<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Vorformatiert Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.HTMLVorformatiertZchn
{mso-style-name:"HTML Vorformatiert Zchn";
mso-style-priority:99;
mso-style-link:"HTML Vorformatiert";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=DE link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span lang=EN-US>Hi.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>When I try to establish a connection with
the ShrewSoft Client it fails.<o:p></o:p></span></p>
<pre><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>DHCP over IPSec, no NAT on both sides: </span><span
lang=EN-US>"roadwarrior-dhcp"[1] 89.246.161.100 #3: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected<o:p></o:p></span></pre>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Openswan succeeds the IKE Phase:<o:p></o:p></span></p>
<pre><span lang=EN-US>"roadwarrior-dhcp"[2] 89.246.161.100 #4: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=aes_256 prf=oakley_md5 group=modp3072}<o:p></o:p></span></pre>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>But cannot match the connection description
afterwards: <o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>Jun
15 16:07:37 gateway pluto[23447]: | peer client is 89.246.161.100<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>Jun
15 16:07:37 gateway pluto[23447]: | peer client protocol/port is 17/68<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>Jun
15 16:07:37 gateway pluto[23447]: | our client is 91.67.231.19<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>Jun
15 16:07:37 gateway pluto[23447]: | our client protocol/port is 17/67<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>Jun
15 16:07:37 gateway pluto[23447]: "roadwarrior-dhcp"[2]
89.246.161.100 #4: the peer proposed: xxx.xxx.xxx.xxx/32:17/67 ->
89.246.161.100/32:17/68<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>Jun
15 16:07:37 gateway pluto[23447]: "roadwarrior-dhcp"[2]
89.246.161.100 #4: cannot respond to IPsec SA request because no connection is
known for xxx.xxx.xxx.xxx[C=DE, ST=Brandenburg, L=Potsdam, O=Krellmann,
OU=Servers, CN=vpngate,
E=root@vpngate.potsdam.krellmann.net,+S=C]:17/67...89.246.161.100[C=DE,
O=krellmann, OU=roadwarrior, CN=potsdam.krellmann.net,
E=martin@krellmann.net,+S=C]:17/68<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>Jun
15 16:07:37 gateway pluto[23447]: | complete state transition with (null)<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>Jun
15 16:07:37 gateway pluto[23447]: "roadwarrior-dhcp"[2]
89.246.161.100 #4: sending encrypted notification INVALID_ID_INFORMATION to
89.246.161.100:500<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>The ShrewSoft Client does not notice the
above response and resumes with sending DHCP Discover packages.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Any idea why this happens?<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>The configuration:<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Ipsec.conf:<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>config setup<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> klipsdebug=none<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> nat_traversal=yes<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> nhelpers=5<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> plutodebug=control,crypt,klips<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> protostack=klips<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> uniqueids=yes<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> virtual_private=%v4:10.0.1.0/24,%v4:10.0.2.0/24,%v4:!192.168.10.0/24,%v4:!192.168.178.0/24<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>conn %default<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> type=tunnel<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> authby=rsasig<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> pfs=no<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> rekey=no<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> keylife=1h<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> ikelifetime=3h<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> keyingtries=3<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> left=%defaultroute<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> leftrsasigkey=%cert<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> </span><span
style='font-size:9.0pt;font-family:"Courier New"'>rightca=%same<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:9.0pt;
font-family:"Courier New"'> rightrsasigkey=%cert<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:9.0pt;
font-family:"Courier New"'><o:p> </o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>conn roadwarrior-dhcp<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> keylife=60s<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> rekeymargin=30s<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> rekey=no<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> leftcert=g1.krellmann.net.pem<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> leftprotoport=udp/bootps<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> #this
allows DHCP discovery broadcast:<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> leftsubnet=0.0.0.0/0<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> right=%any<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> rightcert=roadwarrior.potsdam.krellmann.net.pem<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> rightprotoport=udp/bootpc<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> auto=add<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'><o:p> </o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>conn roadwarrior<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> leftcert=g1.krellmann.net.pem<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> leftsubnet=192.168.10.0/24<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> right=%any <o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> rightcert=roadwarrior.potsdam.krellmann.net.pem<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> </span><span
style='font-size:9.0pt;font-family:"Courier New"'>rightsubnet=vnet:%v4:10.0.1.0/24<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:9.0pt;
font-family:"Courier New"'> auto=add<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>The client configuration is mostly “auto”.
Auth mode ist “mutual-rsa”, Certificates are set up (same as on
server side + private key for the client)<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Greets,<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Martin.<o:p></o:p></span></p>
</div>
</body>
</html>