<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7226.0">
<TITLE>Openswan IPsec help please</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">I am using Linux Openswan U2.3.0/K2.6.9-11.EL on a Centos linux machine.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">I guess you have seen this issue quite a few times, and I have had a look on the net but nothing is really giving me the answer.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">I have deleted the entry in the /etc/ipsec.secret and put in 10.3.1.9 10.100.10.101: PSK "test" as I want this to be the shared key between the two devices [The devices are a Unix box and a router] (Although the system is complaining about the /etc/ipsec.secret, I don't know how to put back the old RSA key]</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Any little bit of help will be appreciated for me to get this tunnel up, as the system keeps on complain when I start it up about "ipsec__plutorun: ...could not start conn "tunnelipsec"</FONT></P>
<P><FONT SIZE=2 FACE="Arial">my /var/log/messages looks as follows when I start up the service</FONT>
<BR><FONT SIZE=2 FACE="Arial">Dec 28 17:11:31 bb kernel: NET: Unregistered protocol family 15</FONT>
<BR><FONT SIZE=2 FACE="Arial">Dec 28 17:11:31 bb ipsec_setup: ...Openswan IPsec stopped</FONT>
<BR><FONT SIZE=2 FACE="Arial">Dec 28 17:11:31 bb ipsec_setup: Stopping Openswan IPsec...</FONT>
<BR><FONT SIZE=2 FACE="Arial">Dec 28 17:11:32 bb kernel: NET: Registered protocol family 15</FONT>
<BR><FONT SIZE=2 FACE="Arial">Dec 28 17:11:32 bb ipsec_setup: KLIPS ipsec0 on eth0 10.3.1.9/255.255.255.0 broadcast 10.3.1.255</FONT>
<BR><FONT SIZE=2 FACE="Arial">Dec 28 17:11:32 bb ipsec_setup: ...Openswan IPsec started</FONT>
<BR><FONT SIZE=2 FACE="Arial">Dec 28 17:11:32 bb ipsec_setup: Starting Openswan IPsec 2.3.0...</FONT>
<BR><FONT SIZE=2 FACE="Arial">Dec 28 17:11:32 bb ipsec_setup: insmod /lib/modules/2.6.9-11.EL/kernel/net/key/af_key.ko</FONT>
<BR><FONT SIZE=2 FACE="Arial">Dec 28 17:11:32 bb ipsec_setup: insmod /lib/modules/2.6.9-11.EL/kernel/net/ipv4/xfrm4_tunnel.ko</FONT>
<BR><FONT SIZE=2 FACE="Arial">Dec 28 17:11:33 bb ipsec__plutorun: 104 "tunnelipsec" #1: STATE_MAIN_I1: initiate</FONT>
<BR><FONT SIZE=2 FACE="Arial">Dec 28 17:11:33 bb ipsec__plutorun: ...could not start conn "tunnelipsec"</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">my /etc/ipsec.conf looks like</FONT>
<BR><FONT SIZE=2 FACE="Arial">[root@bb policies]# cat /etc/ipsec.conf</FONT>
<BR><FONT SIZE=2 FACE="Arial"># /etc/ipsec.conf - Openswan IPsec configuration file</FONT>
<BR><FONT SIZE=2 FACE="Arial">version 2.0 </FONT>
<BR><FONT SIZE=2 FACE="Arial">include /etc/ipsec.d/examples/no_oe.conf</FONT>
<BR><FONT SIZE=2 FACE="Arial"># basic configuration</FONT>
<BR><FONT SIZE=2 FACE="Arial">config setup</FONT>
<BR><FONT SIZE=2 FACE="Arial"> # Debug-logging controls: "none" for (almost) none, "all" for lots.</FONT>
<BR><FONT SIZE=2 FACE="Arial"> interfaces="ipsec0=eth0"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> klipsdebug=none</FONT>
<BR><FONT SIZE=2 FACE="Arial"> plutodebug=none</FONT>
<BR><FONT SIZE=2 FACE="Arial"> forwardcontrol=yes</FONT>
<BR><FONT SIZE=2 FACE="Arial"># Add connections here</FONT>
<BR><FONT SIZE=2 FACE="Arial">conn tunnelipsec</FONT>
<BR><FONT SIZE=2 FACE="Arial"> type=tunnel</FONT>
