<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=DE link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span lang=EN-US>After a update to openswan 2.5.17 i have a
strange problems with the rightid option.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>No matter what value i specify for rightid,
it seems that openswan always use %any.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>This problem is related to any connection
with a FQDN as rightid.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>For example a connection to a VPN- Gateway
with a dyndns address:<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>File /etc/ipsec.conf:<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>------------------------------------------------<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>config setup<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> interfaces="ipsec0=eth3"<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> uniqueids=yes<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> OE=off<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>conn durodues<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> left = 62.217.39.186<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> leftnexthop = 62.217.39.185<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> leftsubnet = 172.16.1.0/24<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> leftid = 62.217.39.186<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> right = durodues.dyndns.org<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> rightsubnet = 192.168.100.0/24<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> rightid = durodues.dyndns.org<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> pfs = yes<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> auto = route<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> authby = secret<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>File /etc/ipsec.conf:<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>------------------------------------------------<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>62.217.39.186 durodues.dyndns.org: PSK
"xxxx"<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>After a start of openswan with<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>"ipsec auto status" i get the
following messages.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>------------------------------------------------<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>000 "durodues":
172.16.1.0/24===62.217.39.186<62.217.39.186>[S=C]---62.217.39.185...217.220.236.8<durodues.dyndns.org>[%any,S=C]===192.168.100.0/24;
prospective erouted; eroute owner: #0<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>000 "durodues": myip=unset;
hisip=unset;<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>000 "durodues": ike_life:
3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>000 "durodues": policy:
PSK+ENCRYPT+TUNNEL+PFS+lKOD+rKOD; prio: 24,24; interface: eth3;<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>000 "durodues": newest ISAKMP SA:
#0; newest IPsec SA: #0;<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>And after ipsec auto --up durodues:<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>------------------------------------------------<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Apr 14 18:11:48 sirouter1 pluto[30555]:
durodues #1: initiating Main Mode<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Apr 14 18:11:48 sirouter1 pluto[30555]:
durodues #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Apr 14 18:11:48 sirouter1 pluto[30555]:
durodues #1: STATE_MAIN_I2: sent MI2, expecting MR2<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Apr 14 18:11:48 sirouter1 pluto[30555]:
durodues #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Apr 14 18:11:48 sirouter1 pluto[30555]:
durodues #1: STATE_MAIN_I3: sent MI3, expecting MR3<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Apr 14 18:11:49 sirouter1 pluto[30555]:
durodues #1: Main mode peer ID is ID_IPV4_ADDR: '217.220.236.8'<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Apr 14 18:11:49 sirouter1 pluto[30555]:
durodues #1: we require peer to have ID '%any', but peer declares
'217.220.236.8'<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Apr 14 18:11:49 sirouter1 pluto[30555]:
durodues #1: sending encrypted notification INVALID_ID_INFORMATION to
217.220.236.8:500<o:p></o:p></span></p>
</div>
</body>
</html>