<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000066" bgcolor="#ffffff">
Hi All,<br>
<br>
I am running Centos5 (kernel 2.6.18, openswan-2.6.21) as a VPN client
connecting to my Checkpoint firewall authenticating using user
certificates.<br>
<br>
My setup:<br>
conn "Prague"<br>
left=%defaultroute<br>
leftcert=ondrejv-unix<br>
leftrsasigkey=%cert<br>
leftprotoport=tcp/http<br>
<br>
right=193.85.188.83<br>
# rightsubnet=192.168.60.0/24<br>
rightcert=openswan-cert<br>
rightrsasigkey=%cert<br>
rightprotoport=tcp/http<br>
<br>
I am able to establish the tunnel:<br>
<br>
[root@ondar ipsec.d]# ipsec auto --up Prague<br>
104 "Prague" #3: STATE_MAIN_I1: initiate<br>
003 "Prague" #3: received Vendor ID payload
[draft-ietf-ipsec-nat-t-ike-02_n] method set to=106<br>
106 "Prague" #3: STATE_MAIN_I2: sent MI2, expecting MR2<br>
003 "Prague" #3: NAT-Traversal: Result using
draft-ietf-ipsec-nat-t-ike-02/03: no NAT detected<br>
108 "Prague" #3: STATE_MAIN_I3: sent MI3, expecting MR3<br>
004 "Prague" #3: STATE_MAIN_I4: ISAKMP SA established
{auth=OAKLEY_RSA_SIG cipher=oakley_3des_cbc_192 prf=oakley_sha
group=modp1536}<br>
117 "Prague" #4: STATE_QUICK_I1: initiate<br>
003 "Prague" #4: ignoring informational payload, type
IPSEC_RESPONDER_LIFETIME msgid=f23e7198<br>
004 "Prague" #4: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel
mode {ESP=>0x1ae242ff <0xcf504538 xfrm=3DES_0-HMAC_SHA1
NATOA=none NATD=none DPD=none}<br>
<br>
But now there is a magic as I can not send any packet through the
tunnel. I want to connect to a machine on the network (192.168.60.0)
behind the firewall:<br>
<br>
1) When I keep the 'rightsubnet' option uncommented and try to connect,
firewall blocks the traffic as it does not go via ESP the tunnel<br>
2) If I comment the option 'rightsubnet' out and try the same. Firewall
says: "encryption failure: Clear text packet should be encrypted"<br>
<br>
Is there any help from someone please?<br>
Is there any way to debug the NETKEY issues (I guess it is related to
NETKEY).<br>
<br>
Many thanks,<br>
Ondrej<br>
<br>
<br>
</body>
</html>