i try the connection with this config:<br><br>version 2<br>config setup<br># openswan tunnel configuration<br>conn side2side<br> type=tunnel<br> authby=secret<br>#RRT<br>left=<a href="http://66.232.119.242">66.232.119.242
</a><br>leftsubnet=<a href="http://66.232.119.0/32">66.232.119.0/32</a><br>leftnexthop=%defaultroute<br>#SAA<br>right=<a href="http://64.178.212.21">64.178.212.21</a><br>rightsubnet=<a href="http://176.168.0.20/32">176.168.0.20/32
</a><br>rightnexthop=%defaultroute<br>esp=3des-md5<br>ike=3des-md5-modp1024<br>aggrmode=no<br>keyexchange=ike<br>ikelifetime=24.0m<br>keylife=1.0h<br>pfs=no<br>auto=start<br><br>when i try <span style="font-weight: bold;">
ipsec auto --add side2side</span> i get this error<br><br># ipsec auto --add side2side<br>ipsec_auto: fatal error in "side2side": (/etc/ipsec.conf, line 8) section header "left=<a href="http://66.232.119.242">
66.232.119.242</a>" has wrong number of fields (1)<br><br>i read something about the editor and some character and space i redo the file using vi with copy anything all was typing again ( new file )<br>but i get the same ,any idea ?
<br><br>thanks<br><br><div><span class="gmail_quote">On 6/12/07, <b class="gmail_sendername">Peter McGill</b> <<a href="mailto:petermcgill@goco.net">petermcgill@goco.net</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>You had the esp line right, you just needed to add an
ike line,</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>like so.</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span></span></font> </div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>
ike=3des-md5-modp1024</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span> esp=3des-md5</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span></span></font> </div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>Your using Netkey (native), so the interfaces line will
be ignored,</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>which is fine, or you can comment it out with # for
clarity.</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span></span></font> </div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>ikelifetime and keylife are fine. Order of entries in a
conn section is irrelevent.</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>I personnally usually group them into left side
(left*=) and right side (right*=),</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>and shared settings, (anything not prefixed with left
or right.), but whatever works</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>for you is fine, openswan doesn't care about the order
inside a conn.</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span></span></font> </div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>At this point I recommend you change the ike and esp
lines then go ahead and test.</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>If you have any problems with the connection, then send
us another message.</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>Include the connection logs for troubleshooting with
that message.</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>egrep -e 'Jun 12 .*pluto'
/var/log/*</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>(Change Date appropriately.)</span></font></div>
<div dir="ltr" align="left"><font color="#0000ff" face="Arial" size="2"><span>Do not turn the debug options on in the conf, there is
enouph info without them.</span></font></div>
<div><font color="#0000ff" face="Arial" size="2"></font> </div>
<div align="left"><font face="Arial" size="2">Peter McGill</font></div>
<div><font color="#0000ff" face="Arial" size="2"></font> </div><font face="Arial" size="2"></font><font face="Arial" size="2"></font><font face="Arial" size="2"></font><font face="Arial" size="2"></font><font face="Arial" size="2">
</font><font face="Arial" size="2"></font><br>
<blockquote style="border-left: 2px solid rgb(0, 0, 255); padding-left: 5px; margin-left: 5px; margin-right: 0px;">
<div dir="ltr" align="left" lang="en-us">
<hr>
<font face="Tahoma" size="2"><b>From:</b> E0x [mailto:<a href="mailto:samudhio@gmail.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">samudhio@gmail.com</a>]
<br><b>Sent:</b> June 12, 2007 7:49 AM<br><b>To:</b>
<a href="mailto:petermcgill@goco.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">petermcgill@goco.net</a><br><b>Cc:</b> <a href="mailto:users@openswan.org" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
users@openswan.org</a><br><b>Subject:</b> Re:
[Openswan Users] openswan Side to Side config<br></font><br></div><div><span class="e" id="q_1131fe5d94511cd5_1">
<div></div>i just want confirm the config i do following your
advice<br><br>ipsec --version output :<br><br>Linux Openswan
U2.1.5/K2.6.9-42.0.3.EL (native) (native)<br>See `ipsec --copyright' for
copyright information.<br><br>ipsec.conf :<br><br>config
setup<br> # Debug-logging
controls: "none" for (almost) none, "all" for
lots.<br> #
klipsdebug=all<br> #
plutodebug=dns<br>
interfaces="ipsec0=eth0" <br>conn
tunnelipsec<br>
type=
tunnel<br>
authby=
secret<br>
#RRT<br>
left=
myip<br>
leftsubnet= <a href="http://66.232.119.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">66.232.119.0/24</a><br>
leftnexthop= %defaultroute
<br>
#SAA<br>
right=
other_Company_ip<br>
