On 11/14/06, <b class="gmail_sendername">Peter McGill</b> <<a href="mailto:petermcgill@goco.net">petermcgill@goco.net</a>> wrote:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Main mode connects so it is probably correct, I'd stay away from aggressive mode.</blockquote><div><br>
OK. <br>
</div><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">>
There's no ike line (I don't think openswan 2.4.4 supports it). I tried
adding esp=3des-sha1, but with no luck (still stalls at<br>> STATE_QUICK_I1). What should it be?<br><br>It supports it, but it's usually unnecessary, without it openswan just accepts/trys anything.<br>Sometimes though other vendors only listen to the first suggestion so the ike and esp settings become important.
<br>Above is equivalent to:<br> ike=3des-sha1-modp1024<br>You'd expect phase 2 to use the same like this<br> esp=3des-sha1<br>But that obviosly isn't working if you tried it, so the cisco must have different options for the different phases'
<br>that's highly irregular, his/her setup might be incorrect or they might not know what their doing.<br>Either way, you still need to aggree on a phase 2 connect method as suggested by Paul and Andy as well.</blockquote>
<div><br>
That esp seems right after all. To summarize what I wrote to Frank Mayer,<br>
</div>They instructed us to set it up as follows,<br>
<div style="margin-left: 40px;"><span style="font-family: courier new,monospace;"> left=</span><span style="font-style: italic; font-family: courier new,monospace;">Our_public_IP</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"> leftsubnet=<a href="http://192.168.232.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"><font color="red"><b>MailScanner warning: numerical links are often malicious:</b></font> 192.168.232.0/24</a></span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"> leftnexthop=%defaultroute</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"> right=<a style="font-style: italic;" href="http://38.112.15.162" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"><font color="red"><b>MailScanner has detected a possible fraud attempt from "38.112.15.162" claiming to be</b></font> Their_public_IP</a></span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"> rightsubnet=<a href="http://10.14.8.0/29" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"><font color="red"><b>MailScanner warning: numerical links are often malicious:</b></font> 10.14.8.0/29</a></span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"> rightnexthop=%defaultroute</span><br>
</div>
<br></div>On a hunch I changed leftsubnet to
<a href="http://192.168.232.10/32"><font color="red"><b>MailScanner warning: numerical links are often malicious:</b></font> 192.168.232.10/32</a> -- and BINGO! IPsec SA established. So Openswan
seems happy, although no packets go through. I suspect now it's a
routing/firewalling issue.<br>
<br>
I'm particulary confused about the meaning and use of the nexthop parameters.<br>
<br>
/Christian<br>