<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
I had EXACTLY this same problem, except with a Sonicwall 4100. I posted <br>the question and got the answer a couple weeks back.<br><br>I got past it by adding "aggrmode=yes" to my connection definition.<br><br>Here's a few other things I did:<br><br>a) Named the leftid "GroupVPN" -- if I name the leftID anything else, <br>sonicwall won't connect...and yes I changed it in the secrets files too.<br><br>b) Took out leftsubnet in config file...not needed....leftIP/32 is default<br><br>c) Took out interfaces= in config file...not needed with netkey which is <br>default in Ubuntu with its 2.6 kernel<br><br>d) Took RSA line out of secrets file<br><br>e) left=%defaultroute<br><br>f) Took out xauth=yes as is no longer used <br>(http://readlist.com/lists/openswan.org/users/0/622.html)<br><br>g) CRITICAL: Go into the Sonicwall configuration utility and set the <br>following: VPN -> Settings -> GroupVPN configure -> Client tab->"Virtual <br>Adapter Settings" from "DHCP lease" to "DHCP lease or Manual Configuration"<br><br><br>Here is my config:<br><br>version 2.0 # conforms to second version of ipsec.conf specification<br><br>config setup<br>nat_traversal=yes<br>nhelpers=0<br><br>conn SonicWallOffice<br>type=tunnel # Needed for host-to-subnet<br>left=%defaultroute # this computer's external internet address<br>leftid=@GroupVPN # Can't be anything...needed to be this for Sonicwall<br>leftxauthclient=yes # Indicates the left side asks to be xauth authenticated<br>right= XX.YY.ZZ.AA # WAN IP address of SonicWALL<br>rightsubnet= 192.168.253.1/24 # Destination network (usually LAN subnet <br>of SonicWALL)<br>rightid=@blahblahblah # Peer ID - SonicWALL’s Unique Firewall Identifier<br>rightxauthserver=yes # Indicates the right side does the xauth <br>authentication<br>keyingtries=0 # Number of times ipsec should try to obtain a key 0=infinite<br>keyexchange=ike # This is the default (and only) value, here for <br>completeness<br>pfs=no # Perfect Forward Secrecy, default=yes (?????? why no)<br>auto=add # authorizes but doesn't start this connection at startup<br>auth=esp # Authenticate over ESP protocol (the default) as opposed to AH<br>esp=3des-md5 # ????????????? IKE Phase II Settings????<br>ike=3des-md5-modp1024 # ????????????? IKE Phase I Settings??? -modp1024 <br>= DH group 2<br>authby=secret # Authenticate By - Preshared Secret (needed for sonicwall)<br>aggrmode=yes # Aggressive Mode Phase 1 negotiations (requires use of IKE)<br><br>include /etc/ipsec.d/examples/no_oe.conf<br><br><br /><hr />See how Windows connects the people, information, and fun that are part of your life. <a href='http://clk.atdmt.com/MRT/go/msnnkwxp1020093175mrt/direct/01/' target='_new'>See Now</a></body>
</html>