Hello,<br><br>I'm trying to configure ipsec with a zywall 2 plus router.<br>I have successfully connect the zywall to my openswan box (debian + openswan).<br>I'm using NETKEY The server is a server that only have the public interface. I have created new one :<br>
<br><a href="http://192.168.2.1/24">192.168.2.1/24</a> ---- public ip of openswanbox --------- BOX ------------------ public ip of zywall --- <a href="http://192.168.10.0/24">192.168.10.0/24</a><br clear="all"><br>000 #4: "techvar":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27737s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate<br>
000 #4: "techvar" <a href="mailto:esp.531534b@217.128.239.227">esp.531534b@217.128.239.227</a> <a href="mailto:esp.fea97a54@88.191.91.113">esp.fea97a54@88.191.91.113</a> <a href="mailto:tun.0@217.128.239.227">tun.0@217.128.239.227</a> <a href="mailto:tun.0@88.191.91.113">tun.0@88.191.91.113</a> ref=0 refhim=4294901761<br>
000 #1: "techvar":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2330s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate<br><br>But, from each side, I can't ping any of other LAN subnet.<br>
<br>I I had this route in the zywall :<br><br>Destination<br><a href="http://192.168.2.0">192.168.2.0</a> / <a href="http://255.255.255.0">255.255.255.0</a> <br><br>Gateway<br><a href="http://192.168.10.1">192.168.10.1</a><br>
<br>I can ping the server (<a href="http://192.168.2.1">192.168.2.1</a>).<br><br>If I add this route in the server :<br>route add -net <a href="http://192.168.10.0/24">192.168.10.0/24</a> gw <a href="http://192.168.2.1">192.168.2.1</a><br>
<br>I can ping the router (<a href="http://192.168.10.1">192.168.10.1</a>) but I can't ping any of PC connected in the subnet <a href="http://192.168.10.0/24">192.168.10.0/24</a><br><br>conn techvar<br> #local<br>
left=<a href="http://88.191.91.113">88.191.91.113</a><br> leftsubnet=<a href="http://192.168.2.0/24">192.168.2.0/24</a><br> leftid=<a href="http://88.191.91.113">88.191.91.113</a><br> authby=secret<br>
pfs=yes<br> auth=esp<br> aggrmode=no<br> disablearrivalcheck=no<br> esp=3des-md5-96<br> # remote<br> right=<a href="http://217.128.239.227">217.128.239.227</a><br> rightsubnet=<a href="http://192.168.10.0/24">192.168.10.0/24</a><br>
rightid=<a href="http://217.128.239.227">217.128.239.227</a><br> auto=start<br><br>I'm using iptables on the server :<br># IPSEC<br>iptables -A INPUT -i eth1 -p tcp --dport 50 -j ACCEPT<br>iptables -A INPUT -i eth1 -p tcp --dport 51 -j ACCEPT<br>
iptables -A INPUT -i eth1 -p udp --destination-port 500 -j ACCEPT<br><br>Any idea to solve this probem ?<br>-- <br>- reza -<br>