<div dir="ltr"><div>Thanks - got that loaded and its now doing something:<br></div><div><br></div><div style>New addition: x.x.x.w = Default Gateway on the eth0 interface</div><div><br></div><div><div># ipsec status</div><div>000 using kernel interface: netkey</div><div>000 interface lo/lo ::1</div><div>000 interface lo/lo 127.0.0.1</div><div>000 interface eth0/eth0 197.189.240.195</div><div>000 interface eth1/eth1 10.0.64.150</div><div>000 %myid = (none)</div><div>000 debug none</div><div>000</div><div>000 virtual_private (%priv):</div><div>000 - allowed 0 subnets:</div><div>000 - disallowed 0 subnets:</div><div>000 WARNING: Either virtual_private= is not specified, or there is a syntax</div><div>000 error in that line. 'left/rightsubnet=vhost:%priv' will not work!</div><div>000 WARNING: Disallowed subnets in virtual_private= is empty. If you have</div><div>000 private address space in internal use, it should be excluded!</div><div>000</div><div>000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192</div><div>000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8, keysizemin=128, keysizemax=128</div><div>000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448</div><div>000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0</div><div>000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=12, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=16, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=12, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=16, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=22, name=(null), ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128</div><div>000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160</div><div>000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256</div><div>000 algorithm ESP auth attr: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384, keysizemin=384, keysizemax=384</div><div>000 algorithm ESP auth attr: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512, keysizemin=512, keysizemax=512</div><div>000 algorithm ESP auth attr: id=8, name=(null), keysizemin=160, keysizemax=160</div><div>000 algorithm ESP auth attr: id=9, name=(null), keysizemin=128, keysizemax=128</div><div>000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0, keysizemax=0</div><div>000</div><div>000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=128</div><div>000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=128</div><div>000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=128</div><div>000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=128</div><div>000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=128</div><div>000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=128</div><div>000 algorithm IKE encrypt: id=3, name=OAKLEY_BLOWFISH_CBC, blocksize=8, keydeflen=128</div><div>000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192</div><div>000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128</div><div>000 algorithm IKE encrypt: id=65004, name=OAKLEY_SERPENT_CBC, blocksize=16, keydeflen=128</div><div>000 algorithm IKE encrypt: id=65005, name=OAKLEY_TWOFISH_CBC, blocksize=16, keydeflen=128</div><div>000 algorithm IKE encrypt: id=65289, name=OAKLEY_TWOFISH_CBC_SSH, blocksize=16, keydeflen=128</div><div>000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16</div><div>000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20</div><div>000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32</div><div>000 algorithm IKE hash: