<div dir="ltr">anyone?<div>pls help ))</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">2014-04-14 9:42 GMT+07:00 Vladimir Obukhov <span dir="ltr"><<a href="mailto:stncldbsh@gmail.com" target="_blank">stncldbsh@gmail.com</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">ok I've moved on a bit<div>if I do:</div><div># ipsec auto --verbose --down md-ene-mikrotik</div><div>
# ipsec auto --verbose --up md-ene-mikrotik</div><div><div class="gmail_extra">I get my tunnel up and running!</div>
<div class="gmail_extra"><br></div><div class="gmail_extra"><div class="gmail_extra">/etc/init.d/ipsec restart</div><div class="gmail_extra">ipsec_setup: Stopping Openswan IPsec...</div><div class="gmail_extra">ipsec_setup: Starting Openswan IPsec U2.6.23/K2.6.32-50-generic-pae...</div>
<div class="gmail_extra">ipsec_setup: Command line is not complete. Try option "help"</div><div><br></div><div>so the problem is with startup scripts or smth</div><div>perhaps there is a fix for this, pls help</div>
<br><div class="gmail_quote">2014-04-10 15:58 GMT+07:00 Vladimir Obukhov <span dir="ltr"><<a href="mailto:stncldbsh@gmail.com" target="_blank">stncldbsh@gmail.com</a>></span>:<div><div class="h5"><br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr">Hello,<div><br><div><div>I am trying to make a tunnel between </div><div><div>Linux Openswan U2.6.23/K2.6.32-50-generic-pae (netkey)</div></div><div>and RouterOS 6.11</div><div>they are connected as follows:</div>
<div>LAN <a href="http://192.168.20.0/24===%5B" target="_blank">192.168.20.0/24===[</a> 88.888.8.88 OPENSWAN ] ...INTERNET... [ 77.777.77.7 ROUTEROS ]===<a href="http://192.168.17.0/24" target="_blank">192.168.17.0/24</a> LAN;</div>
<div><br></div><div>here's what I see on linux box</div>
<div># ipsec auto --status</div><div>"md-ene-mikrotik":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 1340s; newest ISAKMP; lastdpd=70s(seq in:0 out:0); idle; import:not set<br></div><div>
<br></div><div>on mikrotik I also see</div><div>> ip ipsec remote-peers print</div><div> 0 local-address=77.777.77.7 remote-address=88.888.8.88 state=established side=initiator established=38m5s <br></div><div><br></div>
<div>so the first phase goes right</div><div><div><br></div><div>but I see no sa-installed on microtic</div><div>[admin@MikroTik] > ip ipsec installed-sa print</div></div><div><br></div><div># ip xfrm state</div><div>
gives nothing</div>
<div><br></div><div><br></div><div>below are the settings on both sides, let me know if more info is needed</div><div>by the way, there is one more tunnel between this mikrotik and another one, works fine.</div><div>Thanks!</div>
<div><br></div><div>here's my /etc/ipsec.conf</div><div><br></div><div><div>config setup</div><div> virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12" target="_blank">10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12</a></div>
<div> oe=off</div><div> protostack=netkey</div><div><br></div><div>conn md-ene-mikrotik</div><div> esp=3des-sha1</div><div> ike=3des-md5-modp1024</div><div> authby=secret</div><div> keylife=28800s</div>
<div> left=88.888.8.88</div><div> leftsubnet=<a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a></div><div> leftsourceip=192.168.20.1</div><div> right=77.777.77.7</div><div> rightsubnet=<a href="http://192.168.17.0/24" target="_blank">192.168.17.0/24</a></div>
<div> rightsourceip=192.168.17.1</div><div> auto=add</div><div> type=tunnel</div><div> pfs=no</div></div><div><br></div></div></div><div>here's mikrotik conf</div><div>> ip ipsec peer print</div><div><div>
1 address=88.888.8.88/32 local-address=0.0.0.0 passive=no port=500 auth-method=pre-shared-key secret="cthdbc" generate-policy=no exchange-mode=main send-initial-contact=yes proposal-check=obey hash-algorithm=md5 enc-algorithm=3des </div>
<div> dh-group=modp1024 lifetime=1d lifebytes=0 dpd-interval=2m dpd-maximum-failures=5 </div></div><div><br></div><div>> ip ipsec policy print</div><div> 1 src-address=<a href="http://192.168.17.0/24" target="_blank">192.168.17.0/24</a> src-port=any dst-address=<a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a> dst-port=any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes sa-src-address=77.777.77.7 sa-dst-address=88.888.8.88 proposal=proposal1 priority=0 </div>
<div><br></div><div>> ip ipsec proposal print</div><div><div> 1 name="proposal1" auth-algorithms=sha1 enc-algorithms=3des lifetime=8h pfs-group=modp1024 </div></div><div><br></div><div><br></div></div>
</blockquote></div></div></div><br></div></div></div>
</blockquote></div><br></div>