I wrote severals message about Vista rekeying problem. Some answers but without solution.<br>So, I decided to study pluto source code in order to write a patch to workaround this issue.<br>We are using Openswan 2.4.8 and 2.4.12 in production environment.<br>
<br>But I think that is better to study 2.6.x source code...<br><br>So I decided to try to upgrade my Openswan Test Box. And I've got a problem with NAT-T roadwarriors. IPSec connection seems to be ok but L2TP doesn't work (L2TP servers can't answer to New Session) and I found a difference in IPSec Policy for an Win2k roadwarrior...<br>
<br>With 2.4.8, I've got :<br># ip xfrm policy<br>src <a href="http://82.241.242.240/32">82.241.242.240/32</a> dst <a href="http://88.191.42.90/32">88.191.42.90/32</a> proto udp sport 1701 <br> dir in priority 2080 <br>
tmpl src <a href="http://0.0.0.0">0.0.0.0</a> dst <a href="http://0.0.0.0">0.0.0.0</a><br> proto esp reqid 16401 mode transport<br>src <a href="http://88.191.42.90/32">88.191.42.90/32</a> dst <a href="http://82.241.242.240/32">82.241.242.240/32</a> proto udp dport 1701 <br>
dir out priority 2080 <br> tmpl src <a href="http://0.0.0.0">0.0.0.0</a> dst <a href="http://0.0.0.0">0.0.0.0</a><br> proto esp reqid 16401 mode transport<br><br>With 2.6.15dr2 (same ipsec.conf, same roadwarrior : only a "make programs install"), I've got :<br>
# ip xfrm policy<br>src <a href="http://192.168.0.11/32">192.168.0.11/32</a> dst <a href="http://88.191.42.90/32">88.191.42.90/32</a> proto udp <br> dir in priority 2080 <br> tmpl src <a href="http://0.0.0.0">0.0.0.0</a> dst <a href="http://0.0.0.0">0.0.0.0</a><br>
proto esp reqid 16405 mode transport<br>src <a href="http://88.191.42.90/32">88.191.42.90/32</a> dst <a href="http://192.168.0.11/32">192.168.0.11/32</a> proto udp <br> dir out priority 2080 <br> tmpl src <a href="http://0.0.0.0">0.0.0.0</a> dst <a href="http://0.0.0.0">0.0.0.0</a><br>
proto esp reqid 16405 mode transport<br><br><br>It seems that Policy is based on Virtual IP and not Public IP and sport and dport are not set anymore.<br>It could explain why my L2TP servers can't respond to new clients...<br>
<br>I don't know what to do... Any idea ?<br><br>Thanks !<br>