id=5, name=OAKLEY_SHA2_384, hashsize=48</div><div>000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64</div><div>000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024</div><div>000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536</div><div>000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048</div><div>000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072</div><div>000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096</div><div>000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144</div><div>000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192</div><div>000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024</div><div>000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048</div><div>000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048</div><div>000</div><div>000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,2,64} trans={0,2,3072} attrs={0,2,2048}</div><div>000</div><div>000 "tj-vpn": <a href="http://10.0.0.0/16===x.x.x.x">10.0.0.0/16===x.x.x.x</a><x.x.x.x>[+S=C]---x.x.x.w...x.x.x.w---y.y.y.y<y.y.y.y>[+S=C]===z.z.z.z/32; prospective erouted; eroute owner: #0</div><div>000 "tj-vpn": myip=unset; hisip=unset;</div><div>000 "tj-vpn": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; nat_keepalive: yes</div><div>000 "tj-vpn": policy: PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 16,32; interface: eth0;</div><div>000 "tj-vpn": newest ISAKMP SA: #0; newest IPsec SA: #0;</div><div>000 "tj-vpn": IKE algorithms wanted: AES_CBC(7)_256-SHA1(2)_000-MODP1536(5), AES_CBC(7)_256-SHA1(2)_000-MODP1024(2)</div><div>000 "tj-vpnt": IKE algorithms found: AES_CBC(7)_256-SHA1(2)_160-MODP1536(5), AES_CBC(7)_256-SHA1(2)_160-MODP1024(2)</div><div>000 "tj-vpn": ESP algorithms wanted: AES(12)_256-SHA1(2)_000</div><div>000 "tj-vpn": ESP algorithms loaded: AES(12)_256-SHA1(2)_160</div><div>000</div><div>000 #16: "tj-vpn":500 STATE_MAIN_I2 (sent MI2, expecting MR2); EVENT_RETRANSMIT in 38s; nodpd; idle; import:admin initiate</div><div>000 #16: pending Phase 2 for "tj-vpn" replacing #0</div><div>000</div></div><div><br></div><div><div># ipsec auto --up tj-vpn</div><div>104 "tj-vpn" #20: STATE_MAIN_I1: initiate</div><div>003 "tj-vpn" #20: ignoring Vendor ID payload [FRAGMENTATION c0000000]</div><div>106 "tj-vpn" #20: STATE_MAIN_I2: sent MI2, expecting MR2</div><div>010 "tj-vpn" #20: STATE_MAIN_I2: retransmission; will wait 20s for response</div><div>003 "tj-vpn" #20: ignoring informational payload, type INVALID_COOKIE msgid=00000000</div><div>003 "tj-vpn" #20: received and ignored informational message</div><div>010 "tj-vpn" #20: STATE_MAIN_I2: retransmission; will wait 40s for response</div><div>003 "tj-vpn" #20: ignoring informational payload, type INVALID_COOKIE msgid=00000000</div><div>003 "tj-vpn" #20: received and ignored informational message</div><div>031 "tj-vpn" #20: max number of retransmissions (2) reached STATE_MAIN_I2</div><div>000 "tj-vpn" #20: starting keying attempt 2 of an unlimited number, but releasing whack</div></div><div><br></div><div style>Any ideas whats happening?</div><div><br></div><div style>Cheers</div><div style>Ian</div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Apr 23, 2015 at 10:00 PM, Neal Murphy <span dir="ltr"><<a href="mailto:neal.p.murphy@alum.wpi.edu" target="_blank">neal.p.murphy@alum.wpi.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">'modprobe ipsec' to load the klips module. IIf that fails, remove<br>
'protostack=klips' from the config and use netkey.<br>
<span class="HOEnZb"><font color="#888888"><br>
N<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
On Thursday, April 23, 2015 03:56:11 PM you wrote:<br>
> Hey Neal,<br>
><br>
> Thanks for the prompt response.<br>
><br>
> I am getting the following with your suggested config - have I done<br>
> something wrong?<br>
><br>
> # /etc/init.d/ipsec restart<br>
> ipsec_setup: Stopping Openswan IPsec...<br>
> ipsec_setup: Starting Openswan IPsec 2.6.32...<br>
> ipsec_setup: No KLIPS support found while requested, desperately falling<br>
> back to netkey<br>
