<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
..... and I forgot to ask if you had set up your /etc/ipsec.secrets
file (or your /etc/ipsec.d/ipsec.*.secrets file) with your secret in
the form:<br>
<br>
10.0.1.1 10.0.2.1 : PSK "YourSecretGoesHere"<br>
<br>
Nick<br>
<br>
On 04/09/2011 19:41, Nick Howitt wrote:
<blockquote cite="mid:4E63C669.1010403@gmail.com" type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
Hi Tyler<br>
<br>
I am a regular over on the ClearOS forums and I'll see if I can
give you a hand, but some of the guys on the mailing lists know a
lot more than me.<br>
<br>
First off, is this a test config where your left and right are
simulating public IP's or are both devices NAT'd? For the moment I
will assume the former. In "config setup", please add "oe=no" and
if you are simulating public IP's can you remove the nat_traversal
line?<br>
<br>
In "conn test" please add a line
leftsourceip="your_ClearOS_LAN_IP". I would also remove the
references to leftupdown and rightupdown. If they are the default
ones the references are not needed and if they are ClearOS
tinkered ones (rather than the default ones) they are not needed
either. Is there any reason you have rekey=no? I would let it
rekey as you are allowing the ClearOS to initiate the connection.
To match the Fortigate, also set ikelifetime=86400 but both these
values are quite long. Typically you would use values of 1h and 8h
but opinions seem to vary as to which should be which.<br>
<br>
With these changes what do you see in /var/log/secure when you
start ipsec (only the later part where the conn starts
negotiating, not where openswan is loading)? The log items contain
the reference "pluto[....]".<br>
<br>
Also worth trying is to stop the ClearOS initiating the conn and
see how it responds (rekey=no, auto=add and remove ike and
phase2alg references.<br>
<br>
Regards,<br>
<br>
Nick<br>
<br>
On 30/08/2011 06:49, Tyler J. Wagner wrote:
<blockquote cite="mid:4E5C79FC.1090507@tolaris.com" type="cite">
<pre wrap="">Hello all,
I've been trying to bring up an IPsec VPN between a ClearOS 5.2 device and
a Fortigate router. If anyone has advice or a working example of such a
configuration, I would really appreciate the help.
The ClearOS GUI is useless for this, so I'm really just using a generic
OpenSwan device. On the ClearOS router, the firewall passes esp and ah
traffic input and output, and does not masquerade it. rp_filter is
disabled, and of course ip_forwarding is enabled.
Attached is a condensed ipsec.conf from the ClearOS GUI.
On the Fortigate router, I've created a "route-based VPN", to use the
Fortigate terminology from their IPsec user guide. This means I've
established an IPsec configuration, then created firewall policies for
internal-to-ipsec and ipsec-to-internal traffic directions. I already have
a working Fortigate-to-Fortigate IPsec VPN using this configuration. This
is a second link.
Attached are screenshots of the IPsec config from the Fortigate router.
Suggestions?
Regards,
Tyler
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:Users@openswan.org">Users@openswan.org</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</a>
Micropayments: <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a>
Building and Integrating Virtual Private Networks with Openswan:
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
<a class="moz-txt-link-abbreviated" href="mailto:Users@openswan.org">Users@openswan.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</a>
Micropayments: <a class="moz-txt-link-freetext" href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a>
Building and Integrating Virtual Private Networks with Openswan:
<a class="moz-txt-link-freetext" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
</body>
</html>