<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1264" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>So, these are the steps I did to get so
far:</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>downloaded and compiled openswan<BR>started with
service ipsec start<BR>created CA <BR>created Certificate for VPNUser1 (WinXP
Roadwarrior)<BR>created Certificate for gateway<BR>copied GatewayCert.pem to
/etc/ipsec.d and GatewayKey to /etc/ipsec.d/private<BR>put Password of the key
in /etc/ipsec.secrets<BR>I also put the cacert.pem and the crl.pem in the
corresponding dirs in /etc/ipsec.d</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>this is my /etc/ipsec.conf<BR>version
2.0 </FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>config
setup<BR>
interfaces=%defaultroute<BR>
klipsdebug=none<BR>
plutodebug=none<BR>
uniqueids=yes</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>conn %default<BR>
keyingtries=1<BR>
disablearrivalcheck=no<BR>
authby=rsasig<BR>
rightrsasigkey=%cert<BR>
auto=add<BR>
left=%defaultroute<BR>
leftcert=GatewayCert.pem<BR>
leftupdown=/usr/local/lib/ipsec/_updown_x509</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>conn xp-n2n<BR>
right=%any<BR> rightid="C=AT, L=Wien, O=Schneller
Scharau 5th Mind, CN=VPNusr1"<BR>
leftsubnet=192.168.118.0/24<BR>
rightsubnetwithin=192.168.0.0/24<BR>
rightsubnet=192.168.0.15/32</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>Under windows I followed the docs at <A
href="http://www.freeswan.ca/docs/WindowsInterop">http://www.freeswan.ca/docs/WindowsInterop</A>.<BR>I
manually added two tunnels for the ipsec connection.<BR>I also imported the VPN
User Certificate and the Certificate of the CA (but not the gateway) all with
the mmc.</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>Now with freeswan I still saw packaged arriving at
the fw. with openswan I only get (in /var/log/secure):</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>Mar 24 16:18:41 firewall ipsec__plutorun:
Restarting Pluto subsystem...<BR>Mar 24 16:18:41 firewall pluto[16161]: Starting
Pluto (Openswan Version 2.1.1 X.509-1.4.8 PLUTO_USES_KEYRR)<BR>Mar 24 16:18:41
firewall pluto[16161]: including NAT-Traversal patch (Version 0.6c)
[disabled]<BR>Mar 24 16:18:41 firewall pluto[16161]: Using KLIPS IPsec interface
code<BR>Mar 24 16:18:41 firewall pluto[16161]: Changing to directory
'/etc/ipsec.d/cacerts'<BR>Mar 24 16:18:41 firewall pluto[16161]:
loaded cacert file 'cacert.pem' (1180 bytes)<BR>Mar 24 16:18:41 firewall
pluto[16161]: Changing to directory '/etc/ipsec.d/crls'<BR>Mar 24 16:18:41
firewall pluto[16161]: loaded crl file 'crl.pem' (633
bytes)</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>So can anybody help me out of this one?<BR>At the
moment I seem to have a problem with openswan. Maybe this relates to the nat
traversal patch. since packets with protocol 50 (ESP) can be routed. Mabye this
is some x509 problem (since I see all thos certificate lines in my
log).</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>with tcpdump on the two firewalls I
see</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>(fw one which just forwards the
packets):</FONT></DIV>
<DIV><FONT face=Arial size=2>16:41:39.826773 galileo.intern.mpwi.at.isakmp >
200-200-200-200.static.adsl-line.inode.at.isakmp: isakmp: phase 1 I ident:
[|sa]<BR>(multiple times then)</FONT></DIV>
<DIV><FONT face=Arial size=2>16:42:38.494738 galileo.intern.mpwi.at.isakmp >
200-200-200-200.static.adsl-line.inode.at.isakmp: isakmp: phase 2/others I inf:
[|d]</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>(fw two with openswan):</FONT></DIV>
<DIV><FONT face=Arial size=2>16:42:08.722066 100.100.100.100.isakmp >
200.200.200.200.isakmp: isakmp: phase 1 I ident: [|sa]</FONT></DIV>
<DIV><FONT face=Arial size=2>(multiple times then)<BR>16:42:38.507461
100.100.100.100.isakmp > 200.200.200.200.isakmp: isakmp: phase 2/others I
inf:<BR> (d: doi=ipsec proto=isakmp spilen=16 nspi=1
spi=4b2fb1187c5aa6980000000000000000)</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Please help me I am losing a lot of sleep on
this.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Thanks in Advance</FONT></DIV>
<DIV><FONT face=Arial size=2>Leonard</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> </DIV>
<DIV><BR></DIV></FONT></BODY></HTML>