<BR><FONT SIZE=2 FACE="Arial"> left=10.3.1.9 # Local ip</FONT>
<BR><FONT SIZE=2 FACE="Arial"> leftsubnet=10.1.1.0/24 #Local network</FONT>
<BR><FONT SIZE=2 FACE="Arial"> leftnexthop=10.3.1.1 </FONT>
<BR><FONT SIZE=2 FACE="Arial"> right=10.100.10.101 #Remote ip address </FONT>
<BR><FONT SIZE=2 FACE="Arial"> rightsubnet=155.236.47.0/24 # Remote network</FONT>
<BR><FONT SIZE=2 FACE="Arial"> rightnexthop=10.100.10.1</FONT>
<BR><FONT SIZE=2 FACE="Arial"> esp= des-md5-96</FONT>
<BR><FONT SIZE=2 FACE="Arial"> pfs= no</FONT>
<BR><FONT SIZE=2 FACE="Arial"> auto=start </FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">my TCPDump just shows</FONT>
<BR><FONT SIZE=2 FACE="Arial">17:14:42.828708 IP 10.100.10.101.isakmp > 10.3.1.9.isakmp: isakmp: phase 1 I ident</FONT>
<BR><FONT SIZE=2 FACE="Arial">17:14:42.829577 IP 10.3.1.9.isakmp > 10.100.10.101.isakmp: isakmp: phase 1 R inf</FONT>
<BR><FONT SIZE=2 FACE="Arial">17:14:43.638849 IP 10.100.10.101.isakmp > 10.3.1.9.isakmp: isakmp: phase 1 I inf</FONT>
<BR><FONT SIZE=2 FACE="Arial">17:14:52.267624 IP 10.100.10.101.isakmp > 10.3.1.9.isakmp: isakmp: phase 1 I ident</FONT>
<BR><FONT SIZE=2 FACE="Arial">17:14:52.268488 IP 10.3.1.9.isakmp > 10.100.10.101.isakmp: isakmp: phase 1 R inf</FONT>
<BR><FONT SIZE=2 FACE="Arial">17:14:53.098304 IP 10.100.10.101.isakmp > 10.3.1.9.isakmp: isakmp: phase 1 I inf</FONT>
<BR><FONT SIZE=2 FACE="Arial">17:14:59.008855 IP 10.3.1.9.3158 > auth2.pacenet.co.za.domain: 36755+ PTR? 101.10.100.10.in-addr.arpa. (44)</FONT>
<BR><FONT SIZE=2 FACE="Arial">17:15:02.827326 IP 10.100.10.101.isakmp > 10.3.1.9.isakmp: isakmp: phase 1 I ident</FONT>
<BR><FONT SIZE=2 FACE="Arial">17:15:02.828250 IP 10.3.1.9.isakmp > 10.100.10.101.isakmp: isakmp: phase 1 R inf</FONT>
<BR><FONT SIZE=2 FACE="Arial">17:15:03.638848 IP 10.100.10.101.isakmp > 10.3.1.9.isakmp: isakmp: phase 1 I inf</FONT>
<BR><FONT SIZE=2 FACE="Arial">17:15:04.008737 IP 10.3.1.9.3160 > auth1.pacenet.co.za.domain: 36755+ PTR? 101.10.100.10.in-addr.arpa. (44)</FONT>
<BR><FONT SIZE=2 FACE="Arial">17:15:09.008976 IP 10.3.1.9.3158 > auth2.pacenet.co.za.domain: 36755+ PTR? 101.10.100.10.in-addr.arpa. (44)</FONT>
<BR><FONT SIZE=2 FACE="Arial">17:15:14.009290 IP 10.3.1.9.3160 > auth1.pacenet.co.za.domain: 36755+ PTR? 101.10.100.10.in-addr.arpa. (44)</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">[root@bb policies]# ipsec auto status</FONT>
<BR><FONT SIZE=2 FACE="Arial">ipsec auto: warning: obsolete command syntax used</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 interface lo/lo ::1</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 interface lo/lo 127.0.0.1</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 interface eth0/eth0 10.3.1.9</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 %myid = (none)</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 debug none</FONT>
<BR><FONT SIZE=2 FACE="Arial">000</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0, keysizemax=0</FONT>
<BR><FONT SIZE=2 FACE="Arial">000</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192</FONT>
<BR><FONT SIZE=2 FACE="Arial">000</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}</FONT>
<BR><FONT SIZE=2 FACE="Arial">000</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 "tunnelipsec": 10.1.1.0/24===10.3.1.9---10.3.1.1...10.100.10.1---10.100.10.101===155.236.47.0/24; prospective erouted; eroute owner: #0</FONT></P>
