<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
  <meta content="text/html; charset=ISO-8859-1"
 http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi,<br>
<br>
How did you create the virtual interface with ip&nbsp; <a
 moz-do-not-send="true" href="http://10.5.5.5/32===10.254.254.254">10.5.5.5</a>
?<br>
<br>
On 12/23/2010 01:46 PM, Hammad wrote:
<blockquote
 cite="mid:AANLkTimgACHNcemmXejYaH7i+LbVhNLo1ipKnJb+ftiZ@mail.gmail.com"
 type="cite">
  <div dir="ltr">Hi,<br>
  <br>
Ok, given below connection configuration on EC2 this I am up with my
tunnel,<br>
"connection": <a moz-do-not-send="true"
 href="http://10.5.5.5/32===10.254.254.254">10.5.5.5/32===10.254.254.254</a>&lt;10.254.254.1&gt;[59.59.59.59,+S=C]
......&nbsp; 202.2.2.2&lt;202.2.2.2&gt;[+S=C]===<a moz-do-not-send="true"
 href="http://172.7.7.7/32">172.7.7.7/32</a>;<br>
  <br>
Now since my Elastic IP is my ID leftid=59.59.59.59; remote end
recognizes me as a good boy.<br>
  <br>
But... when I ping/trace route remote end's encryption domain IP, it
says connection timeout. <br>
Now when I try to traceroute; none of its bit goes through my Elastic
IP - since there is no record other than leftid, on my end machine that
I am in fact 59.59.59.59.<br>
  <br>
How can I make my application reach 172.7.7.7 through 59.59.59.59 on my
Amazon instance?<br>
  <br>
  <u><b>Here is my tunnel.</b></u><br>
"connection" #1: ignoring unknown Vendor ID payload
[48a45f8a629df21329e84ed5b051ef831b7746440000000d00000614]<br>
"connection" #1: received Vendor ID payload [Dead Peer Detection]<br>
"connection" #1: ignoring Vendor ID payload [HeartBeat Notify 386b0100]<br>
"connection" #1: transition from state STATE_MAIN_I1 to state
STATE_MAIN_I2<br>
"connection" #1: STATE_MAIN_I2: sent MI2, expecting MR2<br>
"connection" #1: transition from state STATE_MAIN_I2 to state
STATE_MAIN_I3<br>
"connection" #1: STATE_MAIN_I3: sent MI3, expecting MR3<br>
"connection" #1: Main mode peer ID is ID_IPV4_ADDR: '202.2.2.2'<br>
"connection" #1: transition from state STATE_MAIN_I3 to state
STATE_MAIN_I4<br>
"connection" #1: STATE_MAIN_I4: ISAKMP SA established
{auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5
group=modp1024}<br>
"connection" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW
{using isakmp#1 msgid:93df71f8 proposal=defaults pfsgroup=no-pfs}<br>
"connection" #2: transition from state STATE_QUICK_I1 to state
STATE_QUICK_I2<br>
"connection" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel
mode {ESP=&gt;0x6397e30b &lt;0x2588073b xfrm=3DES_0-HMAC_MD5 NATOA=none
NATD=none DPD=none}<br>
  <br>
  <br>
  <div class="gmail_quote">On Sun, Dec 5, 2010 at 7:14 PM, Piavlo <span
 dir="ltr">&lt;<a moz-do-not-send="true"
 href="mailto:piavka@cs.bgu.ac.il">piavka@cs.bgu.ac.il</a>&gt;</span>
wrote:<br>
  <blockquote class="gmail_quote"
 style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
    <div bgcolor="#ffffff" text="#000000">
&nbsp;Hi,<br>
    <br>
it should be similar to this:<br>
    <br>
-----------------<br>
config setup<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; nat_traversal=yes<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; virtual_private=%v4<a moz-do-not-send="true"
 href="http://172.7.7.7/32" target="_blank">172.7.7.7/32</a>:,%v4:!<a
 moz-do-not-send="true" href="http://10.5.5.5/32" target="_blank">10.5.5.5/32</a><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; oe=off<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; protostack=netkey<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # force_keepalive=yes<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # keep_alive=30<br>
conn ec2-to-juniper<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; connaddrfamily=ipv4<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type=tunnel<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; authby=secret<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # ike=3des-sha1;modp1536<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; phase2=esp<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # phase2alg=3des-sha1;modp1536<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; forceencaps=yes<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; pfs=yes<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # dpddelay=30<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # dpdtimeout=120<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # dpdaction=restart<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; left=10.254.254.254<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; leftid=59.59.59.59<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; leftnexthop=%defaultroute<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; leftsubnet=<a moz-do-not-send="true" href="http://10.5.5.5/32"
 target="_blank">10.5.5.5</a>/32<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; leftsourceip=<a moz-do-not-send="true" href="http://10.5.5.5/32"
 target="_blank">10.5.5.5</a><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; right=202.2.2.2<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rightsubnet=<a moz-do-not-send="true" href="http://172.7.7.7/32"
 target="_blank">172.7.7.7/32</a><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; auto=add<br>
-----------------<br>
    <br>
Regards<br>
Alex
    <div>
    <div class="h5"><br>
    <br>
On 12/05/2010 12:19 PM, Hammad wrote:
    </div>
    </div>
    <blockquote type="cite">
      <div>
      <div class="h5">
      <div dir="ltr">Hi,<br>
      <br>
Can somebody help to put the pieces of puzzle together for configuring
openswan on EC2;<br>
      <br>
My Elastic Ip: 59.59.59.59<br>
My EC2 Instance IP: 10.254.254.254<br>
My encryption domain (a virtual interface created to cater dynamic IPs
on EC2 instance/restart persistent): <a moz-do-not-send="true"
 href="http://10.5.5.5/32" target="_blank">10.5.5.5/32</a><br>
      <br>
Other end public (Using Netscreen/juniper): 202.2.2.2<br>
Other end encrypted domain: <a moz-do-not-send="true"
 href="http://172.7.7.7/32" target="_blank">172.7.7.7/32</a><br>
      <br>
1) How do I fill in following fields for this connection;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; left=<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; leftid=<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; leftnexthop=<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; leftsubnet=<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; right=<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rightnexthop=<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rightsubnet=<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rightid=<br>
      <br>
      <br>
2) My EC2 provides me firewall webinterface; do I need to configure my
iptables in that case? for masquerading etc?<br>
      <br>
Regards,<br>
Hammad<br>
      </div>
      </div>
      </div>
      <pre><fieldset></fieldset>
_______________________________________________
<a moz-do-not-send="true" href="mailto:Users@openswan.org"
 target="_blank">Users@openswan.org</a>
<a moz-do-not-send="true"
 href="http://lists.openswan.org/mailman/listinfo/users" target="_blank">http://lists.openswan.org/mailman/listinfo/users</a>
Micropayments: <a moz-do-not-send="true"
 href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy"
 target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a>
Building and Integrating Virtual Private Networks with Openswan: 
<a moz-do-not-send="true"
 href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155"
 target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
  </pre>
    </blockquote>
    <br>
    </div>
  </blockquote>
  </div>
  <br>
  </div>
</blockquote>
<br>
</body>
</html>