<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<font size="-1"><font face="Arial">Hi,<br>
<br>
You can run commends whenever connection goes up and down by specifying
it in _updown script which is usually located at /usr/lib/ipsec<br>
and specify same updown script in your config if its not default.<br>
<br>
Regards,<br>
Utkarsh Shah<br>
</font></font><br>
<a class="moz-txt-link-abbreviated" href="mailto:users-request@openswan.org">users-request@openswan.org</a> wrote:
<blockquote cite="midmailman.898.1183151287.17318.users@openswan.org"
type="cite">
<pre wrap="">Send Users mailing list submissions to
<a class="moz-txt-link-abbreviated" href="mailto:users@openswan.org">users@openswan.org</a>
To subscribe or unsubscribe via the World Wide Web, visit
<a class="moz-txt-link-freetext" href="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</a>
or, via email, send a message with subject or body 'help' to
<a class="moz-txt-link-abbreviated" href="mailto:users-request@openswan.org">users-request@openswan.org</a>
You can reach the person managing the list at
<a class="moz-txt-link-abbreviated" href="mailto:users-owner@openswan.org">users-owner@openswan.org</a>
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Users digest..."
Today's Topics:
1. Re: Heartbeat and l2tp (James)
2. openswan to cisco pix ipsec problem (isakmp error) (Teodor Iacob)
3. Cisco IPSec incompatibility (mehrunes dagon)
4. Re: Problems when using subnet 0.0.0.0/0 (????? ??????)
5. there is a way to insert iptables rules dynamically on ipsec
tunnel creation??? (Matias Lopez Bergero)
----------------------------------------------------------------------
Message: 1
Date: Fri, 29 Jun 2007 10:45:50 -0700
From: James <a class="moz-txt-link-rfc2396E" href="mailto:james@nttmcl.com"><james@nttmcl.com></a>
Subject: Re: [Openswan Users] Heartbeat and l2tp
To: Jacco de Leeuw <a class="moz-txt-link-rfc2396E" href="mailto:jacco2@dds.nl"><jacco2@dds.nl></a>
Cc: <a class="moz-txt-link-abbreviated" href="mailto:users@openswan.org">users@openswan.org</a>
Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:4685454E.9010303@nttmcl.com"><4685454E.9010303@nttmcl.com></a>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Jacco de Leeuw wrote:
</pre>
<blockquote type="cite">
<pre wrap="">James wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi guys i have an issue with heartbeat and l2tp
i have heartbeat setup to take control of xxx.xxx.1.3
the real internal ip of the itnerface is xxx.xxx.1.4
i set ipsec.conf left = xxx.xxx.1.3
i set l2tpd.conf local ip = xxx.xxx.1.3
</pre>
</blockquote>
<pre wrap="">I don't know about your Heartbeat setup, but this is clearly wrong.
'left' and 'local ip' cannot be the same. 'left' is your external
interface and 'local ip' is an address on your internal network.
</pre>
<blockquote type="cite">
<pre wrap="">i notice that when i try connecting with a winxp client using those
settings it never gets to the l2tp authentiation stage
a tcpdump shows some of these:
</pre>
</blockquote>
<pre wrap="">I can't imagine that it works without the HA stuff as it is now.
Have you tried that first?
Jacco
</pre>
</blockquote>
<pre wrap=""><!---->yeah it worked fine without the ha stuff.
i changed the local ip for l2tp by the way. even though it worked before
i changed it.
------------------------------
Message: 2
Date: Fri, 29 Jun 2007 22:31:45 +0300
From: Teodor Iacob <a class="moz-txt-link-rfc2396E" href="mailto:theo@kappa.ro"><theo@kappa.ro></a>
Subject: [Openswan Users] openswan to cisco pix ipsec problem (isakmp
error)
To: <a class="moz-txt-link-abbreviated" href="mailto:users@openswan.org">users@openswan.org</a>
Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:46855E21.1060108@kappa.ro"><46855E21.1060108@kappa.ro></a>
Content-Type: text/plain; charset="iso-8859-1"
Hi,
I'm trying to setup a linux box to connect to a Cisco Pix device for
which you can find the config attached. Also attached you can find
the ipsec.conf and logs from both linux box and the cisco device.
I've been given by this provider the following comments to setup
this connection:
Encryption Phase 1(IKE):
Key management = IKE
Diffie-Hellman Group = 2
Encrypt Algorithm = 3DES
Hash Algorithm = SHA1
Authentication Method = Preshared
Life Time = 14400sec
Encryption Phase 2(IPSec):
Encapsulation = ESP
Encrypt Algorithm = 3DES
Hash Algorithm = SHA1
Perfect Forward Secrecy = NO
Life Time = 28800 sec
The connection is done over the internet with public ip addresses.
The linux box is running Fedora Core 6 with OpenSwan 2.4.5-2.1 (rpm package)
Any help is highly appreciated...
Thank you,
</pre>
</blockquote>
</body>
</html>