<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7653.38">
<TITLE>RE : [Openswan Users] help with ipsec + zywall</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Thanks for your answer.<BR>
Here it is my router config :<BR>
<BR>
---------- IKE Setup ----------<BR>
Authentication Method: Pre-Shared Key<BR>
Phase 1 - Negotiation Mode= Main<BR>
Authentication= preShareKey<BR>
Key= xxxxxxxxxxx<BR>
Encryption Algorithm= 3DES Authentication Algorithm= MD5<BR>
SA Life Time (Seconds)= 86400 Key Group= DH2<BR>
<BR>
ras> ipsec ipsecDisplay 1<BR>
---------- IPSec Setup ----------<BR>
Index #= 1 Active= Yes Multi Pro = No Protocol= 0 Global SW= 0xA<BR>
Bound IKE 1 NailUp = Yes Netbios = No Name= vpn<BR>
ControlPing = No LogControlPing = No Control ping address = 0.0.0.0<BR>
Local: Addr Type= SUBNET Port Start= 0 End= N/A<BR>
IP Addr Start= 192.168.1.0 Mask= 255.255.255.0<BR>
Remote: Addr Type= SUBNET Port Start= 0 End= N/A<BR>
IP Addr Start= 192.168.2.0 Mask= 255.255.255.0<BR>
<BR>
Enable Replay Detection= Yes Key Management= IKE<BR>
Phase 2 - Active Protocol= ESP<BR>
Encryption Algorithm= 3DES Authentication Algorithm= MD5<BR>
SA Life Time (Seconds)= 86400<BR>
Encapsulation= Tunnel Perfect Forward Secrecy (PFS)= DH2<BR>
<BR>
The SA Life Time is the maximum that the router can support. But I have build the tunnel yesterday, and today this tunnel<BR>
was down. There will be a VoIP system in this tunnel. I cannot tell to everyone that everyday it is possible that the vpn can crash.<BR>
Especially if it I have to rebuild it everyday :s bad bad bad.<BR>
<BR>
Any idea ?<BR>
<BR>
---<BR>
Reza ISSANY<BR>
Ingénieur Système<BR>
ZA Les Playes - Jean Monnet Sud<BR>
Avenue de Lisbonne<BR>
83500 La Seyne sur Mer<BR>
<BR>
<BR>
<BR>
-------- Message d'origine--------<BR>
De: Faizan Syed [<A HREF="mailto:consultant77pk@yahoo.com">mailto:consultant77pk@yahoo.com</A>]<BR>
Date: mer. 6/10/2009 08:29<BR>
À: reza; users@openswan.org<BR>
Objet : Re: [Openswan Users] help with ipsec + zywall<BR>
<BR>
Hi Reza.<BR>
<BR>
There is nothing wrong in config, usualy its compatibility issue, and some<BR>
routers can not persist a connection<BR>
like this Zywall is a Zyxell model u told. I was facing the same issue usin<BR>
with Mikrotik Router OS, usualy routers<BR>
have some Lifetime config settings that you have to chek and make sure its<BR>
either disabled or set to the max to<BR>
keep the connection alive. Also try changing on IPsec 'auto=start'<BR>
<BR>
Faizan Syed<BR>
Adhoc Technologies<BR>
<BR>
<BR>
----- Original Message -----<BR>
From: reza<BR>
To: users@openswan.org<BR>
Sent: Tuesday, June 09, 2009 8:51 PM<BR>
Subject: [Openswan Users] help with ipsec + zywall<BR>
<BR>
<BR>
Hi,<BR>
<BR>
Forgive me for my bad english. I'm a french people.<BR>
<BR>
I'm trying to configure openswan with a zywall router using an ath by<BR>
rsasig.<BR>
<BR>
I can get workinf the tunnel, but periodically (randomly), the tunnel<BR>
crashes.<BR>
When I verify the status of this vpn connection, I can see that the tunnel<BR>
is established,<BR>
but there is no traffic. I have to down my connection, hangup the zywall<BR>
side (bouton hangup in admin panel),<BR>
and without any up, the connection is negiciated and established, and all<BR>
traffic work.<BR>
<BR>
My conf :<BR>
conn techvar<BR>
# materiel : zywall 2 plus<BR>
#local<BR>
left=publicipoftheopenswanbox<BR>
leftsubnet=192.168.2.0/24<BR>
leftid=xxxxxxxxxx<BR>
authby=secret<BR>
pfs=yes<BR>
auth=esp<BR>
aggrmode=no<BR>
disablearrivalcheck=no<BR>
esp=3des-md5-96<BR>
# remote<BR>
right=publiipofthezywall<BR>
rightsubnet=192.168.1.0/24<BR>
rightid=xxxxxxx<BR>
auto=add<BR>
<BR>
Any idea to solve the problem ?<BR>
<BR>
Thanks in advance for your help.<BR>
<BR>
<BR>
<BR>
_______________________________________________<BR>
Users@openswan.org<BR>
<A HREF="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</A><BR>
Building and Integrating Virtual Private Networks with Openswan:<BR>
<A HREF="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</A><BR>
<BR>
<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>