<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="GENERATOR" content="GtkHTML/4.6.6">
</head>
<body>
On Cisco side there is 10.0.0.0/24 network while openswan runs on one server where address 10.0.100.1 is a IP attached to loopback sub-interface.
<br>
<br>
<br>
Dnia 2014-07-14, pon o godzinie 15:32 +0100, Nick Howitt pisze:
<blockquote type="CITE">
<pre>
What are the real LAN subnets at either end of the tunnel?
On 2014-07-14 13:51, Piotr Pawłowski wrote:
<font color="#737373">> Indeed... Typo in networks (facepalm)... That's the result of debugging</font>
<font color="#737373">> too long. Thanks for the tip.</font>
<font color="#737373">> Now VPN is established, however there is no possibility to reach any </font>
<font color="#737373">> end</font>
<font color="#737373">> (from openswan I am not able to reach 10.0.0.2/32 and from Cisco I</font>
<font color="#737373">> cannot reach 10.0.100.1).</font>
<font color="#737373">> Route on openswan side is added by the software. Route on Cisco side</font>
<font color="#737373">> looks like this:</font>
<font color="#737373">> ip route 10.0.100.1 255.255.255.255 $ciscoPublicIP</font>
<font color="#737373">> </font>
<font color="#737373">> Any kind of tip will be helpful.</font>
<font color="#737373">> </font>
<font color="#737373">> Regards</font>
<font color="#737373">> Piotr</font>
<font color="#737373">> </font>
<font color="#737373">> </font>
<font color="#737373">> Dnia 2014-07-14, pon o godzinie 09:02 +0100, Nick Howitt pisze:</font>
<font color="#737373">>> I don't know if your configs are edited, but you must not have any </font>
<font color="#737373">>> blank</font>
<font color="#737373">>> lines in a conn. A blank line signifies the end of a conn. It probably</font>
<font color="#737373">>> also applies to config setup. If you want, you can use an indented #</font>
<font color="#737373">>> rather than a totally blank line.</font>
<font color="#737373">>> </font>
<font color="#737373">>> I can't read Cisco configs but it also seems that your </font>
<font color="#737373">>> left/rightsubnets</font>
<font color="#737373">>> don't match your access-list. Is this correct or do you specify </font>
<font color="#737373">>> subnets</font>
<font color="#737373">>> elsewhere in the Cisco config?</font>
<font color="#737373">>> </font>
<font color="#737373">>> Nick</font>
<font color="#737373">>> </font>
<font color="#737373">>> On 2014-07-14 08:36, Piotr Pawłowski wrote:</font>
<font color="#737373">>> > Dear all,</font>
<font color="#737373">>> ></font>
<font color="#737373">>> > From two weeks I am trying to setup ipsec vpn connection between two</font>
<font color="#737373">>> > hosts. One of them is openswan on linux, other is Cisco device. Without</font>
<font color="#737373">>> > luck.</font>
<font color="#737373">>> > Openswan configuration below:</font>
<font color="#737373">>> ></font>
<font color="#737373">>> > config setup</font>
<font color="#737373">>> > interfaces=%defaultroute</font>
<font color="#737373">>> > plutodebug=none</font>
<font color="#737373">>> > klipsdebug=none</font>
<font color="#737373">>> > plutoopts="--perpeerlog"</font>
<font color="#737373">>> ></font>
<font color="#737373">>> > nat_traversal=yes</font>
<font color="#737373">>> > virtual_private=%v4:10.0.100.1/32,%v4:10.0.0.2/32</font>
<font color="#737373">>> > oe=off</font>
<font color="#737373">>> > protostack=netkey</font>
<font color="#737373">>> > plutostderrlog=/var/log/pluto.log</font>
<font color="#737373">>> > conn testConnection</font>
<font color="#737373">>> > auto=start</font>
<font color="#737373">>> > type=tunnel</font>
<font color="#737373">>> > aggrmode=no</font>
