<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:lucida console,sans-serif;font-size:12pt"><div><p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">Paul,</span></p><p class="MsoNormal"><br><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"></span></p><p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">Many thanks for your help, this is the config on the cisco side. can you take a look at this and suggest the proper <br>ike and esp line on my side?</span></p><p class="MsoNormal"><br><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"></span></p><p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31, 73, 125);">with this config my configuration is</span></p><p class="MsoNormal"><br><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"></span></p><p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">ike = aes_sha1</span></p><p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">esp = aes_sha1</span></p><p class="MsoNormal"><br><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"></span></p><p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">is this correct ?<br></span></p><p class="MsoNormal"><br><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31, 73, 125);"></span></p><p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"><br></span></p><p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">crypto isakmp policy 45</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> encr aes</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> authentication pre-share</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> group 2</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> lifetime 3600</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">crypto isakmp key secret address 122.55.48.156</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">crypto ipsec transform-set <b>sha-aes</b> esp-aes esp-sha-hmac</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">crypto map generic 170 ipsec-isakmp </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> description ** VPN to Client **<br></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> set peer 122.55.48.156</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> set transform-set <b>sha-aes</b> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> match address vpnclient<br></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">ip access-list extended vpnclient<br></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> permit ip host 208.77.116.46 <span style="border-bottom: 1px dashed rgb(0, 102, 204); background: transparent none repeat scroll 0% 0%; cursor: pointer; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" class="yshortcuts" id="lw_1257430859_1">10.8.44</span>.0 0.0.0.255</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">PSC-XVPN1# sh cry isa sa</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">dst src state conn-id slot</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">210.5.121.100 122.55.48.156 QM_IDLE 940 0</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">PSC-XVPN1#</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">Oct 30 12:31:33.592: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of
Quick mode failed with peer at 122.55.48.156 </span></p>
<span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span></div><div style="font-family: lucida console,sans-serif; font-size: 12pt;"><br>Best regards,<br><br>Ronaldo Chan<br><br><div style="font-family: arial,helvetica,sans-serif; font-size: 10pt;"><font face="Tahoma" size="2"><hr size="1"><b><span style="font-weight: bold;">From:</span></b> Paul Wouters <paul@xelerance.com><br><b><span style="font-weight: bold;">To:</span></b> Ronald <loloski@yahoo.com><br><b><span style="font-weight: bold;">Sent:</span></b> Thu, November 5, 2009 8:19:44 PM<br><b><span style="font-weight: bold;">Subject:</span></b> Re: [Openswan Users] rightsubnet parameter question<br></font><br>
On Thu, 5 Nov 2009, Ronald wrote:<br><br>> Thanks for your reply, yes the config i attach is just what i had in mind sorry, yes we do the<br>> authentication via pre-shared key.<br><br>Ok.<br><br>> pfs is disabled on cisco side. xauth this is my problem since according to the admin he has no setting<br>> with this. on part on the crypto map definition.<br>> <br>> no-xauth no-config-mode option<br><br>Then your config looks fine, so you might only need to change the ike= and esp= line to<br>the values the cisco has configured.<br><br><br><br><br>Paul<br></div></div>
<!-- cg23.c1.mail.mud.yahoo.com compressed/chunked Wed Nov 4 22:10:59 PST 2009 -->
</div><br>
</body></html>