<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16640" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=764331719-25042008><FONT face=Arial
color=#0000ff size=2>Only way I know of using openswan is to use
xl2tpd.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=764331719-25042008><FONT face=Arial
color=#0000ff size=2>IPSec doesn't handle virtual IPs.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=764331719-25042008><FONT face=Arial
color=#0000ff size=2>L2TP does.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=764331719-25042008><FONT face=Arial
color=#0000ff size=2>That's how Windows IPSec works, it's actually
L2TP/IPSec.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=764331719-25042008><FONT face=Arial
color=#0000ff size=2>L2TP running on top of IPSec for
security.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=764331719-25042008><FONT face=Arial
color=#0000ff size=2>Look for Jacco's docs on setting up l2tp client with
ipsec.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=764331719-25042008><FONT face=Arial
color=#0000ff size=2>Specifically it's recommended to use xl2tpd (from
xelerance,</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=764331719-25042008><FONT face=Arial
color=#0000ff size=2>the makers of openswan) with openswan.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=764331719-25042008><FONT face=Arial
color=#0000ff size=2>Note that I haven't done this myself, so I'm cc'ing the
list, in</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=764331719-25042008><FONT face=Arial
color=#0000ff size=2>case someone else has better or more specific advice
here.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=764331719-25042008><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=764331719-25042008><FONT face=Arial
color=#0000ff size=2>Note, your openswan version is a little out of
date...</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=764331719-25042008><FONT face=Arial
color=#0000ff size=2>I think 2.4.11 is the official stable
version.</FONT></SPAN></DIV>
<DIV><FONT face=Arial color=#0000ff size=2></FONT> </DIV>
<DIV align=left><FONT face=Arial size=2>Peter McGill</FONT></DIV>
<DIV> </DIV><BR>
<BLOCKQUOTE
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> Chris Zimmerman
[mailto:czimmer@wczimmerman.dyndns.org] <BR><B>Sent:</B> April 25, 2008 3:15
PM<BR><B>To:</B> petermcgill@goco.net<BR><B>Subject:</B> Re: [Openswan Users]
Anyone? Anyone? "Roadwarrior" to SonicWall VPNrouting
issues<BR></FONT><BR></DIV>
<DIV></DIV>Ah-then that may be the issue. My presence on the remote LAN
is with my Internet IP. The other Windows clients that connect to this
VPN using the Sonicwall client are assigned a dynamic address which is on the
local LAN (192.168.1.x) and the client also creates routes at connection
time to allow them to navigate through to the <A
href="http://192.168.2.0/24">192.168.2.0/24</A> and other remote
networks. <BR><BR>So-how can I assign a "local" ip to my
connection? Is this even possible? <BR><BR>Thanks so much again
for your help. <BR><BR>
<DIV class=gmail_quote>On Fri, Apr 25, 2008 at 12:10 PM, Peter McGill <<A
href="mailto:petermcgill@goco.net">petermcgill@goco.net</A>> wrote:<BR>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">
<DIV>
<P><SPAN lang=en-us><FONT face=Arial color=#0000ff size=2>I cannot see