<font color="#737373">>> ></font>
<font color="#737373">>> > left=$openswanPublicIP</font>
<font color="#737373">>> > leftsubnet=10.0.100.1/32</font>
<font color="#737373">>> > leftsourceip=10.0.100.1</font>
<font color="#737373">>> ></font>
<font color="#737373">>> > right=$ciscoPublicIP</font>
<font color="#737373">>> > rightsubnet=10.0.0.2/32</font>
<font color="#737373">>> ></font>
<font color="#737373">>> > keyexchange=ike</font>
<font color="#737373">>> > ike=3des-md5-modp1024</font>
<font color="#737373">>> ></font>
<font color="#737373">>> > authby=secret</font>
<font color="#737373">>> ></font>
<font color="#737373">>> > phase2=esp</font>
<font color="#737373">>> > phase2alg=3des-md5</font>
<font color="#737373">>> > pfs=yes</font>
<font color="#737373">>> ></font>
<font color="#737373">>> ></font>
<font color="#737373">>> > Cisco configuration:</font>
<font color="#737373">>> ></font>
<font color="#737373">>> > crypto isakmp policy 1</font>
<font color="#737373">>> > encr 3des</font>
<font color="#737373">>> > hash md5</font>
<font color="#737373">>> > authentication pre-share</font>
<font color="#737373">>> > group 2</font>
<font color="#737373">>> > lifetime 28800</font>
<font color="#737373">>> > crypto isakmp key TestKey address $openswanPublicIP</font>
<font color="#737373">>> > crypto ipsec transform-set OPENSWAN esp-3des esp-md5-hmac</font>
<font color="#737373">>> > mode tunnel</font>
<font color="#737373">>> > crypto map openswan-map 1 ipsec-isakmp</font>
<font color="#737373">>> > set peer $openswanPublicIP</font>
<font color="#737373">>> > set transform-set OPENSWAN</font>
<font color="#737373">>> > match address 190</font>
<font color="#737373">>> > access-list 190 permit ip 10.0.0.0 0.0.1.255 10.0.100.0 0.0.0.255</font>
<font color="#737373">>> ></font>
<font color="#737373">>> ></font>
<font color="#737373">>> ></font>
<font color="#737373">>> > IMHO everything looks fine. Openswan thinks different. Below output</font>
<font color="#737373">>> > from</font>
<font color="#737373">>> > pluto.log.</font>
<font color="#737373">>> ></font>
<font color="#737373">>> > Plutorun started on Mon Jul 14 07:01:57 UTC 2014</font>
<font color="#737373">>> > adjusting ipsec.d to /etc/ipsec.d</font>
<font color="#737373">>> > Starting Pluto (Openswan Version 2.6.28; Vendor ID OEQ{O\177nez{CQ)</font>
<font color="#737373">>> > pid:23920</font>
<font color="#737373">>> > SAref support [disabled]: Protocol not available</font>
<font color="#737373">>> > SAbind support [disabled]: Protocol not available</font>
<font color="#737373">>> > Setting NAT-Traversal port-4500 floating to on</font>
<font color="#737373">>> > port floating activation criteria nat_t=1/port_float=1</font>
<font color="#737373">>> > NAT-Traversal support [enabled]</font>
<font color="#737373">>> > using /dev/urandom as source of random entropy</font>
<font color="#737373">>> > ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC_SSH: Ok (ret=0)</font>
<font color="#737373">>> > ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0)</font>
<font color="#737373">>> > ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0)</font>
<font color="#737373">>> > ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)</font>
<font color="#737373">>> > ike_alg_register_enc(): Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0)</font>
<font color="#737373">>> > ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)</font>
<font color="#737373">>> > ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)</font>
<font color="#737373">>> > starting up 1 cryptographic helpers</font>
<font color="#737373">>> > started helper pid=23924 (fd:4)</font>