> ipsec_setup: NETKEY support found. Use protostack=netkey in /etc/ipsec.conf<br>
> to avoid attempts to use KLIPS. Attempting to continue with NETKEY<br>
> ipsec_setup: /usr/libexec/ipsec/addconn Non-fips mode set in<br>
> /proc/sys/crypto/fips_enabled<br>
><br>
> # ipsec status<br>
> 000 using kernel interface: noklips<br>
> 000 %myid = (none)<br>
> 000 debug none<br>
> 000<br>
> 000 virtual_private (%priv):<br>
> 000 - allowed 0 subnets:<br>
> 000 - disallowed 0 subnets:<br>
> 000 WARNING: Either virtual_private= is not specified, or there is a syntax<br>
> 000 error in that line. 'left/rightsubnet=vhost:%priv' will not<br>
> work!<br>
> 000 WARNING: Disallowed subnets in virtual_private= is empty. If you have<br>
> 000 private address space in internal use, it should be excluded!<br>
> 000<br>
> 000<br>
> 000 algorithm IKE encrypt: id=3, name=OAKLEY_BLOWFISH_CBC, blocksize=8,<br>
> keydeflen=128<br>
> 000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8,<br>
> keydeflen=192<br>
> 000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16,<br>
> keydeflen=128<br>
> 000 algorithm IKE encrypt: id=65004, name=OAKLEY_SERPENT_CBC, blocksize=16,<br>
> keydeflen=128<br>
> 000 algorithm IKE encrypt: id=65005, name=OAKLEY_TWOFISH_CBC, blocksize=16,<br>
> keydeflen=128<br>
> 000 algorithm IKE encrypt: id=65289, name=OAKLEY_TWOFISH_CBC_SSH,<br>
> blocksize=16, keydeflen=128<br>
> 000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<br>
> 000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<br>
> 000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32<br>
> 000 algorithm IKE hash: id=5, name=OAKLEY_SHA2_384, hashsize=48<br>
> 000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64<br>
> 000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024<br>
> 000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536<br>
> 000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048<br>
> 000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072<br>
> 000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096<br>
> 000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144<br>
> 000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192<br>
> 000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024<br>
> 000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048<br>
> 000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048<br>
> 000<br>
> 000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0}<br>
> trans={0,0,0} attrs={0,0,0}<br>
> 000<br>
> 000<br>
> 000<br>
><br>
><br>
> # ipsec auto --add tj-vpn<br>
> /usr/libexec/ipsec/addconn Non-fips mode set in<br>
> /proc/sys/crypto/fips_enabled<br>
> 023 address family inconsistency in this connection=2 host=2/nexthop=0<br>
> 037 attempt to load incomplete connection<br>
><br>
> Any suggestions?<br>
><br>
> Cheers<br>
> Ian<br>
><br>
> On Thu, Apr 23, 2015 at 8:50 PM, Neal Murphy <<a href="mailto:neal.p.murphy@alum.wpi.edu">neal.p.murphy@alum.wpi.edu</a>><br>
><br>
> wrote:<br>
> > Try a more minimal config:<br>
> ><br>
> > ---<br>
> > config setup<br>
> ><br>
> > protostack=klips<br>
> > interfaces=%defaultroute<br>
> > klipsdebug=none<br>
> > plutodebug=none<br>
> > plutowait=no<br>
> > uniqueids=yes<br>
> ><br>
> > conn tj-vpn<br>
> ><br>
> > authby=secret<br>
> > esp=aes256-sha1<br>
> > ike=aes256-sha1<br>
> > keyexchange=ike<br>
> > pfs=no<br>
> > left=x.x.x.x<br>
> > leftsubnet=<a href="http://10.0.0.0/16" target="_blank">10.0.0.0/16</a><br>
> > leftnexthop=%defaultroute<br>
> > right=y.y.y.y<br>
> > rightsubnet=z.z.z.z/32<br>
> > rightnexthop=%defaultroute<br>
> > auto=start<br>
> ><br>
> > ---<br>
> ><br>
> > Come to think of it, you might just be missing rightnexthop.<br>
> ><br>
> > N<br>
> ><br>
> > On Thursday, April 23, 2015 02:31:10 PM Ian Barnes wrote:<br>
> > > Hi All<br>