anything wrong here, everything looks correct.</FONT></SPAN> <BR><SPAN
lang=en-us><FONT face=Arial color=#0000ff size=2>Your connections are
connected successfully,</FONT></SPAN> <BR><SPAN lang=en-us><FONT face=Arial
color=#0000ff size=2>You have not firewall rules blocking
traffic,</FONT></SPAN> <BR><SPAN lang=en-us><FONT face=Arial color=#0000ff
size=2>The routes have been put in by IPSec.</FONT></SPAN> <BR><SPAN
lang=en-us><FONT face=Arial color=#0000ff size=2>Are you sure it's not a
routing problem on the other side of the SonicWall?</FONT></SPAN> <BR><SPAN
lang=en-us><FONT face=Arial color=#0000ff size=2>Ie) The computers in the
2.0 net and/or their gateway, will need to know to send</FONT></SPAN>
<BR><SPAN lang=en-us><FONT face=Arial color=#0000ff size=2>Traffic destined
for your ip address (68.27..) to the SonicWall (or 1.0 net) for
delivery,</FONT></SPAN> <BR><SPAN lang=en-us><FONT face=Arial color=#0000ff
size=2>And not to their usual internet connection (assuming it isn't the
SonicWall.)</FONT></SPAN> <BR><SPAN lang=en-us><FONT face=Arial
color=#0000ff size=2>Try sniffing the traffic at the lan side of the
SonicWall do your tests for 2.0 appear but</FONT></SPAN> <BR><SPAN
lang=en-us><FONT face=Arial color=#0000ff size=2>Without
responses?</FONT></SPAN> </P><BR>
<P><SPAN lang=en-us><FONT face=Arial size=2>Peter McGill</FONT></SPAN>
</P><BR>
<UL>
<P></P>
<DIV class=Ih2E3d><SPAN lang=en-us><FONT face=Tahoma
size=1>_____________________________________________
</FONT></SPAN><BR><SPAN lang=en-us><B><FONT face=Tahoma size=1>From:
</FONT></B> <FONT face=Tahoma size=1>Chris Zimmerman
[</FONT></SPAN><A href="mailto:czimmer@wczimmerman.dyndns.org"
target=_blank><SPAN lang=en-us><U><FONT face=Tahoma color=#0000ff
size=1>mailto:czimmer@wczimmerman.dyndns.org</FONT></U></SPAN></A><SPAN
lang=en-us><FONT face=Tahoma size=1>] </FONT></SPAN><BR></DIV><SPAN
lang=en-us><B><FONT face=Tahoma size=1>Sent: </FONT></B> <FONT
face=Tahoma size=1>April 25, 2008 2:27 PM</FONT></SPAN> <BR>
<DIV class=Ih2E3d><SPAN lang=en-us><B><FONT face=Tahoma
size=1>To: </FONT></B> <FONT face=Tahoma size=1><A
href="mailto:petermcgill@goco.net"
target=_blank>petermcgill@goco.net</A></FONT></SPAN> <BR><SPAN
lang=en-us><B><FONT face=Tahoma
size=1>Subject: </FONT></B> <FONT
face=Tahoma size=1>Re: [Openswan Users] Anyone? Anyone? "Roadwarrior" to
SonicWall VPNrouting issues</FONT></SPAN> </DIV>
<P><SPAN lang=en-ca><FONT face=Arial>See attached.
<DIV class=Ih2E3d><BR><BR>I did scrub the file a bit (to protect the
innocent) and the only deviation from my original post/IP's is that my
Sonicwall device is </DIV></FONT></SPAN><A href="http://63.63.63.63"
target=_blank><SPAN lang=en-ca><U><FONT face=Arial
color=#0000ff>63.63.63.63</FONT></U></SPAN></A><SPAN lang=en-ca><FONT
face=Arial> in the output file rather than </FONT></SPAN><A
href="http://1.1.1.1" target=_blank><SPAN lang=en-ca><U><FONT face=Arial
color=#0000ff>1.1.1.1</FONT></U></SPAN></A><SPAN lang=en-ca><FONT
face=Arial>. If the scrubbing makes things more confusing, then I
can send the original output to you as well. I wasn't comfortable
with sending that info to the whole
list.<BR><BR>Thanks!<BR><BR><BR><BR></FONT></SPAN>
<P></P>
<DIV class=Ih2E3d><BR><SPAN lang=en-ca><FONT face=Arial>On Fri, Apr 25,
2008 at 11:23 AM, Peter McGill <</FONT></SPAN><A
href="mailto:petermcgill@goco.net" target=_blank><SPAN lang=en-ca><U><FONT
