<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
Paul Wouters wrote:
<blockquote
cite="mid:Pine.LNX.4.64.0805281811580.26761@newtla.xelerance.com"
type="cite">
<pre wrap="">On Wed, 28 May 2008, Arjun Datta wrote:
</pre>
<blockquote type="cite">
<pre wrap="">This is a FreeSWAN version 2.0 question concerning a pre-existing setup
I have been asked to maintain. Before anyone asks, I cannot upgrade the
ipsec version as yet to openswan and and so am stuck using freeswan for
now =) (I know, I know, it's super old)
</pre>
</blockquote>
<pre wrap=""><!---->
It is. I wouldnt call it secure at this point.
</pre>
<blockquote type="cite">
<pre wrap=""> # (manual) base for SPI numbering; must end in 0
spibase=0x520
</pre>
</blockquote>
<pre wrap=""><!---->
Why are you using manual keying? In fact you sort of are not.
</pre>
<blockquote type="cite">
<pre wrap=""> # (auto) key-exchange type
keyexchange=ike
# (auto) key lifetime (before automatic rekeying)
keylife=8h
# (auto) how persistent to be in (re)keying negotiations (0
means very)
keyingtries=0
auto=start
</pre>
</blockquote>
<pre wrap=""><!---->
Because this says you are using automatic keying.
</pre>
<blockquote type="cite">
<pre wrap="">When I try to (re)start the connection,
left side says:
</pre>
</blockquote>
<pre wrap=""><!---->
</pre>
<blockquote type="cite">
<pre wrap="">000 #25: "corp-atlantat1" STATE_MAIN_I1 (sent MI1, expecting MR1);
EVENT_RETRANSMIT in 14s
</pre>
</blockquote>
<pre wrap=""><!---->
</pre>
<blockquote type="cite">
<pre wrap="">Is this because right is freeswan 2.0 and left is freeswan 1.0 ?
</pre>
</blockquote>
<pre wrap=""><!---->
Who knows with relics software like that. Normally, I would say
this is a firewall issue. You send 1 packet, the other end receives
0 packets.
Unless you work on the space shuttle or phoenix program though, I
would phase out freeswan ASAP.
Paul
</pre>
</blockquote>
<br>
<font size="-1"><font face="Arial">Hi Paul,<br>
<br>
I agree but I have to work with what I have been given =)<br>
<br>
I figured out the problem, if you are curious.<br>
<br>
I had to comment out the 'left firewall = x.x.x.x' and 'right firewall
= x.x.x.x' in the ipsec.conf file on the freeswan 2.06 (Linux
2.4.20-30.9) machine but left them on the freeswan 1.0 (Linux 2.0.36).<br>
<br>
On the freeswan 2.0.36 machine I also had to add the following line to
iptables<br>
-A FORWARD -i eth1 -j ACCEPT<br>
</font></font><font size="-1"><font face="Arial"><br>
where eth1 is the external NIC<br>
</font></font>
<pre class="moz-signature" cols="72">Regards,
Arjun Datta
</pre>
<br>
</body>
</html>