<font color="#737373">>> > Using Linux 2.6 IPsec interface code on 2.6.32-5-amd64 (experimental</font>
<font color="#737373">>> > code)</font>
<font color="#737373">>> > using /dev/urandom as source of random entropy</font>
<font color="#737373">>> > ike_alg_register_enc(): Activating aes_ccm_8: Ok (ret=0)</font>
<font color="#737373">>> > ike_alg_add(): ERROR: Algorithm already exists</font>
<font color="#737373">>> > ike_alg_register_enc(): Activating aes_ccm_12: FAILED (ret=-17)</font>
<font color="#737373">>> > ike_alg_add(): ERROR: Algorithm already exists</font>
<font color="#737373">>> > ike_alg_register_enc(): Activating aes_ccm_16: FAILED (ret=-17)</font>
<font color="#737373">>> > ike_alg_add(): ERROR: Algorithm already exists</font>
<font color="#737373">>> > ike_alg_register_enc(): Activating aes_gcm_8: FAILED (ret=-17)</font>
<font color="#737373">>> > ike_alg_add(): ERROR: Algorithm already exists</font>
<font color="#737373">>> > ike_alg_register_enc(): Activating aes_gcm_12: FAILED (ret=-17)</font>
<font color="#737373">>> > ike_alg_add(): ERROR: Algorithm already exists</font>
<font color="#737373">>> > ike_alg_register_enc(): Activating aes_gcm_16: FAILED (ret=-17)</font>
<font color="#737373">>> > Changed path to directory '/etc/ipsec.d/cacerts'</font>
<font color="#737373">>> > Changed path to directory '/etc/ipsec.d/aacerts'</font>
<font color="#737373">>> > Changed path to directory '/etc/ipsec.d/ocspcerts'</font>
<font color="#737373">>> > Changing to directory '/etc/ipsec.d/crls'</font>
<font color="#737373">>> > Warning: empty directory</font>
<font color="#737373">>> > added connection description "testConnection"</font>
<font color="#737373">>> > listening for IKE messages</font>
<font color="#737373">>> > NAT-Traversal: Trying new style NAT-T</font>
<font color="#737373">>> > NAT-Traversal: ESPINUDP(1) setup failed for new style NAT-T family IPv4</font>
<font color="#737373">>> > (errno=19)</font>
<font color="#737373">>> > NAT-Traversal: Trying old style NAT-T</font>
<font color="#737373">>> > adding interface eth0/eth0 $openswanPublicIP:500</font>
<font color="#737373">>> > adding interface eth0/eth0 $openswanPublicIP:4500</font>
<font color="#737373">>> > adding interface lo:1/lo:1 10.0.100.1:500</font>
<font color="#737373">>> > adding interface lo:1/lo:1 10.0.100.1:4500</font>
<font color="#737373">>> > adding interface lo/lo 127.0.0.1:500</font>
<font color="#737373">>> > adding interface lo/lo 127.0.0.1:4500</font>
<font color="#737373">>> > adding interface lo/lo ::1:500</font>
<font color="#737373">>> > loading secrets from "/etc/ipsec.secrets"</font>
<font color="#737373">>> > loading secrets from "/var/lib/openswan/ipsec.secrets.inc"</font>
<font color="#737373">>> > "testConnection" #1: initiating Main Mode</font>
<font color="#737373">>> > "testConnection" #1: received Vendor ID payload [RFC 3947] method set</font>
<font color="#737373">>> > to=109</font>
<font color="#737373">>> > "testConnection" #1: enabling possible NAT-traversal with method 4</font>
<font color="#737373">>> > "testConnection" #1: transition from state STATE_MAIN_I1 to state</font>
<font color="#737373">>> > STATE_MAIN_I2</font>
<font color="#737373">>> > "testConnection" #1: STATE_MAIN_I2: sent MI2, expecting MR2</font>
<font color="#737373">>> > "testConnection" #1: received Vendor ID payload [Cisco-Unity]</font>
<font color="#737373">>> > "testConnection" #1: received Vendor ID payload [Dead Peer Detection]</font>
<font color="#737373">>> > "testConnection" #1: ignoring unknown Vendor ID payload</font>
<font color="#737373">>> > [9df211f6d27b7ea9251edca1d227fdd5]</font>
