<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.0.10">
</HEAD>
<BODY>
Hello, <BR>
<BR>
I can initiate tunnels from remote sites to the tunnel concentrator (openswan), but a lot of messages of QI get on the log at central site. Openswan sistem is unable to negotiate the tunnels (for all connections, log shows a lot of line like those)<BR>
<BR>
<B>Sep 13 09:46:45 pluto[31826]: "vpn-sc-singuerlin" #13194: max number of retransmissions (2) reached STATE_QUICK_I1<BR>
Sep 13 09:46:45 pluto[31826]: "vpn-sc-singuerlin" #13194: starting keying attempt 206 of an unlimited number<BR>
Sep 13 09:46:45 pluto[31826]: "vpn-sc-singuerlin" #13226: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS to replace #13194 {using isakmp#12748}<BR>
Sep 13 09:46:45 pluto[31826]: "vpn-sc-singuerlin" #12748: ignoring informational payload, type NO_PROPOSAL_CHOSEN<BR>
Sep 13 09:46:45 pluto[31826]: "vpn-sc-singuerlin" #12748: received and ignored informational message</B><BR>
<BR>
Note : Main Mode looks completed, but as soon as it's initiated, log shows :<BR>
<BR>
<B>no IKE algorithms for this connection<BR>
</B><BR>
When openswan acts as a responder, no problem to get IPSE SA, and communication works, so there is a feasible proposal between peers, and I as said it works on the other direction, but I'm trying to solve because I suspect that messages like :<BR>
<BR>
<B>can not start crypto helper: failed to find any available worker</B><BR>
<BR>
could be related to that massive retransmission of QI. I'm I right ?<BR>
<BR>
The central system is running RHE 4.0 and Openswan 2.3.0, remote nodes (office sites) are Cisco 837 (supporting 3DES). I've set up similar scenarios with Cisco and Openswan and this behaviour does not show and It works fine. The main difference in these scenario where This is showing Is that Openswan Is not directly connected to LAN network It tunnels. I mean :<BR>
<BR>
<B>LAN INSIDE</B> ------ FIREWALL SYSTEM ---------- INTERMEDIATE LAN ----------- <B>OPENSWAN SYSTEM</B> ------------- ROUTER TO OUTSIDE ---------- WAN<BR>
<BR>
In ipsec.conf tunnel conf look like :<BR>
<BR>
conn vpn-sc-singuerlin<BR>
authby=secret<BR>
right=<B><I>WAN IP address of remote node</I></B><BR>
rightid=<B>same as right</B><BR>
rightsubnet=192.168.2.0/24<BR>
left=<B>same as leftid</B><BR>
leftnexthop=<B>router to outside Ip address</B><BR>
leftid=<B>IP of openswan system at openswan-router network</B><BR>
leftsubnet=10.10.0.0/16 (LAN INSIDE)<BR>
auto=add<BR>
<BR>
<BR>
Of course LAN INSIDE is routed from Openswan system. I'm I missing something important there ? Any clues on how to express correctly this topology at ipsec.conf ?<BR>
<BR>
Any help would be appreciated<BR>
<BR>
Thanks in advance<BR>
Albert Agustí <BR>
<BR>
<BR>
<BR>
<BR>
<br><br><br><font color="#333333" size="1"><b>Avís
important</b>:</font><font color="#666666"
size="1"> Aquest missatge i qualsevol fitxer adjunt contenen
informació confidencial d'ús exclusiu per al
destinatari. Si vostè ha rebut aquest correu
electrònic per error, l'informem que està
totalment prohibida la divulgació, còpia o
distribució i li preguem que ho notifiqui i que l'esborri
immediatament. Gràcies per la seva
col·laboració.</font><font
color="#333333" size="1"> <b>Aviso importante</b></font><font
color="#666666" size="1">: Este mensaje y cualquier
fichero adjunto contiene información confidencial de uso
exclusivo para el destinatario. Si usted ha recibido el mensaje por
error, le informamos que está totalmente prohibida su
divulgación, copia o distribución y le rogamos
que lo notifique y que lo borre inmediatamente. Gracias por su
colaboración</font><font size="1">. </font><font
color="#333333" size="1"><b>Important notice</b></font><font
color="#666666" size="1">: This message and any files
transmitted with it are confidential and intended solely for the
individual to whom it is addressed. Unauthorized publication, use,
dissemination, forwarding, printing or copying of this email and its
associated attachments is strictly prohibited. If you have received
this email in error, please notify the sender and delete the original
immediately. Thank you for your cooperation</font>
<BR>
</BODY>
</HTML>