In my production server, I import the rootCA to nss and config.<br><br>Here, I setup a test environment to show you this, all of this has been tested, it shows that all works.<br><br>network topology:<br><br>gw2(192.168.2.133)---->NAT gateway1 ----> NAT gateway2 ----Internet------>gw1(S.S.S.S)<br>
<br>on <b>gw1</b>:<br>yum install openswan<br>#initialize nss DB<br>certutil -N -d /etc/ipsec.d<br><br>#create the rootCA named "curuRootCA"<br>certutil -S -k rsa -n curuCA -s "CN=curuRootCA" -v 12 -d . -t "C,C,C" -x -d /etc/ipsec.d <br>
<br>#create machine cert named "gw1" for gw1<br>certutil -S -k rsa -c curuCA -n gw1 -s "CN=gw1" -v 12 -t "u,u,u" -d /etc/ipsec.d<br><br>#create machine cert named "gw2" for gw2<br>
certutil -S -k rsa -c curuCA -n gw2 -s "CN=gw2" -v 12 -t "u,u,u" -d /etc/ipsec.d<br><br>#add gw1 to ipsec.secrets<br>echo " : RSA gw1" >> /etc/ipsec.secrets<br><br>/etc/ipsec.conf<br>------------------------------------------------------------------------<br>
config setup<br> protostack=netkey<br> nat_traversal=yes<br> virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.1.0/24">10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.1.0/24</a><br>
oe=off<br> nhelpers=0<br>conn gw1-gw2<br> left=S.S.S.S<br> leftid='CN=gw1'<br> leftcert=gw1<br> leftrsasigkey=%cert<br> right=%any<br> rightca=%same<br> rightrsasigkey=%cert<br>
rightsubnet=vhost:%no,%priv<br> auto=add<br>-----------------------------------------------------------------------------<br><br>#export gw2's cert<br>pk12util -o gw2.p12 -n gw2 -d /etc/ipsec.d<br><br>
#copy gw2.p12 to gw2 with your method<br>#restart ipsec<br>/etc/init.d/ipsec restart<br><br>on <b>gw2</b>:<br><br>yum install openswan<br><br>
#initialize nss DB<br>
certutil -N -d /etc/ipsec.d<br><br>
#import gw2's own cert<br>pk12util -i gw2.p12 -n gw2 -d /etc/ipsec.d/<br><br>#modify CA's trust tag<br>certutil -M -n curuCA -t 'c,c,c' -d /etc/ipsec.d<br><br>#add gw2 to ipsec.secrets<br>
echo " : RSA gw2" >> /etc/ipsec.secrets<br><br>/etc/ipsec.conf<br>--------------------------------------------------------------------------------<br>config setup<br> protostack=netkey<br> nat_traversal=yes<br>
virtual_private=<br> oe=off<br> nhelpers=0<br>conn gw1-gw2<br> left=%defaultroute<br> leftcert=gw2<br> leftrsasigkey=%cert<br> right=S.S.S.S<br> rightid="CN=gw1"<br>
rightca=%same<br> rightrsasigkey=%cert<br> auto=start<br>------------------------------------------------------------------<br>#restart ipsec<br>/etc/init.d/ipsec restart<br><br><br>My test also confirms that even use openssl to generate the CA and certs, export to pkcs12, then use pk12util to import to nss, all will works fine.<br>
<br>the two test box both use CentOS 5.6 with openswan-2.6.21-5.el5_6.4. gw1 is an KVM guest , and gw2 is an VMWare guest.<br><br><br><br><br><div class="gmail_quote">2011/7/28 Richard Pickett <span dir="ltr"><<a href="mailto:richard.pickett@csrtechnologies.com">richard.pickett@csrtechnologies.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Curu,<div><br></div><div>I'm not using sonic wall in my config as Kevin is (the other user reporting the same problem). The client side is shrewsoft, and it may be part of the problem, but it's odd that the nss on the server is throwing an error and causing pluto to die and restart, the client should never be able to cause that.</div>
<div><br></div><div>Can you send me your config(s) and how you created your keys (did you create them in nss or import them?)</div><div><br></div><div>It would help a lot, and I really appreciate you taking the time to help!<div>
<div></div><div class="h5"><br>
<br><br><div class="gmail_quote">On Wed, Jul 27, 2011 at 8:46 PM, Curu Wong <span dir="ltr"><<a href="mailto:prinbra@gmail.com" target="_blank">prinbra@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I don't quite understand the problem here.<br><br>I have been using OpenSwan package from the official CentOS repository(of course with NSS) for 2 years, connecting several pair of Linux servers, all work fine.<br><br>
