<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
</style>
</head>
<body class='hmmessage'>
To all,<br><br>I am having trouble understanding the "ike" parameter in the ipsec.conf file. According to the man page <br><br>ike=cipher-hash-modgroup but what are all the possible choices. <br><br>The man page for ipsec.conf shows some examples which I am trying between two machines I am using. The conn definition I am using is below. On the otherside of the "ike" parameter is not set therefore defaulting to allowing all possible combinations.<br><br>conn ipsec0<br> authby=secret<br> type=tunnel<br> ike=3des-md5-modp1024<br> left=172.16.163.128<br> right=172.16.163.130<br> auto=ignore<br><br>However when I "ipsec auto --replace ipsec0" followed by "ipsec auto --status on 172.16.163.128 I get the following:<br><br>000 interface ipsec0/eth2 172.16.163.128<br>000 %myid = (none)<br>000 debug raw+crypt+parsing+emitting+control+lifecycle+klips+dns+oppo+controlmore+pfkey+nattraversal+x509<br>000<br>000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64, keysizemin=192, keysizemax=192<br>000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=128, keysizemin=128, keysizemax=256<br>000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128<br>000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160<br>000<br>000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192<br>000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128<br>000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<br>000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<br>000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024<br>000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536<br>000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048<br>000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072<br>000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096<br>000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144<br>000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192<br>000<br>000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}<br>000<br>000 "ipsec0": 172.16.163.128...172.16.163.130; unrouted; eroute owner: #0<br>000 "ipsec0": srcip=unset; dstip=unset; srcup=ipsec _updown; dstup=ipsec _updown;<br>000 "ipsec0": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0<br>000 "ipsec0": policy: PSK+ENCRYPT+TUNNEL+PFS; prio: 32,32; interface: eth2; encap: esp;<br>000 "ipsec0": newest ISAKMP SA: #0; newest IPsec SA: #0;<br>000 "ipsec0": IKE algorithms wanted: 3DES_CBC(5)_000-MD5(1)-MODP1024(2); flags=strict<br>000 "ipsec0": IKE algorithms found: 3DES_CBC(5)_192-MD5(1)_128-MODP1024(2)<br><br>Then after about 2 minutes I did the "ipsec auto --status" again and got the following:<br><br>000 interface ipsec0/eth2 172.16.163.128<br>000 %myid = (none)<br>000 debug raw+crypt+parsing+emitting+control+lifecycle+klips+dns+oppo+controlmore+pfkey+nattraversal+x509<br>000<br>000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64, keysizemin=192, keysizemax=192<br>000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=128, keysizemin=128, keysizemax=256<br>000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128<br>000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160<br>000<br>000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192<br>000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128<br>000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<br>000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<br>000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024<br>000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536<br>000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048<br>000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072<br>000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096<br>000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144<br>000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192<br>000<br>000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}<br>000<br>000 "ipsec0": 172.16.163.128...172.16.163.130; erouted; eroute owner: #46<br>000 "ipsec0": srcip=unset; dstip=unset; srcup=ipsec _updown; dstup=ipsec _updown;<br>000 "ipsec0": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0<br>000 "ipsec0": policy: PSK+ENCRYPT+TUNNEL+PFS; prio: 32,32; interface: eth2; encap: esp;<br>000 "ipsec0": newest ISAKMP SA: #45; newest IPsec SA: #46;<br>000 "ipsec0": IKE algorithms wanted: 3DES_CBC(5)_000-MD5(1)-MODP1024(2); flags=strict<br>000 "ipsec0": IKE algorithms found: 3DES_CBC(5)_192-MD5(1)_128-MODP1024(2)<br>000 "ipsec0": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024<br><br><br>So it looks like the tunnel has been negotiated with SA#45. Should I be concerned with the "wanted" "found" and newest not all matching?<br><br>If anyone could provide me with further examples of what is allowed for the parameter "ike" I would appreciate it. <br><br>Thank you,<br>Jennifer<br><p class="EC_EC_MsoNormal" style=""><a name="_MailAutoSig"><span style="font-size: 12pt;"><font color="#000000"><font face="Calibri">*********************************</font></font></span></a></p>
<p class="EC_EC_MsoNormal" style=""><span style=""><b style=""><i style=""><span style="font-size: 12pt;"><font color="#000000"><font face="Calibri">Jennifer Agarwal</font></font></span></i></b></span></p>
<p class="EC_EC_MsoNormal" style=""><span style=""><span style=""><font size="3"><font color="#000000"><font face="Calibri">President / Principal Engineer<br></font></font></font></span></span></p>
<p class="EC_EC_MsoNormal" style=""><span style=""><span style=""><font size="3"><font color="#000000"><font face="Calibri">Exquisite Software Solutions, LLC</font></font></font></span></span></p>
<p class="EC_EC_MsoNormal" style=""><span style=""><span style=""><font size="3"><font color="#000000"><font face="Calibri">(240) 483-8619</font></font></font></span></span></p>
<p class="EC_EC_MsoNormal" style=""><span style=""><span style=""><font size="3"><font color="#000000"><font face="Calibri">jsagarwal@exqss.com</font></font></font></span></span></p>
<p class="EC_EC_MsoNormal" style=""><span style=""><span style="font-size: 12pt; font-family: 'Arial','sans-serif';"><font color="#000000"> </font></span></span></p>
<p class="EC_EC_MsoNormal" style=""><span style=""><span style="font-size: 12pt;"><font color="#000000"><font face="Calibri">*********************************</font></font></span></span></p><br><br><br /><hr />Search from any Web page with powerful protection. Get the FREE Windows Live Toolbar Today! <a href='http://get.live.com/toolbar/overview' target='_new'>Try it now!</a></body>
</html>