> > ><br>
> > > Apologies for the probable stupid question - but I am having some<br>
> ><br>
> > problems<br>
> ><br>
> > > getting an IPSEC tunnel up and running to a provider.<br>
> > ><br>
> > > Here is my network config:<br>
> > ><br>
> > > *Connecting Server*<br>
> > > Connecting Server has two interfaces<br>
> > > eth0: x.x.x.x/28<br>
> > > eth1: <a href="http://10.0.64.150/24" target="_blank">10.0.64.150/24</a><br>
> > ><br>
> > > Connecting server is running CentOS 6.6, OpenSwan (2.6.32-37.el6)<br>
> > ><br>
> > > Here is a verify:<br>
> > > # ipsec verify<br>
> > > Checking your system to see if IPsec got installed and started<br>
> > > correctly: Version check and ipsec on-path<br>
> > > [OK] Linux Openswan U2.6.32/K2.6.32-504.el6.x86_64 (netkey)<br>
> > > Checking for IPsec support in kernel [OK]<br>
> > ><br>
> > > SAref kernel support [N/A]<br>
> > > NETKEY: Testing for disabled ICMP send_redirects [OK]<br>
> > ><br>
> > > NETKEY detected, testing for disabled ICMP accept_redirects [OK]<br>
> > > Testing against enforced SElinux mode [OK]<br>
> > > Checking that pluto is running [OK]<br>
> > ><br>
> > > Pluto listening for IKE on udp 500 [OK]<br>
> > > Pluto listening for NAT-T on udp 4500 [OK]<br>
> > ><br>
> > > Two or more interfaces found, checking IP forwarding [OK]<br>
> > > Checking NAT and MASQUERADEing [OK]<br>
> > > Checking for 'ip' command [OK]<br>
> > > Checking /bin/sh is not /bin/dash [OK]<br>
> > > Checking for 'iptables' command [OK]<br>
> > > Opportunistic Encryption Support [DISABLED]<br>
> > ><br>
> > ><br>
> > > *Remote Server*<br>
> > > Here are the connection details of the remote connection i've been<br>
> > > given: Remote IP: y.y.y.y<br>
> > > Internal IP: z.z.z.z<br>
> > ><br>
> > > *Phase 1:*<br>
> > > Cipher: AES-256<br>
> > > MD Algorithm: SHA1<br>
> > > LifeTime: 86400sec<br>
> > > DH Group: 2<br>
> > > IKE Mode: Main<br>
> > > Auth Mode: PSK<br>
> > ><br>
> > > *Phase 2:*<br>
> > > IPSec Type: ESP<br>
> > > Cipher: AES-256<br>
> > > MD Algorithm: SHA1<br>
> > > PFS: NO<br>
> > > LifeTime: 3600seconds<br>
> > > Granularity: Host<br>
> > ><br>
> > ><br>
> > > *My Config*<br>
> > > conn tj-vpn<br>
> > ><br>
> > > type=tunnel<br>
> > > auth=esp<br>
> > > authby=secret<br>
> > > ikelifetime=86400m<br>
> > > rekeymargin=10m<br>
> > > rekeyfuzz=0%<br>
> > > keylife=3600s<br>
> > > esp=aes256-sha1<br>
> > > ike=aes256-sha1<br>
> > > keyexchange=ike<br>
> > > pfs=no<br>
> > > left=x.x.x.x<br>
> > > leftsubnet=<a href="http://10.0.0.0/16" target="_blank">10.0.0.0/16</a><br>
> > > leftnexthop=%defaultroute<br>
> > > right=y.y.y.y<br>
> > > rightsubnet=z.z.z.z/32<br>
> > > auto=start<br>
> > ><br>
> > > Startup shows the following:<br>
> > ><br>
> > > # ipsec auto --up tj-vpn<br>
> > > 104 "tj-vpn" #2: STATE_MAIN_I1: initiate<br>
> > > 003 "tj-vpn" #2: received Vendor ID payload [RFC 3947] method set<br>
> > > to=109 003 "tj-vpn" #2: ignoring Vendor ID payload [FRAGMENTATION<br>
> > > c0000000] 003 "tj-vpn" #2: peer requested 5184000 seconds which<br>
> > > exceeds our limit 86400 seconds. Attribute OAKLEY_LIFE_DURATION<br>
> > > (variable length) 003 "tj-vpn" #2: no acceptable Oakley Transform<br>
> > > 214 "tj-vpn" #2: STATE_MAIN_I1: NO_PROPOSAL_CHOSEN<br>
> > > *JUST HANGS THERE*<br>
> > ><br>
> > > # ipsec --status<br>
> > > 000 using kernel interface: netkey<br>
> > > 000 interface lo/lo ::1<br>
> > > 000 interface lo/lo 127.0.0.1<br>
> > > 000 interface lo/lo 127.0.0.1<br>
> > > 000 interface eth0/eth0 x.x.x.x<br>
> > > 000 interface eth0/eth0 x.x.x.x<br>
> > > 000 interface eth1/eth1 10.0.64.150<br>
> > > 000 interface eth1/eth1 10.0.64.150<br>
> > > 000 %myid = (none)<br>
> > > 000 debug none<br>
> > > 000<br>
> > > 000 virtual_private (%priv):<br>
> > > 000 - allowed 0 subnets:<br>
