<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; "><div>Hi,</div><div><br></div><div>My openswan version is U2.6.37, OS is fedora 16. I want to use openswan</div><div>as a client and Cisco ASA as a VPN server.</div><div> I use following URL as a reference:</div><div><a href="http://binaryjunction.com/2010/05/07/openswan-vpn-client-cisco-servers">http://binaryjunction.com/2010/05/07/openswan-vpn-client-cisco-servers</a>/</div><div><br></div><div><br></div><div>Client ip: 10.140.28.12</div><div>Server ip:10.75.189.105</div><div><br></div><div>Here is my ipsec.conf:</div><div><br></div><div><div>version 2.0 # must support 2.0 openswan</div><div><br></div><div># basic configuration</div><div>config setup</div><div> protostack=netkey</div><div> nat_traversal=yes</div><div> interfaces=%defaultroute</div><div> plutodebug=none</div><div> strictcrlpolicy=no</div><div> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12</div><div> oe=off</div><div><br></div><div>conn labVPN</div><div> type=tunnel</div><div> authby=secret</div><div> left=%defaultroute</div><div> leftid=@mum</div><div> leftxauthclient=yes</div><div> leftmodecfgclient=yes</div><div> leftxauthusername=VPNTester</div><div> right=10.75.189.105</div><div> remote_peer_type=cisco</div><div> rightxauthserver=yes</div><div> rightmodecfgserver=yes</div><div> modecfgpull=yes</div><div> keyexchange=ike</div><div> ike=3des-md5;modp1024</div><div> esp=3des-md5;modp1024</div><div> #ikelifetime=28800s</div><div> #keylife=60m</div><div> #compress=no</div><div> aggrmode=yes</div><div> pfs=no</div><div> auto=add</div></div><div><br></div><div>When I use ipsec auto —up labVPN, the output seems OK…</div><div><div>112 "labVPN" #1: STATE_AGGR_I1: initiate</div><div>003 "labVPN" #1: received Vendor ID payload [XAUTH]</div><div>003 "labVPN" #1: received Vendor ID payload [RFC 3947] method set to=109 </div><div>003 "labVPN" #1: received Vendor ID payload [Dead Peer Detection]</div><div>003 "labVPN" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected</div><div>004 "labVPN" #1: STATE_AGGR_I2: sent AI2, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}</div><div>004 "labVPN" #1: STATE_XAUTH_I1: XAUTH client - awaiting CFG_set</div><div>004 "labVPN" #1: STATE_XAUTH_I1: XAUTH client - awaiting CFG_set</div><div>004 "labVPN" #1: STATE_MAIN_I4: ISAKMP SA established</div><div>117 "labVPN" #2: STATE_QUICK_I1: initiate</div></div><div><br></div><div>But no tunnel up:</div><div><div># /etc/init.d/ipsec status</div><div>IPsec running - pluto pid: 29480</div><div>pluto pid 29480</div><div>No tunnels up</div></div><div><br></div><div><div># tail -20 /var/log/messages</div><div>Dec 31 15:42:21 localhost pluto[29480]: ike_alg_register_enc(): Activating aes_gcm_16: FAILED (ret=-17)</div><div>Dec 31 15:42:21 localhost pluto[29480]: Changed path to directory '/etc/ipsec.d/cacerts'</div><div>Dec 31 15:42:21 localhost pluto[29480]: loaded CA cert file 'cacert.pem' (1025 bytes)</div><div>Dec 31 15:42:21 localhost pluto[29480]: Could not change to directory '/etc/ipsec.d/aacerts': /</div><div>Dec 31 15:42:21 localhost pluto[29480]: Could not change to directory '/etc/ipsec.d/ocspcerts': /</div><div>Dec 31 15:42:21 localhost pluto[29480]: Could not change to directory '/etc/ipsec.d/crls'</div><div>Dec 31 15:42:21 localhost pluto[29480]: added connection description "labVPN"</div><div>Dec 31 15:42:21 localhost ipsec__plutorun: 002 added connection description "labVPN"</div><div>Dec 31 15:42:21 localhost pluto[29480]: listening for IKE messages</div><div>Dec 31 15:42:21 localhost pluto[29480]: adding interface eth0/eth0 10.140.28.12:500</div><div>Dec 31 15:42:21 localhost pluto[29480]: adding interface eth0/eth0 10.140.28.12:4500</div><div>Dec 31 15:42:21 localhost pluto[29480]: adding interface lo/lo 127.0.0.1:500</div><div>Dec 31 15:42:21 localhost pluto[29480]: adding interface lo/lo 127.0.0.1:4500</div><div>Dec 31 15:42:21 localhost pluto[29480]: adding interface lo/lo ::1:500</div><div>Dec 31 15:42:21 localhost pluto[29480]: loading secrets from "/etc/ipsec.secrets"</div><div>Dec 31 15:42:31 localhost pluto[29480]: packet from 10.75.189.105:500: Quick Mode message is for a non-existent (expired?) ISAKMP SA</div></div><div><br></div><div>I think my ASA setting is OK, because I can use vpnc to establish the connection. </div><div><br></div><div>Regards,</div><div>Yiyun</div></body></html>