22:49","slug":"site-to-site-vpn-with-mac-os-x-server-and-a-netscreen","status":"publish","type":"post","link":"http:\/\/www.networkjack.info\/blog\/2010\/03\/11\/site-to-site-vpn-with-mac-os-x-server-and-a-netscreen\/","title":{"rendered":"Site to Site VPN with Mac OS X Server and a NetScreen"},"content":{"rendered":"<p>A client needs to have a Site to Site VPN between a server at their office and a NetScreen at their colo.<\/p>\n<p>I did a fresh new install of Leopard Server fully and cleanly updated to 10.5.8 running on a G4 MacMini to make sure I can configure both sides properly.<br \/>\nMy test Server is on a clean public static IP address for the built-in ethernet.<br \/>\nSecondary ethernet using a USB Ethernet adapter for the private side of the network.<\/p>\n<p>System has no issues until&#8230;..<\/p>\n<p>I used the s2svpnadmin cli tool to create a new shared-secret IPSec tunnel to a NetScreen at our colo.<br \/>\nVery basic setup, nothing fancy (not like the tool lets you do anything fancy.)<\/p>\n<p>After creating the config I start to get these entries in my system.log:<\/p>\n<p>Mar 10 12:55:56 test1 vpnd[1614]: Server &#8216;TestColo&#8217; starting&#8230;<br \/>\nMar 10 12:55:56 test1 TestColo[1614]: 2010-03-10 12:55:56 CST\u00c2\u00a0\u00c2\u00a0 \u00c2\u00a0Server &#8216;TestColo&#8217; starting&#8230;<br \/>\nMar 10 12:55:56 test1 vpnd[1614]: Listening for connections&#8230;<br \/>\nMar 10 12:55:56 test1 TestColo[1614]: 2010-03-10 12:55:56 CST\u00c2\u00a0\u00c2\u00a0 \u00c2\u00a0Listening for connections&#8230;<br \/>\nMar 10 12:55:57 test1 ReportCrash[1615]: Formulating crash report for process vpnd[1614]<br \/>\nMar 10 12:55:57 test1 com.apple.launchd[1] (TestColo[1614]): Exited abnormally: Bus error<br \/>\nMar 10 12:55:57 test1 com.apple.launchd[1] (TestColo): Throttling respawn: Will start in 9 seconds<br \/>\nMar 10 12:55:57 test1 ReportCrash[1615]: Saved crashreport to \/Library\/Logs\/CrashReporter\/vpnd_2010-03-10-125556_MacServe-Test1.crash using uid: 0 gid: 0, euid: 0 egid: 0<\/p>\n<p>and looking at the crash report:<\/p>\n<p>Process:\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 vpnd [1614]<br \/>\nPath:\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 \/usr\/sbin\/vpnd<br \/>\nIdentifier:\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 vpnd<br \/>\nVersion:\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 ??? (???)<br \/>\nCode Type:\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 PPC (Native)<br \/>\nParent Process:\u00c2\u00a0 launchd [1]<\/p>\n<p>Date\/Time:\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 2010-03-10 12:55:56.252 -0600<br \/>\nOS Version:\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 Mac OS X Server 10.5.8 (9L34)<br \/>\nReport Version:\u00c2\u00a0 6<br \/>\nAnonymous UUID:\u00c2\u00a0 7E25DC5D-7D93-42B5-8F69-F7C823244418<\/p>\n<p>Exception Type:\u00c2\u00a0 EXC_BAD_ACCESS (SIGBUS)<br \/>\nException Codes: KERN_PROTECTION_FAILURE at 0x0000000000000000<br \/>\nCrashed Thread:\u00c2\u00a0 0<\/p>\n<p>Thread 0 Crashed:<br \/>\n0\u00c2\u00a0\u00c2\u00a0 ???\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 \u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 \u00c2\u00a00000000000 0 + 0<br \/>\n1\u00c2\u00a0\u00c2\u00a0 vpnd\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 \u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 \u00c2\u00a00x0000444c accept_connections + 1280<br \/>\n2\u00c2\u00a0\u00c2\u00a0 vpnd\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 \u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 \u00c2\u00a00x00002a08 main + 1572<br \/>\n3\u00c2\u00a0\u00c2\u00a0 vpnd\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 \u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 \u00c2\u00a00x00001a48 start + 68<br \/>\n4\u00c2\u00a0\u00c2\u00a0 ???\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 \u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 \u00c2\u00a00000000000 0 + 0<\/p>\n<p>Thread 0 crashed with PPC Thread State 32:<br \/>\nsrr0: 0x00000000\u00c2\u00a0 srr1: 0x4200f030\u00c2\u00a0\u00c2\u00a0 dar: 0x000513b0 dsisr: 0x42000000<\/p>\n<p>&#8230;. etc. etc.<\/p>\n<p>I do NOT have the VPN service &#8220;running&#8221;.<\/p>\n<p>I did find this post on Apple discussions:<\/p>\n<p>http:\/\/discussions.apple.com\/thread.jspa?threadID=1491028#7116067<\/p>\n<p>and followed the posters directions for manually starting the tunnel.<br \/>\nI still get a bit of fussing, but no crash.<br \/>\nI checked the IPSec SA\/SPD info with setkey -PD and some basic pings across the network and the tunnel is active.<\/p>\n<p>The crashing doesn&#8217;t seem to be cpu arch dependent as my system is ppc and the OP on the Apple board is using a x86 machine.<\/p>\n<p>Kind of a bummer. It looks like there is probably some really simple issue here as the crash apparently happens very early in the setup process: &#8220;accept_connections&#8221;.<\/p>\n<p>Hopefully this will help someone in the future.<\/p>\n<p>Oh and FYI:<\/p>\n<p>Leopard Server IPSec parameters for a Shared Secret based VPN:<\/p>\n<p>Phase 1: DiffieHellman Group 2, 3DES, MD5, lifetime: 28800<\/p>\n<p>Phase 2: No Perfect Forward Secrecy; Encapsulated Packet (no AH); AES128 encryption; SHA1 hash; lifetime: 3600; Compression: Deflate (this is optional)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A client needs to have a Site to Site VPN between a server at their office and a NetScreen at their colo. I did a&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"http:\/\/www.networkjack.info\/blog\/2010\/03\/11\/site-to-site-vpn-with-mac-os-x-server-and-a-netscreen\/\">Continue reading<span class=\"screen-reader-text\">Site to Site VPN with Mac OS X Server and a NetScreen<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,2],"tags":[],"class_list":["post-200","post","type-post","status-publish","format-standard","hentry","category-os-x-server","category-routers-and-firewalls","entry"],"_links":{"self":[{"href":"http:\/\/www.networkjack.info\/blog\/wp-json\/wp\/v2\/posts\/200"}],"collection":[{"href":"http:\/\/www.networkjack.info\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.networkjack.info\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.networkjack.info\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.networkjack.info\/blog\/wp-json\/wp\/v2\/comments?post=200"}],"version-history":[{"count":2,"href":"http:\/\/www.networkjack.info\/blog\/wp-json\/wp\/v2\/posts\/200\/revisions"}],"predecessor-version":[{"id":202,"href":"http:\/\/www.networkjack.info\/blog\/wp-json\/wp\/v2\/posts\/200\/revisions\/202"}],"wp:attachment":[{"href":"http:\/\/www.networkjack.info\/blog\/wp-json\/wp\/v2\/media?parent=200"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.networkjack.info\/blog\/wp-json\/wp\/v2\/categories?post=200"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.networkjack.info\/blog\/wp-json\/wp\/v2\/tags?post=200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}