face=Arial color=#0000ff>petermcgill@goco.net</FONT></U></SPAN></A><SPAN
lang=en-ca><FONT face=Arial>> wrote:<BR></FONT></SPAN></DIV>
<DIV class=Ih2E3d>
<UL>
<P><SPAN lang=en-ca><FONT face=Arial color=#0000ff size=2>Other people
might appreciate not receiving a large barf, so it may be best to try
just me</FONT></SPAN> <BR><SPAN lang=en-ca><FONT face=Arial
color=#0000ff size=2>first, unless I cannot resolve your
problem.</FONT></SPAN> <BR><SPAN lang=en-ca><FONT
face=Arial> </FONT></SPAN> <BR><SPAN lang=en-ca><FONT face=Arial
size=2>Peter McGill</FONT></SPAN> <BR><SPAN lang=en-ca><FONT
face=Arial> </FONT></SPAN> </P><BR></UL>
<P align=justify><U><SPAN lang=en-us><FONT
face="Courier New"> </FONT><FONT face="Courier New"> _____
<BR></FONT></SPAN></U></P></DIV>
<UL>
<UL>
<P><SPAN lang=en-us><B><FONT face=Tahoma size=2>From:</FONT></B><FONT
face=Tahoma size=2> Chris Zimmerman [</FONT></SPAN><A
href="mailto:HYPERLINK" target=_blank><SPAN lang=en-us><FONT
face=Tahoma size=2>mailto:HYPERLINK
"mailto:czimmer@wczimmerman.dyndns.org" \\n</FONT><U><FONT face=Tahoma
color=#0000ff
size=2>czimmer@wczimmerman.dyndns.org</FONT></U></SPAN></A><SPAN
lang=en-us><FONT face=Tahoma size=2>]<BR></FONT>
<DIV>
<DIV></DIV>
<DIV class=Wj3C7c><B><FONT face=Tahoma size=2>Sent:</FONT></B><FONT
face=Tahoma size=2> April 25, 2008 2:16 PM<BR></FONT><B><FONT
face=Tahoma size=2>To:</FONT></B><FONT face=Tahoma size=2>
</FONT></DIV></DIV></SPAN><A href="mailto:petermcgill@goco.net"
target=_blank><SPAN lang=en-us><U><FONT face=Tahoma color=#0000ff
size=2>petermcgill@goco.net</FONT></U></SPAN></A>
<P></P>
<DIV>
<DIV></DIV>
<DIV class=Wj3C7c><SPAN lang=en-us><BR><B><FONT face=Tahoma
size=2>Subject:</FONT></B><FONT face=Tahoma size=2> Re: [Openswan
Users] Anyone? Anyone? "Roadwarrior" to SonicWall VPNrouting
issues<BR></FONT><BR></SPAN><BR><SPAN lang=en-ca><FONT
face=Arial>Would you rather I post the output of ipsec barf on the
list or to you directly?<BR><BR>Thanks!<BR><BR></FONT></SPAN><BR><SPAN
lang=en-ca><FONT face=Arial>On Fri, Apr 25, 2008 at 10:35 AM, Peter
McGill <</FONT></SPAN><A href="mailto:petermcgill@goco.net"
target=_blank><SPAN lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT
face=Arial color=#0000ff>petermcgill@goco.net</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><FONT face=Arial>>
wrote:<BR></FONT></SPAN></DIV></DIV>
<DIV>
<DIV></DIV>
<DIV class=Wj3C7c>
<UL>
<P><SPAN lang=en-ca><FONT face=Arial color=#0000ff size=2>Well I've
never worked with XAUTH or a SonicWall specifically, but two general
suggestions.</FONT></SPAN> <BR><SPAN lang=en-ca><FONT face=Arial
color=#0000ff size=2>1) This might just be an email typo,
but...</FONT></SPAN> <BR><SPAN lang=en-ca><FONT face=Arial
color=#0000ff size=2>conn net2</FONT></SPAN> <BR><SPAN
lang=en-ca><FONT face=Arial color=#0000ff size=2>
rightsubnet=</FONT></SPAN><A href="http://192.168.2.0"
target=_blank><SPAN lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT
face=Arial color=#0000ff size=2>192.168.2.0</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca></SPAN> <BR><SPAN
lang=en-ca><FONT face=Arial color=#0000ff size=2>should
be</FONT></SPAN> <BR><SPAN lang=en-ca><FONT
face=Arial> </FONT><FONT face=Arial color=#0000ff
size=2>rightsubnet=</FONT></SPAN><A href="http://192.168.2.0/24"
target=_blank><SPAN lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT
face=Arial color=#0000ff
