Hi All,<div><br></div><div>Working on setting up ipsec on aws ec2. Here are my config files:</div><div><br></div><div>ec2:</div><div><br></div><div>/etc/ipsec.conf:</div><div><br></div><div><div># /etc/ipsec.conf - Openswan IPsec configuration file</div>
<div>#</div><div># Manual: ipsec.conf.5</div><div>#</div><div># Please place your own config files in /etc/ipsec.d/ ending in .conf</div><div><br></div><div>version 2.0 # conforms to second version of ipsec.conf specification</div>
<div><br></div><div># basic configuration</div><div>config setup</div><div> # Debug-logging controls: "none" for (almost) none, "all" for lots.</div><div> # klipsdebug=none</div><div> # plutodebug="control parsing"</div>
<div> # For Red Hat Enterprise Linux and Fedora, leave protostack=netkey</div><div> protostack=netkey</div><div> nat_traversal=yes</div><div><br></div><div>include /etc/ipsec.d/*.conf</div><div><br></div>
<div>/etc/ipsec.d/testhtoh.conf</div><div><br></div><div><div>conn testhtoh</div><div> leftid=@ec2</div><div> left=10.251.xxx.xxx</div><div> leftrsasigkey=0sAQOq9...</div><div> rightid=@nonec2</div>
<div> right=38.104.xxx.xxx</div><div> rightrsasigkey=0sAQOI...</div><div> authby=rsasig</div><div> auto=start</div><div><br></div></div><div>non-ec2 server:</div><div><br></div><div><div># /etc/ipsec.conf - Openswan IPsec configuration file</div>
<div>#</div><div># Manual: ipsec.conf.5</div><div>#</div><div># Please place your own config files in /etc/ipsec.d/ ending in .conf</div><div><br></div><div>version 2.0 # conforms to second version of ipsec.conf specification</div>
<div><br></div><div># basic configuration</div><div>config setup</div><div> # Debug-logging controls: "none" for (almost) none, "all" for lots.</div><div> # klipsdebug=none</div><div> # plutodebug="control parsing"</div>
<div> # For Red Hat Enterprise Linux and Fedora, leave protostack=netkey</div><div> protostack=netkey</div><div> nat_traversal=yes</div><div><br></div><div>include /etc/ipsec.d/*.conf</div><div><br></div>
<div>/etc/ipsec.d/testhtoh.conf</div><div><br></div><div><div>conn testhtoh </div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>leftid=@ec2</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>left=67.202.xxx.xxx</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>leftrsasigkey=0sAQOq9wV...</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>leftsubnet=vhost:%priv</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>rightid=@nonec2</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>right=%any</div><div> rightrsasigkey=0sAQOI...</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>authby=rsasig</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auto=add</div>
<div> rekey=no</div><div><br></div><div>on the non-ec2 server I run:</div><div><br></div><div><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">ipsec auto --add testhtoh</p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">023 virtual IP must only be used with %any and without client</p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">037 attempt to load incomplete connection</p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica"><br></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">
</p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">I believe because this fails I get:</p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica; min-height: 14.0px"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">Sep 24 19:01:31 fx-5 pluto[24473]: packet from <a href="http://67.202.6.171:500">67.202.6.171:500</a>: initial Main Mode message received on <a href="http://38.104.134.226:500">38.104.134.226:500</a> but no connection has been authorized with policy=RSASIG</p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica"><br></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">when I run ipsec auto --up testhtoh on ec2</p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">
<br></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">I was following the advice given here:</p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica"><br></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">
<a href="http://wiki.openswan.org/index.php/Openswan/FAQ#a89">http://wiki.openswan.org/index.php/Openswan/FAQ#a89</a></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica"><br></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">
What else can I try?</p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica"><br></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">-Tim</p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">
<br></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">P.S.</p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica"><br></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica">
Thanks for this help!</p><p></p></div></div></div></div>