> > > 000 - disallowed 0 subnets:<br>
> > > 000 WARNING: Either virtual_private= is not specified, or there is a<br>
> ><br>
> > syntax<br>
> ><br>
> > > 000 error in that line. 'left/rightsubnet=vhost:%priv' will<br>
> > > not work!<br>
> > > 000 WARNING: Disallowed subnets in virtual_private= is empty. If you<br>
> > > have 000 private address space in internal use, it should be<br>
> ><br>
> > excluded!<br>
> ><br>
> > > 000<br>
> > > 000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8,<br>
> > > keysizemin=192, keysizemax=192<br>
> > > 000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8,<br>
> > > keysizemin=128, keysizemax=128<br>
> > > 000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8,<br>
> ><br>
> > keysizemin=40,<br>
> ><br>
> > > keysizemax=448<br>
> > > 000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0,<br>
> > > keysizemax=0<br>
> > > 000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8,<br>
> > > keysizemin=128, keysizemax=256<br>
> > > 000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8,<br>
> > > keysizemin=128, keysizemax=256<br>
> > > 000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8,<br>
> > > keysizemin=128, keysizemax=256<br>
> > > 000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=12,<br>
> > > keysizemin=128, keysizemax=256<br>
> > > 000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=16,<br>
> > > keysizemin=128, keysizemax=256<br>
> > > 000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8,<br>
> > > keysizemin=128, keysizemax=256<br>
> > > 000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=12,<br>
> > > keysizemin=128, keysizemax=256<br>
> > > 000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=16,<br>
> > > keysizemin=128, keysizemax=256<br>
> > > 000 algorithm ESP encrypt: id=22, name=(null), ivlen=8, keysizemin=128,<br>
> > > keysizemax=256<br>
> > > 000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8,<br>
> > > keysizemin=128, keysizemax=256<br>
> > > 000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8,<br>
> > > keysizemin=128, keysizemax=256<br>
> > > 000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5,<br>
> > > keysizemin=128, keysizemax=128<br>
> > > 000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1,<br>
> > > keysizemin=160, keysizemax=160<br>
> > > 000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256,<br>
> > > keysizemin=256, keysizemax=256<br>
> > > 000 algorithm ESP auth attr: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384,<br>
> > > keysizemin=384, keysizemax=384<br>
> > > 000 algorithm ESP auth attr: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512,<br>
> > > keysizemin=512, keysizemax=512<br>
> > > 000 algorithm ESP auth attr: id=8, name=(null), keysizemin=160,<br>
> > > keysizemax=160<br>
> > > 000 algorithm ESP auth attr: id=9, name=(null), keysizemin=128,<br>
> > > keysizemax=128<br>
> > > 000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0,<br>
> > > keysizemax=0 000<br>
> > > 000 algorithm IKE encrypt: id=0, name=(null), blocksize=16,<br>
> > > keydeflen=128 000 algorithm IKE encrypt: id=0, name=(null),<br>
> > > blocksize=16, keydeflen=128 000 algorithm IKE encrypt: id=0,<br>
> > > name=(null), blocksize=16, keydeflen=128 000 algorithm IKE encrypt:<br>
> > > id=0, name=(null), blocksize=16, keydeflen=128 000 algorithm IKE<br>
> > > encrypt: id=0, name=(null), blocksize=16, keydeflen=128 000 algorithm<br>
> > > IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=128 000<br>
> > > algorithm IKE encrypt: id=3, name=OAKLEY_BLOWFISH_CBC, blocksize=8,<br>
> > > keydeflen=128<br>
> > > 000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8,<br>
> > > keydeflen=192<br>
> > > 000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16,<br>
> > > keydeflen=128<br>
