<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi,<br>
<br>
On 03/10/2010 05:53 AM, Paul Wouters wrote:
<blockquote
cite="mid:alpine.LFD.1.10.1003091351190.29936@newtla.xelerance.com"
type="cite">
<pre wrap="">On Tue, 9 Mar 2010, farajian amin wrote:
</pre>
<blockquote type="cite">
<pre wrap="">If openswan does request other side certificate , why we need to copy other side certificate to the /etc/ipsec.d/certs too.
</pre>
</blockquote>
<pre wrap="">
You do not need to do that.
</pre>
<blockquote type="cite">
<pre wrap="">I have the following configuration on a client as a road-warrior:
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">conn road-x509
left=192.168.1.210
right=%any
type=tunnel
leftcert=VPN2Cert.pem
rightcert=VPN1Cert.pem
</pre>
</blockquote>
<pre wrap="">
Assuming 192.168.1.210 is the gateway, you need right=%defaultroute, not right=%any
You do not need the leftcert= line. I would add rightsendcert=always.
</pre>
</blockquote>
(Assuming left is the gateway). If both certificates are signed by the
same Certificate Authority, I would remove <b>leftcert</b>, and add <b>leftca=%same
</b>(The documentation it says its on by default, but when testing I
found I needed it).<br>
<br>
That way you only need to put VPN1Cert.pem on the host.<br>
<br>
Likewise, for the gateway (below), remove <b>rightcert</b> and add <b>rightca=%same</b><br>
<b><br>
</b>Regards,<br>
Antony.<br>
<br>
<blockquote
cite="mid:alpine.LFD.1.10.1003091351190.29936@newtla.xelerance.com"
type="cite">
<pre wrap=""></pre>
<blockquote type="cite">
<pre wrap="">and for the gateway:
conn road-x509
left=192.168.1.210
right=%any
type=tunnel
leftcert=VPN2Cert.pem
rightcert=VPN1Cert.pem
</pre>
</blockquote>
<pre wrap="">
You do not need rightcert=
Paul
_______________________________________________
<a class="moz-txt-link-abbreviated" href="mailto:Users@openswan.org">Users@openswan.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</a>
Building and Integrating Virtual Private Networks with Openswan:
<a class="moz-txt-link-freetext" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
<br>
</body>
</html>