size=2>192.168.2.0/24</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca></SPAN> <BR><SPAN
lang=en-ca><FONT face=Arial> </FONT></SPAN> <BR><SPAN
lang=en-ca><FONT face=Arial color=#0000ff size=2>Otherwise from the
information provided, I cannot see any problems, so...</FONT></SPAN>
<BR><SPAN lang=en-ca><FONT face=Arial color=#0000ff size=2>2) Give
us more information.</FONT></SPAN> <BR><SPAN lang=en-ca><FONT
face=Arial color=#0000ff size=2>The output of...</FONT></SPAN>
<BR><SPAN lang=en-ca><FONT face=Arial color=#0000ff size=2>ipsec
barf</FONT></SPAN> <BR><SPAN lang=en-ca><FONT face=Arial
color=#0000ff size=2>Preferably in an attachment and not the email
body.</FONT></SPAN> <BR><SPAN lang=en-ca><FONT face=Arial
color=#0000ff size=2>Note from man ipsec_barf:</FONT></SPAN> </P>
<P><SPAN lang=en-ca><FONT face=Arial color=#0000ff
size=2> Barf censors its output,
replacing keys and secrets with brief check-<BR>
sums to avoid revealing sensitive information.</FONT></SPAN>
<BR><SPAN lang=en-ca><FONT face=Arial color=#0000ff size=2>Also send
us the SonicWall configuration information (without keys of
course).</FONT></SPAN> <BR><SPAN lang=en-ca><FONT
face=Arial> </FONT></SPAN> <BR><SPAN lang=en-ca><FONT
face=Arial color=#0000ff size=2>As for your firewall question, You
need to allow the following in/out connections:</FONT></SPAN>
<BR><SPAN lang=en-ca><FONT face=Arial color=#0000ff
size=2>udp/isakmp (proto 17 port 500)</FONT></SPAN> <BR><SPAN
lang=en-ca><FONT face=Arial color=#0000ff size=2>esp (proto
50)</FONT></SPAN> <BR><SPAN lang=en-ca><FONT face=Arial
color=#0000ff size=2>And if using NAT-T</FONT></SPAN> <BR><SPAN
lang=en-ca><FONT face=Arial color=#0000ff size=2>udp/4500 (proto 17
port 4500)</FONT></SPAN> <BR><SPAN lang=en-ca><FONT face=Arial
color=#0000ff size=2>If the firewall is on the same computer as
IPSec, then you'll also need to allow,</FONT></SPAN> <BR><SPAN
lang=en-ca><FONT face=Arial color=#0000ff size=2>the private
tunnelled traffic ie) to/from </FONT></SPAN><A
href="http://192.168.1.0/24" target=_blank><SPAN
lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT face=Arial color=#0000ff
size=2>192.168.1.0/24</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><FONT face=Arial
color=#0000ff size=2> and </FONT></SPAN><A
href="http://192.168.2.0/24" target=_blank><SPAN
lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT face=Arial color=#0000ff
size=2>192.168.2.0/24</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><FONT face=Arial
color=#0000ff size=2>.</FONT></SPAN> <BR><SPAN lang=en-ca><FONT
face=Arial color=#0000ff size=2>If your using SNAT or MASQUERADE on
your IPSec device, you'll need to exempt,</FONT></SPAN> <BR><SPAN
lang=en-ca><FONT face=Arial color=#0000ff size=2>the private
tunnelled traffic from that.</FONT></SPAN> <BR><SPAN
lang=en-ca><FONT face=Arial color=#0000ff size=2>If the firewall is
on a different computer between IPSec endpoints, then you'll need
to</FONT></SPAN> <BR><SPAN lang=en-ca><FONT face=Arial color=#0000ff
size=2>forward the above isakmp, esp and possibly NAT-T inbound to
the IPSec router to accept</FONT></SPAN> <BR><SPAN lang=en-ca><FONT
face=Arial color=#0000ff size=2>connections from the other
side.</FONT></SPAN> <BR><SPAN lang=en-ca><FONT
face=Arial> </FONT></SPAN> <BR><SPAN lang=en-ca><FONT
face=Arial size=2>Peter McGill</FONT></SPAN> <BR><SPAN