<P><FONT SIZE=2 FACE="Arial">000 "tunnelipsec": srcip=unset; dstip=unset</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 "tunnelipsec": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 "tunnelipsec": policy: RSASIG+ENCRYPT+TUNNEL+UP+lKOD+rKOD; prio: 24,24; interface: eth0;</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 "tunnelipsec": newest ISAKMP SA: #0; newest IPsec SA: #0;</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 "tunnelipsec": ESP algorithms wanted: 2_000-1, flags=-strict</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 "tunnelipsec": ESP algorithms loaded: 2_000-1, flags=-strict</FONT>
<BR><FONT SIZE=2 FACE="Arial">000</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 #1: "tunnelipsec" STATE_MAIN_I2 (sent MI2, expecting MR2); none in -1s; lastdpd=-1s(seq in:0 out:0)</FONT>
<BR><FONT SIZE=2 FACE="Arial">000 #1: pending Phase 2 for "tunnelipsec" replacing #0</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">[root@bb policies]# ipsec verify status</FONT>
<BR><FONT SIZE=2 FACE="Arial">Checking your system to see if IPsec got installed and started correctly:</FONT>
<BR><FONT SIZE=2 FACE="Arial">Version check and ipsec on-path [OK]</FONT>
<BR><FONT SIZE=2 FACE="Arial">Linux Openswan U2.3.0/K2.6.9-11.EL (netkey)</FONT>
<BR><FONT SIZE=2 FACE="Arial">Checking for IPsec support in kernel [OK]</FONT>
<BR><FONT SIZE=2 FACE="Arial">Checking for RSA private key (/etc/ipsec.secrets) [FAILED]</FONT>
<BR><FONT SIZE=2 FACE="Arial">ipsec showhostkey: no default key in "/etc/ipsec.secrets"</FONT>
<BR><FONT SIZE=2 FACE="Arial">Checking that pluto is running [OK]</FONT>
<BR><FONT SIZE=2 FACE="Arial">Two or more interfaces found, checking IP forwarding [OK]</FONT>
<BR><FONT SIZE=2 FACE="Arial">Checking NAT and MASQUERADEing [N/A]</FONT>
<BR><FONT SIZE=2 FACE="Arial">Checking for 'ip' command [OK]</FONT>
<BR><FONT SIZE=2 FACE="Arial">Checking for 'iptables' command [OK]</FONT>
<BR><FONT SIZE=2 FACE="Arial">Checking for 'setkey' command for NETKEY IPsec stack support [OK]</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Opportunistic Encryption DNS checks:</FONT>
<BR><FONT SIZE=2 FACE="Arial"> Looking for TXT in forward dns zone: bb.pacenet.co.za [MISSING]</FONT>
<BR><FONT SIZE=2 FACE="Arial"> Does the machine have at least one non-private address? [FAILED]</FONT>
</P>
<BR>
<BR>
<P><BR><FONT face=Arial>Website: </FONT><A href="http://www.fastnet.co.za"><FONT
face=Arial>http://www.fastnet.co.za</FONT></A></P>
<P><U>
</U></P>
<P><FONT face=Arial size=2>DISCLAIMER: The information in this message is
confidential and may be legally privileged. It is intended solely for the
addressee. Access to this message by anyone else is unauthorized. If you are not
the intended recipient, any disclosure, copying, or distribution of the message,
or any action or omission taken by you in reliance on it, is prohibited and may
be unlawful. Please immediately contact the sender if you have received this
message in error. <STRONG><FONT color=#ff8000><FONT
color=#0000ff>SWIFTNET</FONT> </FONT></STRONG>and any of its subsidiaries each
reserve the right to monitor all e-mail communications through its networks.
Thank you.</FONT></P>
<P><U><FONT
size=1>
</FONT></U></P>
</BODY>
</HTML>