<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi Tyler<br>
<br>
I am a regular over on the ClearOS forums and I'll see if I can give
you a hand, but some of the guys on the mailing lists know a lot
more than me.<br>
<br>
First off, is this a test config where your left and right are
simulating public IP's or are both devices NAT'd? For the moment I
will assume the former. In "config setup", please add "oe=no" and if
you are simulating public IP's can you remove the nat_traversal
line?<br>
<br>
In "conn test" please add a line leftsourceip="your_ClearOS_LAN_IP".
I would also remove the references to leftupdown and rightupdown. If
they are the default ones the references are not needed and if they
are ClearOS tinkered ones (rather than the default ones) they are
not needed either. Is there any reason you have rekey=no? I would
let it rekey as you are allowing the ClearOS to initiate the
connection. To match the Fortigate, also set ikelifetime=86400 but
both these values are quite long. Typically you would use values of
1h and 8h but opinions seem to vary as to which should be which.<br>
<br>
With these changes what do you see in /var/log/secure when you start
ipsec (only the later part where the conn starts negotiating, not
where openswan is loading)? The log items contain the reference
"pluto[....]".<br>
<br>
Also worth trying is to stop the ClearOS initiating the conn and see
how it responds (rekey=no, auto=add and remove ike and phase2alg
references.<br>
<br>
Regards,<br>
<br>
Nick<br>
<br>
On 30/08/2011 06:49, Tyler J. Wagner wrote:
<blockquote cite="mid:4E5C79FC.1090507@tolaris.com" type="cite">
<pre wrap="">Hello all,
I've been trying to bring up an IPsec VPN between a ClearOS 5.2 device and
a Fortigate router. If anyone has advice or a working example of such a
configuration, I would really appreciate the help.
The ClearOS GUI is useless for this, so I'm really just using a generic
OpenSwan device. On the ClearOS router, the firewall passes esp and ah
traffic input and output, and does not masquerade it. rp_filter is
disabled, and of course ip_forwarding is enabled.
Attached is a condensed ipsec.conf from the ClearOS GUI.
On the Fortigate router, I've created a "route-based VPN", to use the
Fortigate terminology from their IPsec user guide. This means I've
established an IPsec configuration, then created firewall policies for
internal-to-ipsec and ipsec-to-internal traffic directions. I already have
a working Fortigate-to-Fortigate IPsec VPN using this configuration. This
is a second link.
Attached are screenshots of the IPsec config from the Fortigate router.
Suggestions?
Regards,
Tyler
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
<a class="moz-txt-link-abbreviated" href="mailto:Users@openswan.org">Users@openswan.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</a>
Micropayments: <a class="moz-txt-link-freetext" href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a>
Building and Integrating Virtual Private Networks with Openswan:
<a class="moz-txt-link-freetext" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
</body>
</html>