<font color="#737373">>> > "testConnection" #1: received Vendor ID payload [XAUTH]</font>
<font color="#737373">>> > "testConnection" #1: NAT-Traversal: Result using RFC 3947</font>
<font color="#737373">>> > (NAT-Traversal): no NAT detected</font>
<font color="#737373">>> > "testConnection" #1: transition from state STATE_MAIN_I2 to state</font>
<font color="#737373">>> > STATE_MAIN_I3</font>
<font color="#737373">>> > "testConnection" #1: STATE_MAIN_I3: sent MI3, expecting MR3</font>
<font color="#737373">>> > "testConnection" #1: Main mode peer ID is ID_IPV4_ADDR:</font>
<font color="#737373">>> > '$ciscoPublicIP'</font>
<font color="#737373">>> > "testConnection" #1: transition from state STATE_MAIN_I3 to state</font>
<font color="#737373">>> > STATE_MAIN_I4</font>
<font color="#737373">>> > "testConnection" #1: STATE_MAIN_I4: ISAKMP SA established</font>
<font color="#737373">>> > {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5</font>
<font color="#737373">>> > group=modp1024}</font>
<font color="#737373">>> > "testConnection" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP</font>
<font color="#737373">>> > +IKEv2ALLOW {using isakmp#1 msgid:b73ac6a6</font>
<font color="#737373">>> > proposal=3DES(3)_192-MD5(1)_128 pfsgroup=OAKLEY_GROUP_MODP1024}</font>
<font color="#737373">>> > "testConnection" #1: ignoring informational payload, type</font>
<font color="#737373">>> > NO_PROPOSAL_CHOSEN msgid=00000000</font>
<font color="#737373">>> > "testConnection" #1: received and ignored informational message</font>
<font color="#737373">>> > :testConnection" #2: max number of retransmissions (2) reached</font>
<font color="#737373">>> > STATE_QUICK_I1. No acceptable response to our first Quick Mode</font>
<font color="#737373">>> > message:</font>
<font color="#737373">>> > perhaps peer likes no proposal</font>
<font color="#737373">>> ></font>
<font color="#737373">>> > I also tried with 'transform-set esp-aes 256 esp-sha-hmac' on Cisco</font>
<font color="#737373">>> > side</font>
<font color="#737373">>> > and keyexchange=ike , ike=3des-md5-modp1024 , phase2=esp ,</font>
<font color="#737373">>> > phase2alg=3des-md5;modp1024 on openswan side. Also with same error as</font>
<font color="#737373">>> > shown in pluto.log .</font>
<font color="#737373">>> ></font>
<font color="#737373">>> > Can anybody point the area, where I am doing something wrong?</font>
<font color="#737373">>> > Thank you in advance.</font>
<font color="#737373">>> ></font>
<font color="#737373">>> > Regards</font>
<font color="#737373">>> > Piotr</font>
<font color="#737373">>> > _______________________________________________</font>
<font color="#737373">>> > <a href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a></font>
<font color="#737373">>> > <a href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a></font>
<font color="#737373">>> > Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a></font>
<font color="#737373">>> > Building and Integrating Virtual Private Networks with Openswan:</font>
<font color="#737373">>> > <a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a></font>
<font color="#737373">> _______________________________________________</font>
<font color="#737373">> <a href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a></font>
<font color="#737373">> <a href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a></font>
<font color="#737373">> Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a></font>
<font color="#737373">> Building and Integrating Virtual Private Networks with Openswan:</font>
<font color="#737373">> <a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a></font>
</pre>
</blockquote>
</body>
</html>