<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
On 30. 04. 2010 20:32, Paul Wouters wrote:
<blockquote
cite="mid:alpine.LFD.1.10.1004301431400.24707@newtla.xelerance.com"
type="cite">On Fri, 30 Apr 2010, Danilo Godec wrote:
<br>
<br>
<blockquote type="cite">
<blockquote type="cite">Apr 30 09:14:22 fw pluto[15466]:
"mytunnel-net" #4: sent MR3, ISAKMP
<br>
SA established
<br>
Apr 30 09:14:22 fw pluto[15466]: "mytunnel-net" #5: no acceptable
<br>
Proposal in IPsec SA
<br>
</blockquote>
</blockquote>
<br>
Your phase2 paramters are misconfigured between the endpoints
<br>
</blockquote>
<br>
Well, that was quite obvious, but I couldn't find a working setup on my
side.<br>
<br>
Then I asked the other admin to tweak their configuration and he
allowed other algorithms and it finaly works:<br>
<br>
<blockquote type="cite">000 "mytunnel-net": IKE algorithms wanted:
7_000-1-5, 7_000-2-5, 7_000-1-2, 7_000-2-2, 7_000-1-1, 7_000-2-1,
flags=-strict<br>
000 "mytunnel-net": IKE algorithms found: 7_128-1_128-5,
7_128-2_160-5, 7_128-1_128-2, 7_128-2_160-2, 7_128-1_128-1,
7_128-2_160-1,<br>
000 "mytunnel-net": IKE algorithm newest: <b>AES_CBC_128-SHA-MODP1024</b><br>
000 "mytunnel-net": ESP algorithms wanted: 3_000-1, 3_000-2, ;
pfsgroup=5; flags=-strict<br>
000 "mytunnel-net": ESP algorithms loaded: 3_168-1_128, 3_168-2_160,<br>
000 "mytunnel-net": ESP algorithm newest: <b>3DES_0-HMAC_SHA1;
pfsgroup=MODP1536</b></blockquote>
<br>
My setup is this regarding algorithms is this:<br>
<br>
<blockquote type="cite"> ike=aes<br>
ikelifetime=86400s<br>
keylife=28800s<br>
authby=secret<br>
</blockquote>
<br>
If I don't specify 'ike=aes', it doesn't work...<br>
<br>
<br>
It appears I'm missing 'AES' for ESP:<br>
<br>
<blockquote type="cite"># ipsec auto --status | grep ESP<br>
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64,
keysizemin=168, keysizemax=168<br>
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5,
keysizemin=128, keysizemax=128<br>
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1,
keysizemin=160, keysizemax=160</blockquote>
<br>
<br>
<br>
Thanks for the help, Danilo<br>
<br>
<br>
</body>
</html>