rightsubnet=
the_same_other_company_Ip<br>
rightnexthop=
%defaultroute<br>
esp=
3des-md5-modp1024<br>
aggrmode= no
<br> keyexchange=
ike<br>
ikelifetime=
24.0m<br>
keylife=
1.0h<br>
pfs=
no<br>
auto=
start<br><br>=============end==============================<br><br><br>i need
confirm the parte of rightsubnet , i asking if i need acces of they subnet or
they just need a vpn encrypt with that server <br><br>the i dont know where
put the option of keylife and the other, so i assume is in the right side (
#SSA ) is this OK ? <br><br>Thanks<br><br>pd: sorry for my bad english <br>
<div><span class="gmail_quote"><font color="#0000ff" face="Arial" size="2"></font><font color="#0000ff" face="Arial" size="2"></font><br><br>On 6/11/07,
<b class="gmail_sendername">Peter McGill</b> <<a href="mailto:petermcgill@goco.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">petermcgill@goco.net</a>> wrote: </span>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">>
-----Original Message-----<br>> Date: Sat, 9 Jun 2007 12:29:41
-0400<br>> From: E0x < <a href="mailto:samudhio@gmail.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">samudhio@gmail.com</a>><br>> Subject:
[Openswan Users] openswan Side to Side config<br>> To: <a href="mailto:users@openswan.org" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">users@openswan.org</a><br>><br>>
Hello all i am new using openswan and i have this situation:
<br>><br>>
openswan.i386 2.1.5-1fc2<br>><br>>
OS:
Centos 4.5<br>><br>>
kernel:
2.6.9-42.0.3.EL<br>><br>> i have to do a side to side config with
another company but i<br>> dont sure what<br>> are they using i guess
is a something like a pix<br>> cisco because the info that they give for
the encryptation <br>> method that i can<br>> choose<br>><br>> i
choose this method:<br>> Phase 1 IKE Properties:<br>><br>> Key
Exchange: 3DES<br>> Data Integrity : MD5<br>> Renegotiate IKE SA: 1440
seconds<br>> DH-Group : Group 2 ( 1024 ) <br>> Use
Agressive Mode: Disable<br>><br>> Phase 2 IPsec
Properties:<br>><br>> Data Encryption : 3DES<br>> Data Integrity :
MD5<br>> Perfect Forward Secrecy: Disabled<br>> Renegotiate
: IPSEC SA`s Every : 3600 Seconds <br>> Support Site to Site
Compression : Disabled<br>><br>> other settings : pre-share secrets
must be at least 10 alpha/numeric<br>> characters long. also, they can
only be exchanged in a secure manner<br>> <br>>
====End====<br>><br>><br>> now in my site i have only one interface
( eth0 ) with 6<br>> public ip ( alias<br>> interface) ( eth0:1 .
eth0:2...etc )<br>> and i config openswan like this :<br>> config
setup <br>> #
Debug-logging controls: "none" for (almost) none,<br>> "all"
for lots.<br>> #
klipsdebug=all<br>> #
plutodebug=dns<br>><br>> conn
tunnelipsec<br>>
type= tunnel
<br>>
authby=
secret<br>>
#RRT<br>>
left=
one_of_My_Public_IP<br>>
leftsubnet= network-public_ip/24 <<a href="http://66.232.119.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://66.232.119.0/24
</a>><br>>
leftnexthop= %defaultroute<br>>
#SAA<br>>
right= the_another_company_ip<br>>
rightsubnet= where_i_put_the_Same_IP_that_Above<br>>
rightnexthop= %defaultroute
<br>>
esp= 3des-md5<br>>
keyexchange= ike<br>>
pfs= no<br>>
auto=
start<br><br>I would say your on the right track with this.<br>You should
set these to match the timeouts given:
<br>ikelifetime=24.0m<br>keylife=1.0h<br>You could also add these to the
conn:<br>ike=3des-md5-modp1024<br>aggrmode=no<br>If you have rightsubnet =
right, then you can only communicate with the<br>Foreign router, and not the
network beyond it, you'll probably need to <br>Put their subnet info in
rightsubnet.<br>If you have six public ip's, then you should probably have a
leftsubnet of /29.<br>Ie) If <a href="http://66.232.119.1" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">66.232.119.1</a>
- 6, then <a href="http://66.232.119.0/29" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">66.232.119.0/29</a>,<br>or <a href="http://66.232.119.33" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
66.232.119.33</a> - 38 then <a href="http://66.232.119.32/29" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">66.232.119.32/29</a>, etc...<br>You may need
an intefaces line for ip alias used for ipsec, if using klips. <br>Netkey
should ingnore the setting so it should be safe to set either way.<br>ipsec
--version will tell you which your using.<br>config
setup<br> interfaces="ipsec0=eth0:1"<br><br>You
secrets file should look like this: <br><left pub ip> <right pub
ip> : PSK "<secret>"<br><br>Lastly don't forget to setup firewall
(iptables) rules to allow both the ipsec and tunneled traffic.<br><br>>
#Disable Opportunistic Encryption <br>> include
/etc/ipsec.d/examples/no_oe.conf<br>><br>><br>>
=======end=======<br>><br>> now they will give me a key when i am
ready for the test i<br>> guest the key is<br>> config in
/etc/ipsec.secrets <br>><br>> so my question is : i know openswan is
for connect to private<br>> network trough<br>> internet but how i can
do that if in my case i dont have a<br>> private network ?<br>> what i
need put in the leftsubnet: option ? i need asking for <br>> the subnet
of<br>> another company too for set in some ipsec interface that
will<br>> create with i<br>> connect
?<br><br></blockquote></div><br></span></div></blockquote></div>
</blockquote></div><br>