<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<title></title>
</head>
<body text="#000066" bgcolor="#ffffff">
And the answer is:<br>
.....<br>
I did not configure the policy properly on the firewall. Now it works
fine (always glad when I can answer myself :-)<br>
Funny thing is, that the *protoport option is completely ignored
(everything that belongs to the 192.168.60.x subnet is being tunneled
to the other side).<br>
<br>
Ondrej<br>
<br>
On 17.12.2009 10:13, Ondrej Valousek wrote:
<blockquote cite="mid:4B29F625.6020005@s3group.cz" type="cite">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
Hi All,<br>
<br>
I am running Centos5 (kernel 2.6.18, openswan-2.6.21) as a VPN client
connecting to my Checkpoint firewall authenticating using user
certificates.<br>
<br>
My setup:<br>
conn "Prague"<br>
left=%defaultroute<br>
leftcert=ondrejv-unix<br>
leftrsasigkey=%cert<br>
leftprotoport=tcp/http<br>
<br>
right=193.85.188.83<br>
# rightsubnet=192.168.60.0/24<br>
rightcert=openswan-cert<br>
rightrsasigkey=%cert<br>
rightprotoport=tcp/http<br>
<br>
I am able to establish the tunnel:<br>
<br>
[root@ondar ipsec.d]# ipsec auto --up Prague<br>
104 "Prague" #3: STATE_MAIN_I1: initiate<br>
003 "Prague" #3: received Vendor ID payload
[draft-ietf-ipsec-nat-t-ike-02_n] method set to=106<br>
106 "Prague" #3: STATE_MAIN_I2: sent MI2, expecting MR2<br>
003 "Prague" #3: NAT-Traversal: Result using
draft-ietf-ipsec-nat-t-ike-02/03: no NAT detected<br>
108 "Prague" #3: STATE_MAIN_I3: sent MI3, expecting MR3<br>
004 "Prague" #3: STATE_MAIN_I4: ISAKMP SA established
{auth=OAKLEY_RSA_SIG cipher=oakley_3des_cbc_192 prf=oakley_sha
group=modp1536}<br>
117 "Prague" #4: STATE_QUICK_I1: initiate<br>
003 "Prague" #4: ignoring informational payload, type
IPSEC_RESPONDER_LIFETIME msgid=f23e7198<br>
004 "Prague" #4: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel
mode {ESP=>0x1ae242ff <0xcf504538 xfrm=3DES_0-HMAC_SHA1
NATOA=none NATD=none DPD=none}<br>
<br>
But now there is a magic as I can not send any packet through the
tunnel. I want to connect to a machine on the network (192.168.60.0)
behind the firewall:<br>
<br>
1) When I keep the 'rightsubnet' option uncommented and try to connect,
firewall blocks the traffic as it does not go via ESP the tunnel<br>
2) If I comment the option 'rightsubnet' out and try the same. Firewall
says: "encryption failure: Clear text packet should be encrypted"<br>
<br>
Is there any help from someone please?<br>
Is there any way to debug the NETKEY issues (I guess it is related to
NETKEY).<br>
<br>
Many thanks,<br>
Ondrej<br>
<br>
<br>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
<a class="moz-txt-link-abbreviated" href="mailto:Users@openswan.org">Users@openswan.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</a>
Building and Integrating Virtual Private Networks with Openswan:
<a class="moz-txt-link-freetext" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
<br>
</body>
</html>