Hello,<br><br>Happy new year! What do you do when you are off on your holidays? Naturally, I play with VPNs. :-)<br><br>Anyway, I cannot get NAT traversal to work. My setup is as follows- I want to get a VPN running between two hosts both running Openswan. One is on the internet and has a public IP address, and is running Fedora 9. The other is my laptop sat at home behind a NAT running Fedora 10.<br>
<br>I've successfully created a VPN between two hosts on the same subnet (behind the NAT). So now I'm trying to get NAT traversal to work.<br><br>Here is my config file:<br><br>-----------------------<br>version 2.0 # conforms to second version of ipsec.conf specification<br>
<br>config setup<br> protostack=netkey<br> nat_traversal=yes<br><br>conn host-to-host<br> left=192.168.2.34<br> leftid=81.76.68.138<br> leftnexthop=192.168.2.1<br> leftsubnet=<a href="http://192.168.2.0/24">192.168.2.0/24</a><br>
leftrsasigkey=blah blah blah<br> right=94.102.146.99 # Remote vitals<br> rightid=94.102.146.99<br> rightsubnet=<a href="http://94.102.146.96/29">94.102.146.96/29</a><br> rightrsasigkey=blah blah blah<br>
rightnexthop=94.102.146.97 # correct in many situations<br> auto=add # authorizes but doesn't start this<br> # connection at startup<br><br><br>---------------------<br>
<br>When I do on the box behind the NAT I get:<br><br>[root@localhost log]# ipsec auto --up host-to-host<br>104 "host-to-host" #1: STATE_MAIN_I1: initiate<br>010 "host-to-host" #1: STATE_MAIN_I1: retransmission; will wait 20s for response<br>
<br><br>and I see in /etc/secure on the remote box:<br>Jan 1 11:14:57 server pluto[17123]: packet from <a href="http://81.76.68.138:500">81.76.68.138:500</a>: ignoring unknown Vendor ID payload [4f457d5a765a404d5b4f5744]<br>
Jan 1 11:14:57 server pluto[17123]: packet from <a href="http://81.76.68.138:500">81.76.68.138:500</a>: received Vendor ID payload [Dead Peer Detection]<br>Jan 1 11:14:57 server pluto[17123]: packet from <a href="http://81.76.68.138:500">81.76.68.138:500</a>: received Vendor ID payload [RFC 3947] method set to=109 <br>
Jan 1 11:14:57 server pluto[17123]: packet from <a href="http://81.76.68.138:500">81.76.68.138:500</a>: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109<br>Jan 1 11:14:57 server pluto[17123]: packet from <a href="http://81.76.68.138:500">81.76.68.138:500</a>: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 109<br>
Jan 1 11:14:57 server pluto[17123]: packet from <a href="http://81.76.68.138:500">81.76.68.138:500</a>: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109<br>Jan 1 11:14:57 server pluto[17123]: packet from <a href="http://81.76.68.138:500">81.76.68.138:500</a>: initial Main Mode message received on <a href="http://94.102.146.99:500">94.102.146.99:500</a> but no connection has been authorized with policy=RSASIG<br>
<br><br>Any ideas? Thanks in advance,<br><br>David<br><br>