<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>There is classic tunnel between openswan-2.4.12rc3 and cisco
asa-5510<br>
<br>
</tt><tt>[root@mail root]# ipsec --version<br>
Linux Openswan 2.4.12rc3 (klips)<br>
<br>
</tt>
<hr size="2" width="100%"><tt>/etc/ipsec.conf<br>
...<br>
config setup<br>
interfaces="ipsec0=eth2"<br>
klipsdebug=none<br>
plutodebug=none<br>
uniqueids=yes<br>
nat_traversal=no<br>
<br>
conn %default<br>
leftrsasigkey=%none<br>
rightrsasigkey=%none<br>
type=tunnel<br>
compress=no<br>
auth=esp<br>
authby=secret<br>
keyexchange=ike<br>
disablearrivalcheck=yes<br>
<br>
conn block<br>
auto=ignore<br>
<br>
conn private<br>
auto=ignore<br>
<br>
conn private-or-clear<br>
auto=ignore<br>
<br>
conn clear-or-private<br>
auto=ignore<br>
<br>
conn clear<br>
auto=ignore<br>
<br>
conn packetdefault<br>
auto=ignore<br>
<br>
conn OPS-AND-OPS<br>
rekey=no<br>
dpddelay=30<br>
dpdtimeout=120<br>
dpdaction=restart<br>
compress=no<br>
ike=3des-sha1-modp1024<br>
esp=3des-sha1<br>
left=xxx.x.xxx.178<br>
leftnexthop=xxx.x.xxx.177<br>
leftsubnet=10.101.0.0/16<br>
right=xxx.xx.xxx.172<br>
rightnexthop=xxx.xx.xxx.169<br>
rightsubnet=10.102.0.0/16<br>
ikelifetime=3600<br>
keylife=7200<br>
pfs=no<br>
auto=start<br>
<br>
</tt>
<hr size="2" width="100%"><tt>Script to test tunnel ...<br>
---<br>
#! /bin/bash<br>
<br>
(<br>
export endPoint="10.102.3.1"<br>
export logFile=${endPoint}.log<br>
export sleepSec=10<br>
(<br>
<br>
let status=1<br>
<br>
echo "$endPoin = $endPoint, logFile = $logFile, sleepSec = $sleepSec"<br>
<br>
while : ; do<br>
<br>
ping -c 1 -w 2 ${endPoint} > /dev/null 2>&1<br>
if [ $? -eq 0 ] ; then<br>
if [ $status -ne 0 ] ; then<br>
let status=0<br>
echo "`date`: status = SUCCESS"<br>
fi<br>
else<br>
if [ $status -eq 0 ] ; then<br>
let status=1<br>
echo "`date`: status = PROBLEM"<br>
fi<br>
<br>
fi<br>
<br>
sleep $sleepSec<br>
done<br>
<br>
) > ${logFile} 2>&1 &<br>
<br>
)<br>
</tt>
<hr size="2" width="100%"><tt>Result of testing:<br>
...<br>
</tt><tt>Mar 8 22:14:55 EET 2008: status = SUCCESS<br>
</tt><tt>Mar </tt><tt>8 22:49:31 EET 2008: status = PROBLEM<br>
</tt><tt>Mar </tt><tt>8 23:49:08 EET 2008: status = SUCCESS<br>
</tt><tt>Mar </tt><tt>9 00:34:45 EET 2008: status = PROBLEM<br>
</tt><tt>Mar </tt><tt>9 01:33:45 EET 2008: status = SUCCESS<br>
</tt><tt>Mar </tt><tt>9 02:19:12 EET 2008: status = PROBLEM<br>
</tt><tt>Mar </tt><tt>9 03:22:50 EET 2008: status = SUCCESS<br>
</tt><tt>Mar </tt><tt>9 04:08:27 EET 2008: status = PROBLEM<br>
</tt><tt>Mar </tt><tt>9 05:13:41 EET 2008: status = SUCCESS<br>
</tt><tt>Mar </tt><tt>9 05:59:18 EET 2008: status = PROBLEM<br>
</tt><tt>Mar </tt><tt>9 06:59:55 EET 2008: status = SUCCESS<br>
</tt><tt>Mar </tt><tt>9 07:45:33 EET 2008: status = PROBLEM<br>
</tt><tt>Mar </tt><tt>9 08:50:46 EET 2008: status = SUCCESS<br>
</tt><tt>Mar </tt><tt>9 09:36:23 EET 2008: status = PROBLEM<br>
</tt><tt>Mar </tt><tt>9 10:40:24 EET 2008: status = SUCCESS<br>
</tt><tt>Mar </tt><tt>9 11:25:52 EET 2008: status = PROBLEM<br>
</tt><tt>Mar </tt><tt>9 12:29:17 EET 2008: status = SUCCESS<br>
</tt><tt>Mar </tt><tt>9 13:14:44 EET 2008: status = PROBLEM<br>
</tt>
<hr size="2" width="100%"><tt><br>
Rekey = yes/no do not solve the problem<br>
<br>
Config on cisco ASA-5510<br>
---<br>
crypto map outside_map 20 set transform-set ESP-3DES-SHA<br>
crypto map outside_map 20 set security-association lifetime seconds 7200<br>
crypto map outside_map 20 set nat-t-disable<br>
<br>
crypto isakmp policy 10<br>
authentication pre-share<br>
encryption 3des<br>
hash sha<br>
group 2<br>
lifetime 3600<br>
<br>
</tt>
<hr size="2" width="100%"><tt>All links to lists.freeswan.org are
outdated<br>
<br>
<a class="moz-txt-link-freetext" href="http://www.freeswan.org/freeswan_trees/freeswan-2.01/doc/interop.html">http://www.freeswan.org/freeswan_trees/freeswan-2.01/doc/interop.html</a><br>
...<br>
=> A Linux FreeS/WAN-Cisco connection may close after some time.<a
href="http://lists.freeswan.org/pipermail/users/2001-December/005758.html">
Here</a> ( </tt><tt><a class="moz-txt-link-freetext" href="http://lists.freeswan.org/pipermail/users/2001-December/005758.html">http://lists.freeswan.org/pipermail/users/2001-December/005758.html</a>
) is a workaround.<br>
</tt><tt>...<br>
<br>
How can I solve this problem?<br>
<br>
</tt>
<pre class="moz-signature" cols="72"><tt>--
There is a great difference between
"be involved" and "be committed".
Usually we are committed...
</tt>
</pre>
</body>
</html>