Hello,<br><br>I tried to setup a manually keyed encryption-only connection with DES (for compatibility reasons).<br>But failed.<br><br># ipsec spi --af inet --said <a href="mailto:esp0x2222@172.16.1.11">esp0x2222@172.16.1.11</a> --esp des --src 172.16.3.2 --enckey 0x9876543210987654<br>
/usr/libexec/ipsec/spi: Invalid encryption algorithm 'des' follows '--esp' option: lead too many(2) transforms<br><br>However the following works:<br><br>Encryption-only 3DES:<br># ipsec spi --af inet --said <a href="mailto:esp0x2222@172.16.1.11">esp0x2222@172.16.1.11</a> --esp 3des --src 172.16.3.2 --enckey 0x987654321098765432109876543210987654321098765432<br>
# ipsec spi<br><a href="mailto:esp0x2222@172.16.1.11">esp0x2222@172.16.1.11</a> ESP_3DES: dir=out src=172.16.3.2 iv_bits=64bits iv=0x7ec36178c1bf36e7 eklen=192 life(c,s,h)=addtime(3,0,0) natencap=none natsport=0 natdport=0 refcount=3 ref=7<br>
<br>DES with authentication:<br># ipsec spi --af inet --said <a href="mailto:esp0x2222@172.16.1.11">esp0x2222@172.16.1.11</a> --esp des-md5 --src 172.16.3.2 --authkey 0x98765432109876549876543210987654 --enckey 0x9876543210987654<br>
# ipsec spi<br><a href="mailto:esp0x2222@172.16.1.11">esp0x2222@172.16.1.11</a> ESP_ID2_HMAC_MD5: dir=out src=172.16.3.2 iv_bits=64bits iv=0xb7b6e8a5328314c1 alen=128 aklen=128 eklen=64 life(c,s,h)=addtime(2,0,0) natencap=none natsport=0 natdport=0 refcount=3 ref=9<br>
<br>DES is available:<br># ipsec auto --status<br>000 interface ipsec0/eth1 172.16.3.2<br>000 interface ipsec0/eth1 172.16.3.2<br>000 %myid = (none)<br>000 debug none<br>000 <br>000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=64, keysizemin=64, keysizemax=64.<br>
...<br>000 algorithm IKE encrypt: id=1, name=OAKLEY_DES_CBC, blocksize=8, keydeflen=64<br><br>Any clue?<br><br>Thanks for you time.<br><br>Regards<br>-hiren<br>