lang=en-ca><FONT face=Arial> </FONT></SPAN>
</P><BR></UL></DIV></DIV></UL></UL>
<P align=justify><U><SPAN lang=en-us><FONT
face="Courier New"> </FONT><FONT face="Courier New"> _____
<BR></FONT></SPAN></U></P>
<UL>
<UL>
<UL>
<UL>
<P><SPAN lang=en-us><B><FONT face=Tahoma
size=2>From:</FONT></B><FONT face=Tahoma size=2> </FONT></SPAN><A
href="mailto:users-bounces@openswan.org" target=_blank><SPAN
lang=en-us><U><FONT face=Tahoma color=#0000ff
size=2>users-bounces@openswan.org</FONT></U></SPAN></A><SPAN
lang=en-us><FONT face=Tahoma size=2> [</FONT></SPAN><A
href="mailto:HYPERLINK" target=_blank><SPAN lang=en-us><FONT
face=Tahoma size=2>mailto:HYPERLINK
"mailto:users-bounces@openswan.org" \\n</FONT><U><FONT face=Tahoma
color=#0000ff
size=2>users-bounces@openswan.org</FONT></U></SPAN></A><SPAN
lang=en-us><FONT face=Tahoma size=2>]</FONT><B> <FONT face=Tahoma
size=2>On Behalf Of</FONT></B> <FONT face=Tahoma size=2>Chris
Zimmerman<BR></FONT>
<DIV>
<DIV></DIV>
<DIV class=Wj3C7c><B><FONT face=Tahoma
size=2>Sent:</FONT></B><FONT face=Tahoma size=2> April 25, 2008
1:00 PM<BR></FONT><B><FONT face=Tahoma size=2>To:</FONT></B><FONT
face=Tahoma size=2> </FONT></DIV></DIV></SPAN><A
href="mailto:users@openswan.org" target=_blank><SPAN
lang=en-us><U><FONT face=Tahoma color=#0000ff
size=2>users@openswan.org</FONT></U></SPAN></A>
<P></P>
<DIV>
<DIV></DIV>
<DIV class=Wj3C7c><SPAN lang=en-us><BR><B><FONT face=Tahoma
size=2>Subject:</FONT></B><FONT face=Tahoma size=2> [Openswan
Users] Anyone? Anyone? "Roadwarrior" to SonicWall VPNrouting
issues<BR></FONT><BR></SPAN><BR><SPAN lang=en-ca><FONT
face=Arial>I'm not trying to be a pest, but I have to get this
working:<BR><BR>I have been fighting through this setup for more
than a week now and I'm at a brick wall. <BR><BR>My
setup:<BR><BR>my.ip-----------{internet}-----</FONT></SPAN><A
href="http://1.1.1.1" target=_blank><SPAN lang=en-ca></SPAN><SPAN
lang=en-ca><U><FONT face=Arial
color=#0000ff>1.1.1.1</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><FONT
face=Arial>(sonicwall)</FONT></SPAN><A href="http://192.168.1.254"
target=_blank><SPAN lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT
face=Arial color=#0000ff>192.168.1.254</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><FONT
face=Arial>========[</FONT></SPAN><A href="http://192.168.1.0/24"
target=_blank><SPAN lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT
face=Arial color=#0000ff>192.168.1.0/24</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><BR></SPAN><BR><SPAN
lang=en-ca><FONT
face=Arial>
[--------[</FONT></SPAN><A href="http://192.168.1.1/"
target=_blank><SPAN lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT
face=Arial color=#0000ff>192.168.1.1</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><FONT
face=Arial>(router)</FONT></SPAN><A href="http://192.168.2.1/"
target=_blank><SPAN lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT
face=Arial color=#0000ff>192.168.2.1</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><FONT
face=Arial>]----------</FONT></SPAN><A
href="http://192.168.2.0/24" target=_blank><SPAN
lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT face=Arial
color=#0000ff>192.168.2.0/24</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><BR><FONT
face=Arial> <BR><BR>I
am connected to the internet over an aircard using Ubuntu, so no
NAT'ing is in the way on my end. I need to establish a
