<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
--></style>
</head>
<body class='hmmessage'>
Hi , <br> Could you run a traceroute from remote pc 10.3.15.60 to your pc 150.24.31.22. Which device in your network setup has the address 150.24.31.21 ?<br> Thanks .<br><br><span style="font-family: Tahoma,Helvetica,Sans-Serif; font-style: italic; font-weight: bold;">-<span style="font-family: Times New Roman,Times,Serif;"> Simon Charles - </span></span><br><br><br><br><br>> Date: Fri, 2 Oct 2009 16:48:13 -0400<br>> From: Donald.Goffe@GTECH.COM<br>> To: users@openswan.org<br>> Subject: [Openswan Users] Using Cisco VPN3000<br>> <br>> I read Paul and Kens' book, great job guys.<br>> I am having an issue when I establish a tunnel thru a Cisco 3000<br>> concentrator.<br>> The tunnel uses netkey and is up. I can ping the concentrator and get an<br>> echo reply just fine. Ethereal confirms the pings have been encrypted in<br>> both directions. My pc is on the left with an address of 150.24.31.22,<br>> the vpn server is 10.10.1.11 and the target Pc is 10.3.15.60 on the<br>> private side of the network.<br>> PROBLEM:<br>> When I ping 10.3.15.60 I see the encrypted echo request get to the<br>> concentrator, be decrypted, and the ICMP ping actually get to the<br>> 10.3.15.60 PC. The response is an ICMP echo reply back to 150.24.31.21<br>> as expected, which does not go back over the tunnel and as such is never<br>> encrypted. Instead it simple appears on my terminal as a plain old non<br>> encrypted ICMP reply. The Cisco concentrator indicates my tunnel has an<br>> assigned source address of 255.255.255.255 and a public address of<br>> 150.24.31.21. That can't be correct.<br>> <br>> Has anyone seen this issue?<br>> Thanks in advance...<br>> <br>> Config:<br>> # /etc/ipsec.conf - Openswan IPsec configuration file<br>> # RCSID $Id: ipsec.conf.in,v 1.16 2005/07/26 12:29:45 ken Exp $<br>> <br>> # This file: /usr/local/share/doc/openswan/ipsec.conf-sample<br>> #<br>> # Manual: ipsec.conf.5<br>> <br>> <br>> version 2.0 # conforms to second version of ipsec.conf specification<br>> <br>> # basic configuration<br>> config setup<br>> # Do not set debug options to debug configuration issues!<br>> # plutodebug / klipsdebug = "all", "none" or a combation from<br>> below:<br>> # "raw crypt parsing emitting control klips pfkey natt x509 dpd<br>> private"<br>> # eg:<br>> # plutodebug="control parsing"<br>> #<br>> # enable to get logs per-peer<br>> # plutoopts="--perpeerlog"<br>> #<br>> # Again: only enable plutodebug or klipsdebug when asked by a<br>> developer<br>> #<br>> # NAT-TRAVERSAL support, see README.NAT-Traversal<br>> #nat_traversal=yes<br>> # exclude networks used on server side by adding %v4:!a.b.c.0/24<br>> virtual_private=%v4:10.0.0.0/8<br>> # OE is now off by default. Uncomment and change to on, to<br>> enable.<br>> #oe=off<br>> # which IPsec stack to use. netkey,klips,mast,auto or none<br>> protostack=netkey<br>> <br>> <br>> # Add connections here<br>> <br>> conn gtech<br>> # # Left security gateway, subnet behind it, nexthop<br>> toward right.<br>> type=tunnel<br>> left=150.24.31.22<br>> leftsubnet=150.24.31.0/24<br>> # leftmodecfgclient=yes<br>> leftxauthclient=yes<br>> leftid=@gtech<br>> # # Right security gateway, subnet behind it, nexthop toward<br>> left.<br>> right=10.10.1.11<br>> rightxauthserver=yes<br>> rightsubnet=10.3.15.0/24<br>> rightmodecfgserver=yes<br>> pfs=no<br>> # # To authorize this connection, but not actually start<br>> it,<br>> # # at startup, uncomment this.<br>> # auto=add<br>> auto=route<br>> auth=esp<br>> esp=3des-md5<br>> ike=3des-md5-modp1024<br>> modecfgpull=yes<br>> authby=secret<br>> aggrmode=yes<br>> <br>> <br>> <br>> CONFIDENTIALITY NOTICE: The contents of this email are confidential<br>> and for the exclusive use of the intended recipient. If you receive this<br>> email in error, please delete it from your system immediately and <br>> notify us either by email, telephone or fax. You should not copy,<br>> forward, or otherwise disclose the content of the email.<br>> <br>> _______________________________________________<br>> Users@openswan.org<br>> http://lists.openswan.org/mailman/listinfo/users<br>> Building and Integrating Virtual Private Networks with Openswan: <br>> http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155<br> </body>
</html>