> > > 000 algorithm IKE encrypt: id=65004, name=OAKLEY_SERPENT_CBC,<br>
> ><br>
> > blocksize=16,<br>
> ><br>
> > > keydeflen=128<br>
> > > 000 algorithm IKE encrypt: id=65005, name=OAKLEY_TWOFISH_CBC,<br>
> ><br>
> > blocksize=16,<br>
> ><br>
> > > keydeflen=128<br>
> > > 000 algorithm IKE encrypt: id=65289, name=OAKLEY_TWOFISH_CBC_SSH,<br>
> > > blocksize=16, keydeflen=128<br>
> > > 000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<br>
> > > 000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<br>
> > > 000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32<br>
> > > 000 algorithm IKE hash: id=5, name=OAKLEY_SHA2_384, hashsize=48<br>
> > > 000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64<br>
> > > 000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024<br>
> > > 000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536<br>
> > > 000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048,<br>
> > > bits=2048 000 algorithm IKE dh group: id=15,<br>
> > > name=OAKLEY_GROUP_MODP3072, bits=3072 000 algorithm IKE dh group:<br>
> > > id=16, name=OAKLEY_GROUP_MODP4096, bits=4096 000 algorithm IKE dh<br>
> > > group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144 000 algorithm IKE<br>
> > > dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192 000 algorithm<br>
> > > IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024 000 algorithm<br>
> > > IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048 000 algorithm<br>
> > > IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048 000<br>
> > > 000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,2,64}<br>
> > > trans={0,2,3072} attrs={0,2,2048}<br>
> > > 000<br>
> > > 000 "tj-vpn":<br>
> > > <a href="http://10.0.0.0/16===x.x.x.x" target="_blank">10.0.0.0/16===x.x.x.x</a><br>
> ><br>
> > <x.x.x.x>[+S=C]...y.y.y.y<y.y.y.y>[+S=C]===z.z.z.z/32<br>
> ><br>
> > > ; prospective erouted; eroute owner: #0<br>
> > > 000 "tj-vpn": myip=unset; hisip=unset;<br>
> ><br>
> > > 000 "tj-vpn": ike_life: 5184000s; ipsec_life: 3600s; rekey_margin:<br>
> > 600s;<br>
> ><br>
> > > rekey_fuzz: 0%; keyingtries: 0; nat_keepalive: yes<br>
> > > 000 "tj-vpn": policy:<br>
> > > PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 16,32;<br>
> > > interface: eth0;<br>
> > > 000 "tj-vpn": newest ISAKMP SA: #0; newest IPsec SA: #0;<br>
> > > 000 "tj-vpn": IKE algorithms wanted:<br>
> > > AES_CBC(7)_256-SHA1(2)_000-MODP1536(5),<br>
> > > AES_CBC(7)_256-SHA1(2)_000-MODP1024(2)<br>
> > ><br>
> > > 000 "tj-vpn": IKE algorithms found:<br>
> > > AES_CBC(7)_256-SHA1(2)_160-MODP1536(5),<br>
> > ><br>
> > > AES_CBC(7)_256-SHA1(2)_160-MODP1024(2)<br>
> > > 000 "tj-vpn": ESP algorithms wanted: AES(12)_256-SHA1(2)_000<br>
> > > 000 "tj-vpn": ESP algorithms loaded: AES(12)_256-SHA1(2)_160<br>
> > > 000<br>
> > > 000 #2: "tj-vpn":500 STATE_MAIN_I1 (sent MI1, expecting MR1); none in<br>
> ><br>
> > -1s;<br>
> ><br>
> > > nodpd; idle; import:admin initiate<br>
> > > 000 #2: pending Phase 2 for "tj-vpn" replacing #0<br>
> > > 000<br>
> > ><br>
> > > # cat ipsec.secrets<br>
> > > x.x.x.x y.y.y.y: PSK "PSKGOESHERE"<br>
> > ><br>
> > > Anyone have any ideas what i'm doing wrong? I'd appreciate all<br>
> ><br>
> > assistance.<br>
> ><br>
> > > Thanks so much in advance!<br>
> > ><br>
> > > Cheers<br>
> > > Ian<br>
> ><br>
> > _______________________________________________<br>
> > <a href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a><br>
> > <a href="https://lists.openswan.org/mailman/listinfo/users" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a><br>
> > Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
> > Building and Integrating Virtual Private Networks with Openswan:<br>
> > <a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
</div></div></blockquote></div><br></div></div>