It looks like it is an issue with mixmatch. Im not sure how to set the bits for the hash on the Cisco, but on openswan /etc/ipsec.conf: <br><br>conn tunnel<br> esp=aes-sha-256<br><br> should work i'd imagine.<br><br>
Ryan<br><br><div class="gmail_quote">On Thu, Jul 15, 2010 at 10:58 AM, Kevin White <span dir="ltr"><<a href="mailto:openswan-kevin@kevbo.org">openswan-kevin@kevbo.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
I'm trying to set up a VPN between Openswan and a Cisco device. I'm<br>
using Openswan 2.4.9.<br>
<br>
The tunnel isn't coming up, but I have lots of things still to check.<br>
I've noticed one thing, and I'm curious if it is a problem:<br>
<br>
000 "xxx": IKE algorithms wanted: AES_CBC(7)_256-SHA1(2)-MODP1536(5),<br>
AES_CBC(7)_256-SHA1(2)-MODP1024(2); flags=strict<br>
000 "xxx": IKE algorithms found:<br>
AES_CBC(7)_256-SHA1(2)_160-MODP1536(5),<br>
AES_CBC(7)_256-SHA1(2)_160-MODP1024(2)<br>
000 "xxx": ESP algorithms wanted: AES(12)_256-SHA1(2); flags=strict<br>
000 "xxx": ESP algorithms loaded: AES(12)_256-SHA1(2); flags=strict<br>
<br>
Note that the ESP algorithms seem to match, but the IKE seems to have a<br>
problem.<br>
<br>
This is wanted:<br>
<br>
AES_CBC(7)_256-SHA1(2)-MODP1536(5)<br>
<br>
This is found:<br>
<br>
AES_CBC(7)_256-SHA1(2)_160-MODP1536(5)<br>
<br>
I kind of thought those two things were the same, but they appear to<br>
look different...so I'm not sure if this means I'm getting stuck at IKE.<br>
<br>
Is this a problem, or does it just look funny?<br>
<br>
I'm here:<br>
<br>
000 #6: "xxx":500 STATE_MAIN_I2 (sent MI2, expecting MR2);<br>
EVENT_RETRANSMIT in 11s; nodpd<br>
000 #6: pending Phase 2 for "xxx" replacing #0<br>
000 #6: pending Phase 2 for "xxx" replacing #0<br>
<br>
but there can still be problems on the Cisco side: I don't control that<br>
side, and it might not even be configured for my connection yet.<br>
<br>
So, at this point, my question really is: is that an IKE algorithm<br>
mismatch, or is it just cosmetic?<br>
<br>
Thanks,<br>
<br>
Kevin<br>
_______________________________________________<br>
<a href="mailto:Users@openswan.org">Users@openswan.org</a><br>
<a href="http://lists.openswan.org/mailman/listinfo/users" target="_blank">http://lists.openswan.org/mailman/listinfo/users</a><br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
</blockquote></div><br>