<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Paul Wouters wrote:
<blockquote
cite="midPine.LNX.4.64.0710222055400.16744@newtla.xelerance.com"
type="cite">
<pre wrap="">On Mon, 22 Oct 2007, Tejas Jin wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I have had this system up and running for a month. It got rebooted and
now none of the road warriors can connect to it. I think I'm blinded by
it worked before and it should be working now. Maybe somebody else can
see the problem. It's not even making the first step key exchange
correctly.
</pre>
</blockquote>
<pre wrap=""><!---->
</pre>
<blockquote type="cite">
<pre wrap="">--------------------------------------------------------------------------------------------------------------
roadwarrior ipsec.conf
------------------------------------------------------------------------------------------------------------
</pre>
</blockquote>
<pre wrap=""><!---->
</pre>
<blockquote type="cite">
<pre wrap="">conn office
keyexchange=ike
esp=3des-md5
ike=3des-md5
authby=secret
pfs=yes
keylife=3600
right=66.211.219.100
rightsubnet=192.168.5.0/24
</pre>
</blockquote>
<pre wrap=""><!---->
This does not match with your server end, that is using 192.168.1.0/24
</pre>
<blockquote type="cite">
<pre wrap=""> #rightsourceip=
rightnexthop=%defaultroute
rightid=@firewall
left=%defaultroute
#leftsubnet=vhost:%priv,%no
</pre>
</blockquote>
<pre wrap=""><!---->
If the roadwarrior is behind NAT, you need to enable that leftsubnet line.
</pre>
</blockquote>
I corrected the other issues, but when I add this line to the road
warrior, I get<br>
root@warrior # ipsec auto --up office<br>
022 "office": We cannot identify ourselves with either end of this
connection.<br>
<br>
<blockquote
cite="midPine.LNX.4.64.0710222055400.16744@newtla.xelerance.com"
type="cite">
<pre wrap=""></pre>
<blockquote type="cite">
<pre wrap="">include /etc/ipsec.d/*.conf
-----------------------------------------------
ipsec.conf openswan server
-------------------------------------------------
config setup
# Debug-logging controls: "none" for (almost) none, "all" for lots.
# klipsdebug=none
# plutodebug="control parsing"
virtual_private=%v4:192.168.5.0/24
</pre>
</blockquote>
<pre wrap=""><!---->
You should list all RFC1918 address space here EXCEPT the one assigned to the server,
so: virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.18.1.0/24,%v4:!192.168.1.0/24
</pre>
<blockquote type="cite">
<pre wrap=""> nat_traversal=yes
conn office
keyexchange=ike
esp=3des-md5
ike=3des-md5
authby=secret
pfs=yes
keylife=3600
left=66.211.219.100
leftsubnet=192.168.1.0/24
leftsourceip=192.168.1.177
leftnexthop=%defaultroute
leftid=@firewall
right=%any
#rightsubnet=192.168.5.0/24
rightsubnet=vhost:%priv,%no
rightnexthop=%defaultroute
rightid=@warrior
</pre>
</blockquote>
<pre wrap=""><!---->
Paul
</pre>
</blockquote>
<br>
</body>
</html>