I have changed the ipsec.conf file as you requested - result is the same.<br>Here is output of ipsec auto --listall command<br><br>root@slack13:/etc/ipsec.d/private# ipsec auto --listall<br>000 <br>000 List of Public Keys:<br>
000 <br>000 Dec 08 18:59:19 2010, 1024 RSA Key AwEAAc+Lo (no private key), until Nov 22 07:59:02 2020 ok<br>000 ID_DER_ASN1_DN 'C=PL, ST=cos, O=name1, OU=it, CN=vpntest, E=<a href="mailto:myname@wp.pl">myname@wp.pl</a>'<br>
000 Issuer 'C=PL, ST=cos, L=Cieszyn, O=name1, OU=it, CN=myCA, E=<a href="mailto:myname@wp.pl">myname@wp.pl</a>'<br>000 Dec 08 18:59:05 2010, 1024 RSA Key AwEAAZ+GM (has private key), until Nov 22 07:59:39 2020 ok<br>
000 ID_DER_ASN1_DN 'C=PL, ST=cos, O=name1, OU=it, CN=vpntest, E=<a href="mailto:myname@wp.pl">myname@wp.pl</a>'<br>000 Issuer 'C=PL, ST=cos, L=Cieszyn, O=name1, OU=it, CN=myCA, E=<a href="mailto:myname@wp.pl">myname@wp.pl</a>'<br>
000 List of Pre-shared secrets (from /etc/ipsec.secrets)<br>000 8: RSA (none) (none)<br>000 <br>000 List of X.509 End Certificates:<br>000 <br>000 Dec 08 18:59:05 2010, count: 2<br>000 subject: 'C=PL, ST=cos, O=name1, OU=it, CN=vpntest, E=<a href="mailto:myname@wp.pl">myname@wp.pl</a>'<br>
000 issuer: 'C=PL, ST=cos, L=Cieszyn, O=name1, OU=it, CN=myCA, E=<a href="mailto:myname@wp.pl">myname@wp.pl</a>'<br>000 serial: 01<br>000 pubkey: 1024 RSA Key AwEAAZ+GM, has private key<br>
000 validity: not before Nov 25 07:59:39 2010 ok<br>000 not after Nov 22 07:59:39 2020 ok<br>000 subjkey: 37:ac:a2:ad:31:e3:10:87:2b:f7:b8:cf:f0:7c:45:bc:c4:ec:4e:d2<br>000 authkey: 86:97:50:1d:68:c8:0e:6a:0e:dc:61:ba:c2:12:9e:2d:98:1f:d3:6e<br>
000 aserial: 00:83:ff:d4:5e:b1:28:2c:ae<br>000 <br>000 List of X.509 CA Certificates:<br>000 <br>000 Dec 08 18:59:05 2010, count: 1<br>000 subject: 'C=PL, ST=cos, L=Cieszyn, O=name1, OU=it, CN=myCA, E=<a href="mailto:myname@wp.pl">myname@wp.pl</a>'<br>
000 issuer: 'C=PL, ST=cos, L=Cieszyn, O=name1, OU=it, CN=myCA, E=<a href="mailto:myname@wp.pl">myname@wp.pl</a>'<br>000 serial: 00:83:ff:d4:5e:b1:28:2c:ae<br>000 pubkey: 1024 RSA Key AwEAAaOTD<br>
000 validity: not before Nov 25 07:59:02 2010 ok<br>000 not after Nov 22 07:59:02 2020 ok<br>000 subjkey: 86:97:50:1d:68:c8:0e:6a:0e:dc:61:ba:c2:12:9e:2d:98:1f:d3:6e<br>000 authkey: 86:97:50:1d:68:c8:0e:6a:0e:dc:61:ba:c2:12:9e:2d:98:1f:d3:6e<br>
000 aserial: 00:83:ff:d4:5e:b1:28:2c:ae<br>000 <br>000 List of X.509 CRLs:<br>000 <br>000 Dec 08 18:59:05 2010, revoked certs: 0<br><br>This kaypair is used for testing only - after this I will destroy it<br><br>
<br><br><br><br><div class="gmail_quote">2010/12/8 Paul Wouters <span dir="ltr"><<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On Wed, 8 Dec 2010, Adam Sienkiewicz wrote:<br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
right=%any<br>
rightca=%same<br>
</blockquote>
<br>
try rightca=%any (assuming you trust any loaded CA anyways)<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
rightid=%fromcert<br>
rightrsasigkey=%cert<br>
# Using the magic port of "0" means "any one single port". This is<br>
# a work around required for Apple OSX clients that use a randomly<br>
# high port, but propose "0" instead of their port. If that does<br>
# not work, try 17/%any<br>
rightprotoport=17/0<br>
</blockquote>
<br></div>
use 17/%any<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Dec 7 13:28:58 slack13 pluto[26544]: loading secrets from "/etc/ipsec.secrets"<br>
Dec 7 13:28:58 slack13 pluto[26544]: loaded private key file '/etc/ipsec.d/private/vpntest.key' (887 bytes)<br>
Dec 7 13:28:58 slack13 pluto[26544]: | 30 82 02 5b 02 01 00 02 81 81 00 9f 86 33 38 df<br>
Dec 7 13:28:58 slack13 pluto[26544]: | 00 08 12 eb 92 b6 6a 4f 91 b5 5e 17 4f 23 e0 ae<br>
</blockquote>
<br></div>
Please destroy this keypair, it seems you added "crypt" to plutodebug= so it gost posted for everyone to copy.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Dec 7 13:34:15 slack13 pluto[26544]: "l2tp-X.509"[1] 131.207.xx.xx #1: no suitable connection for peer 'C=PL, ST=cos, O=name1, OU=it, CN=mycert, E=<a href="mailto:myname@wp.pl" target="_blank">myname@wp.pl</a>'<br>
Dec 7 13:34:15 slack13 pluto[26544]: "l2tp-X.509"[1] 131.207.xx.xx #1: sending encrypted notification INVALID_ID_INFORMATION to 131.207.xx.xx:59780<br>
</blockquote>
<br></div>
what does ipsec auto --listall say after this?<br><font color="#888888">
<br>
Paul<br>
</font></blockquote></div><br>