<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>I know nothing about Cisco kit, but I've seen specifying a phase 2 modp mess things up. I'd try changing phase2alg=aes128-sha1;modp1024 to just phase2alg=aes128-sha1 but leave in pfs=yes. Having said that, if you set pfs=no, then if the Cisco proposes yes Openswan will negotiate yes anyway.</p>
<p>Nick</p>
<p>On 2014-03-19 17:18, Mike Johnston wrote:</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div class="moz-cite-prefix">I'm not too well versed on this stuff, but I have a few thoughts for you:<br />
<ul>
<li>Make sure your secrets match.</li>
<li>Make sure the IP addresses in your secrets file are accurate.</li>
<li>Try doing some debugging on the ASA.
<ul>
<li>debug crypto isakmp 200 or even debug crypto isakmp 255</li>
<li>debug crypto ipsec</li>
</ul>
</li>
<li>I never could get pfs to work between Openswan and a Cisco firewall. Try temporarily turning off pfs on both ends and see if you get any better luck.</li>
</ul>
</div>
<!-- html ignored --><br />
<pre>_______________________________________________
<a href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a>
<a href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a>
Building and Integrating Virtual Private Networks with Openswan:
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
</body></html>