<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1264" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hello!</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Sorry if I seem like a total newbie but in a way I
am. I come to you for help, because -frankly- I don't know where else to
go.</FONT></DIV>
<DIV><FONT face=Arial size=2>It's probably some stupid mistake, but please bear
with me.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>setup: </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>WinXP Box (192.168.0.15)</FONT></DIV>
<DIV><FONT face=Arial size=2> -> NAT Firewall (linux)</FONT></DIV>
<DIV><FONT face=Arial size=2> -> Internet</FONT></DIV>
<DIV><FONT face=Arial size=2> -> NAT Firewall with Freeswan/X509 2.05
(currently updating to openswan)</FONT></DIV>
<DIV><FONT face=Arial size=2> -> 192.168.118.0/24 Network</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>So my first question: I do need this Nat Traversal
patch right? So that's why I am currently compiling openswan on this
machine.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>For WinXP I used</FONT></DIV>
<DIV><FONT face=Arial size=2><A
href="http://ipsec.math.ucla.edu/services/ipsec-windows.html">http://ipsec.math.ucla.edu/services/ipsec-windows.html</A></FONT></DIV>
<DIV><FONT face=Arial size=2><A
href="http://www.freeswan.ca/docs/WindowsInterop">http://www.freeswan.ca/docs/WindowsInterop</A></FONT></DIV>
<DIV><FONT face=Arial size=2>and tried M</FONT><FONT face=Arial size=2>arkus
Muellers Tools at <A
href="http://vpn.ebootis.de/">http://vpn.ebootis.de/</A> (which didnt't
work)</FONT></DIV>
<DIV><FONT face=Arial size=2>so I configured the connection in the MMC
manually</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Pakets definitely arrive at the ipsec Firewall but
something still is wrong.</FONT></DIV>
<DIV><FONT face=Arial size=2>in oakley.log on WinXP I see:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>3-23: 16:28:31:204:318 Receive: (get) SA =
0x001090b8 from IP.OF.IPSEC.FW.500<BR> 3-23: 16:28:31:204:318 ISAKMP
Header: (V1.0), len = 956<BR> 3-23: 16:28:31:204:318 I-COOKIE
9cb3435a6a80ac1a<BR> 3-23: 16:28:31:204:318 R-COOKIE
fd86d01cf6ea32ca<BR> 3-23: 16:28:31:204:318 exchange: Oakley
Main Mode<BR> 3-23: 16:28:31:204:318 flags: 1 ( encrypted
)<BR> 3-23: 16:28:31:204:318 next payload: ID<BR> 3-23:
16:28:31:204:318 message ID: 00000000<BR></FONT></DIV>
<DIV><FONT face=Arial size=2>On the Firewall:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Mar 23 16:26:51 firewall pluto[28116]: "xp-n2n"[2]
ip.of.nat.fw #3: sent MR3, ISAKMP SA established<BR>Mar 23 16:26:52 firewall
pluto[28116]: "xp-n2n"[2] ip.of.nat.fw #3: cannot respond to IPsec SA request
because no connection is known for 192.168.118.0/24===ip.of.ipsec.fw[C=AT,
L=Wien, O=Schneller<BR> Scharau 5th Mind, CN=VPNusr1]...ip.of.nat.fw[C=AT,
L=Wien, O=Schneller Scharau 5th Mind,
CN=VPNusr1]===192.168.0.15/32<BR></FONT></DIV>
<DIV><FONT face=Arial size=2>Here is my ipsec.conf</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>conn %default<BR>
keyingtries=1<BR>
disablearrivalcheck=no<BR> # always use
certificates<BR>
authby=rsasig<BR>
rightrsasigkey=%cert<BR>
auto=add<BR> # lokaler Endpunkt
(left)<BR>
left=%defaultroute<BR>
leftcert=VPNusr1Cert.pem<BR>
leftupdown=/usr/local/lib/ipsec/_updown_x509</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>conn xp-n2n<BR>
right=%any<BR> rightid="C=AT, L=Wien, O=Schneller
Scharau 5th Mind, CN=VPNusr1"<BR>
leftsubnet=192.168.118.0/24<BR>#
rightsubnetwithin=192.168.0.0/24<BR>#
rightsubnet=192.168.0.15/32</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I'm playing around with the last two
entries.</FONT></DIV>
<DIV><FONT face=Arial size=2>So, is this whole thing because of the missing
NAT-T Patch or is there some major flaw. I'm really not good at this when it
comes to having TWO Firewalls to care about.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Any help is greatly appreciated.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Cheers</FONT></DIV>
<DIV><FONT face=Arial size=2>Leonard</FONT></DIV>
<DIV><FONT face=Arial size=2> </DIV></FONT></BODY></HTML>