Can it be configuration for SonicalWall that cause the problem? forgive me if I misunderstand this situation.<div><div></div><div><br><br><br><div class="gmail_quote">2011/7/27 Richard Pickett <span dir="ltr"><<a href="mailto:richard.pickett@csrtechnologies.com" target="_blank">richard.pickett@csrtechnologies.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">My rsa keys were 8k, I thought maybe nss was having a memory problem (like a static-size limit), so I created a whole ca/certs suite w/ 2k keys, same problem.<div>
<br></div><div>Avesh, any ideas on how much longer you'll be looking at this?</div>
<div><br></div><div>Thanks for your help!<div><div></div><div><br>
<br><br><div class="gmail_quote">On Tue, Jul 26, 2011 at 6:23 AM, Avesh Agarwal <span dir="ltr"><<a href="mailto:avagarwa@redhat.com" target="_blank">avagarwa@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>On 07/26/2011 06:48 AM, Kevin Keane wrote:<br>
> Hello Avesh,<br>
><br>
> Thank you so much! The log I sent was everything that I found in /var/log/secure with plutodebug=all; the only thing I did was scramble machine names and IP addresses since that could be sensitive.<br>
><br>
> I added a report to bugzilla as #725699, but did not yet add the barf. There seems to be quite a bit of sensitive information in the barf, such as my iptables firewall configuration, my Sonicwall S/N, etc., things that I'd prefer not to have on bugzilla. Would you mind if I sent it to you by private email?<br>
><br>
> Also, when the problem actually happens, my system becomes inaccessible. I have to then turn off ipsec on the other end. So the barf does not represent the exact moment the problem occurs; I took the barf a few minutes later (with the certs causing the problem still in the database).<br>
><br>
> As for the steps I did to configure Openswan: it is the standard CentOS 5.6 Openswan RPM. openswan-2.6.21-5.el5_6.4 . So other than fiddling with the configuration, I have not done anything unusual.<br>
><br>
> Come to think about it - is it possible that this is a kernel problem? This VM runs on a Rackspace VM, with a Rackspace kernel instead of a stock CentOS kernel.<br>
><br>
</div>It does not seem to be a kernel at first issue as IKE exchange takes<br>
place in user space and NSS library is also user space. However, it is<br>
surprising why it is happening.<br>
<div><div></div><div>>> Hello Paul, Kevin,<br>
>> I can have a look at it. Kevin can you please put a complete output of ipsec barf instead of truncated ones somewhere, may be on <a href="http://bugzilla.redhat.com" target="_blank">bugzilla.redhat.com</a>? Also, if you can provide the exact steps you followed to configure openswan that would also help.<br>
>> --<br>
>> Thanks and Regards<br>
>> Avesh<br>
> _______________________________________________<br>
> <a href="mailto:Users@openswan.org" target="_blank">Users@openswan.org</a><br>
> <a href="http://lists.openswan.org/mailman/listinfo/users" target="_blank">http://lists.openswan.org/mailman/listinfo/users</a><br>
> Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
> Building and Integrating Virtual Private Networks with Openswan:<br>
> <a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
<br>
<br>
--<br>
Thanks and Regards<br>
Avesh<br>
<br>
_______________________________________________<br>
<a href="mailto:Users@openswan.org" target="_blank">Users@openswan.org</a><br>
<a href="http://lists.openswan.org/mailman/listinfo/users" target="_blank">http://lists.openswan.org/mailman/listinfo/users</a><br>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
</div></div></blockquote></div><br></div></div></div>
<br>_______________________________________________<br>
<a href="mailto:Users@openswan.org" target="_blank">Users@openswan.org</a><br>
<a href="http://lists.openswan.org/mailman/listinfo/users" target="_blank">http://lists.openswan.org/mailman/listinfo/users</a><br>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
<br></blockquote></div><br>
</div></div></blockquote></div><br></div></div></div>
</blockquote></div><br>