<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-CA link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hello people.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I need some help getting an openSwan computer on my internal network to connect to Juniper srx VPN device rented from our ISP.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Here are the settings I have been told to use from the ISP. I cannot view these and have asked them to verify all settings at their end, as I know we need to be exact. They do not support my setup and cannot offer any guidance on how to connect to this device. Just the settings.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Here is what I was told:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Open firewall ports 4500, 500 and ESP protocol 50 on router<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>VPN Settings:<o:p></o:p></p><p class=MsoNormal>ipSec Tunnel<o:p></o:p></p><p class=MsoNormal>Shared Key<o:p></o:p></p><p class=MsoNormal>host ip - xxx.xxx.xxx.xxx<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Phase 1 (IKE) Settings<o:p></o:p></p><p class=MsoNormal>Exchange Mode - Main<o:p></o:p></p><p class=MsoNormal>Encryption - AES - 128 bit<o:p></o:p></p><p class=MsoNormal>Authentication - SHA1<o:p></o:p></p><p class=MsoNormal>DH Group 2 - 3DES <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Phase 2 Settings<o:p></o:p></p><p class=MsoNormal>Protocol - ESP128<o:p></o:p></p><p class=MsoNormal>Encryption - AES - 256 bit<o:p></o:p></p><p class=MsoNormal>Aggressive - Main<o:p></o:p></p><p class=MsoNormal>Authentication - SHA1 DES<o:p></o:p></p><p class=MsoNormal>Key Lifetime (seconds) - 3600 - 3DES<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Other Settings<o:p></o:p></p><p class=MsoNormal>AES - 256 bit<o:p></o:p></p><p class=MsoNormal>Perfect Forward Secrecy - Yes MD5<o:p></o:p></p><p class=MsoNormal>DH Group<o:p></o:p></p><p class=MsoNormal>DH Group 2 - 3DES SHA1<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Once you have your tunnel up, you should be able to SSH to your server with the following<o:p></o:p></p><p class=MsoNormal>connection information:<o:p></o:p></p><p class=MsoNormal>IP: 192.168.12.1<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>My network has a public IP configured on a Cisco Router<o:p></o:p></p><p class=MsoNormal>yyy.yyy.yyy.yyy<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>And the computers behind it are all on a .16 subnet<o:p></o:p></p><p class=MsoNormal>192.168.16.xx<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have researched and tried to get my ipsec.conf file ready for this.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'>config setup<br> interfaces="%defaultroute"<br> # Debug-logging controls: "none" for (almost) none, "all" for lots.<br> klipsdebug=all<br> #plutodebug="control parsing"<br> plutodebug=all<br> # For Red Hat Enterprise Linux and Fedora, leave protostack=netkey<br> protostack=netkey<br> nat_traversal=yes<br> #virtual_private=<br> oe=off<br> # Enable this if you see "failed to find any available worker"<br> # nhelpers=0<br><br>#You may put your configuration (.conf) file in the "/etc/ipsec.d/"<br>#include /etc/ipsec.d/*.conf<br>conn aliantVPN<br> authby=secret<br> auto=start<br> type=tunnel<br> #left=192.168.16.yy<br> left=yyy.yyy.yyy.yyy<br> leftnexthop=%defaultroute<br> leftsubnet=192.168.16.0/24<br> right=xxx.xxx.xxx.xxx<br> rightsubnet=192.168.12.0/24<br> rightnexthop=%defaultroute<br> keylife=3600s<br> #esp=<br> #ike=AES128-sha1<br> phase2=esp<br> phase2alg=aes256-sha1<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>However, I get 2 errors depending on small changes to the file. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If I use the left IP as my public IP then I see "We cannot identify ourselves with the other end of this connection" errors in secure.log<o:p></o:p></p><p class=MsoNormal>If I use the left IP as my internal openSwan computer IP then I see "No_PROPOSAL_CHOSEN" errors in secure.log<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Any suggestions help is greatly appreciated.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thank you.<o:p></o:p></p><p class=MsoNormal>Sean<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>