tunnel from my machine to the sonicwall to gain access to the
</FONT></SPAN><A href="http://192.168.1.0/" target=_blank><SPAN
lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT face=Arial
color=#0000ff>192.168.1.0</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><FONT face=Arial> AND
</FONT></SPAN><A href="http://192.168.2.0/" target=_blank><SPAN
lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT face=Arial
color=#0000ff>192.168.2.0</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><FONT face=Arial>
networks. I am using XAUTH on the Sonicwall and it has NAT
traverse enabled. I can successfully authenticate and
connect to the </FONT></SPAN><A href="http://192.168.1.0/"
target=_blank><SPAN lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT
face=Arial color=#0000ff>192.168.1.0</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><FONT face=Arial> network
and I can ping </FONT></SPAN><A href="http://192.168.1.1/"
target=_blank><SPAN lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT
face=Arial color=#0000ff>192.168.1.1</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><FONT face=Arial>. I
can also ping </FONT></SPAN><A href="http://192.168.2.1/"
target=_blank><SPAN lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT
face=Arial color=#0000ff>192.168.2.1</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><FONT face=Arial> (other
interface on the router) but I cannot ping any other IP's on the
2.0 network. This connection is using the GroupVPN SA on the
Standard OS Sonicwall. How do I configure
this? <BR><BR>Here's my ipsec.conf config:<BR><BR>config
setup<BR><BR>conn block<BR> auto=ignore<BR>conn
private<BR> auto=ignore<BR>conn
private-or-clear<BR> auto=ignore<BR>conn
clear-or-private<BR> auto=ignore<BR>conn
clear<BR> auto=ignore<BR>conn
packetdefault<BR> auto=ignore<BR><BR>conn
net1<BR>
left=my.ip<BR>
leftid=@home<BR>
leftxauthclient=yes<BR> right=ip.sonicwall
(internet)<BR>
rightsubnet=</FONT></SPAN><A href="http://192.168.1.0/24"
target=_blank><SPAN lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT
face=Arial color=#0000ff>192.168.1.0/24</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><BR><FONT
face=Arial>
rightxauthserver=yes<BR>
rightid=@sonicwall identifier<BR> <snip
auth lines><BR> <BR><BR>conn
net2<BR>
left=my.ip<BR>
leftid=@home<BR>
leftxauthclient=yes<BR> right=ip.sonicwall
(internet)<BR>
rightsubnet=</FONT></SPAN><A href="http://192.168.2.0/"
target=_blank><SPAN lang=en-ca></SPAN><SPAN lang=en-ca><U><FONT
face=Arial color=#0000ff>192.168.2.0</FONT></U></SPAN><SPAN
lang=en-ca></SPAN></A><SPAN lang=en-ca><BR><FONT
face=Arial>
rightxauthserver=yes<BR>
rightid=@sonicwall identifier<BR> <snip
auth lines><BR><BR>I've read through countless mailing lists
and google links and the openswan wiki, but I cannot figure out
how to get this working. It has to be a routing issue but I
am still unfamiliar with ipsec so I am unsure of what to
change.<BR><BR>ANY assistance would be great!!<BR><BR>I would also
like to know what, if anything, would need to change for me to
connect this tunnel when my machine (laptop) is behind a firewall,
too.</FONT></SPAN></DIV></DIV><BR><BR></UL></UL></UL></UL>
<P><SPAN lang=en-ca><B><FONT face=System size=2> << File:
ipsec.barf.output >>
</FONT></B></SPAN></P></UL></DIV></BLOCKQUOTE></DIV><BR></BLOCKQUOTE></BODY></HTML>