<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
FWIW, on my Draytek 2900 I could only use 3des for ike (3des-md5,
3des-md5-modp1024 and 3des-sha1-modp1024 all worked).<br>
<br>
For phase2, I had to restrict the aes setting to 128 bits, otherwise
it would use 256 bits. With 256 bits, from memory, a connection
appeared to be made but no traffic would pass. The settings I gound
worked were aes128, 3des-md5 and 3des-sha1.<br>
<br>
The other key item was to use rightid (right being my Draytek). On
the Draytek this was set in Local ID field of the Advanced dial-out
settings. This is when the Draytek was dialling out.<br>
<br>
I cannot remember if you needed to set the rightid for a dial out
connection, but I don't think so. I gave up on getting Openswan to
call the Drayteks. I used to do it on one which had an almost static
WAN IP, but the connection would go down for a while until the ddns
propagated through the system.<br>
<br>
On my Draytek 2600, it initated the connection as it was on a very
dynamic IP. At the 2600 end I restricted it to use 3des as it did
not have a hardware aes processor so the router kept rebooting. I
tried to minimise the processing load on the 2600.<br>
<br>
What I find odd is that I had it working with both 2.4.15 and now
2.6.28 and the only significant change I remember making (apart from
setting oe=no) was having to specify protostack=netkey with 2.6.x.<br>
<br>
Which Draytek are you using?<br>
<br>
Nick<br>
<br>
On 06/09/2010 12:18, Roel van Meer wrote:
<blockquote
cite="mid:cone.1283771937.598262.77530.1001@bork.lsof.org"
type="cite">Paul Wouters writes:
<br>
<br>
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">Might it be that 2.4.x is changing
stuff in proc that 2.6.x doesn't? I haven't looked at that
yet..
<br>
</blockquote>
<br>
Replying to myself: the output of sysctl -a does not differ
(in any relevant parts) between a working 2.4.x setup and a
partially working 2.6.x setup.
<br>
</blockquote>
<br>
I didnt realise it worked with 2.4.x. Is this with X.509? You
might need to
<br>
add a leftid=%fromcert
<br>
</blockquote>
<br>
No, I'm using shared secrets. <br>
<blockquote type="cite">However, I am still very puzzled why yout
I1 would not get a reply. I guess
<br>
looking at the I1 packet (by capturing plutodebug=all logs from
a 2.4 and a
<br>
2.6 run) might sched some more light on it.
<br>
</blockquote>
<br>
Attached are unmodified debug output for a connection initiated by
openswan, with 2.4.15 (working) and 2.6.28 (not working). Since
this is a test setup, I didn't obfuscate it.
<br>
<br>
I also have some more information: it seems the draytek wants 3des
for phase 1. With ike=3des, a connection can be initiated by
openswan with both the 2.4 and 2.6 versions. With ike=aes, a
connection cannot be initiated (from either side). For
completeness: if I don't specify ike, openswan 2.4 can initiate a
connection but 2.6 cannot.
<br>
<br>
<br>
Since providing ike= is an effective workaround, I'm not sure if
you are interested in debugging this any further. If you are,
however, I'm more than willing to help. Please let me know what I
can do.
<br>
<br>
Thanks for your time so far!
<br>
<br>
roel
<br>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
<a class="moz-txt-link-abbreviated" href="mailto:Users@openswan.org">Users@openswan.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</a>
Micropayments: <a class="moz-txt-link-freetext" href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a>
Building and Integrating Virtual Private Networks with Openswan:
<a class="moz-txt-link-freetext" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
</body>
</html>