<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"PT Mono";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.body-text-content
{mso-style-name:body-text-content;}
p.msochpdefault, li.msochpdefault, div.msochpdefault
{mso-style-name:msochpdefault;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.emailstyle17
{mso-style-name:emailstyle17;}
span.emailstyle171
{mso-style-name:emailstyle171;
font-family:"Calibri","sans-serif";
color:windowtext;}
p.msochpdefault1, li.msochpdefault1, div.msochpdefault1
{mso-style-name:msochpdefault1;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Hi Dan,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">My understanding is that it’s not really necessary to split the phase 2 algorithms as you’ve suggested. If you don’t phase 2 inherits the DH group setting of
phase 1. In fact I have this working with 3des. AES128 and AES256. It’s just that I have an issue with blowfish cipher. I also went ahead and tried your suggestion i.e. replace esp with phase2 and phase2alg like this:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> phase2=esp<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> phase2alg=blowfish448-sha1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">This hasn’t helped. The logs do not indicate any error. When I used des, the logs indicated it’s a weak cipher and cannot be used. In the case of Blowfish I
see no such thing and neither an error in the logs.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Mihir<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Daniel Cave [mailto:dan.cave@icloud.com]
<br>
<b>Sent:</b> Wednesday, July 22, 2015 9:54 AM<br>
<b>To:</b> Mihir Shirali -X (mshirali - INFOSYS LIMITED at Cisco)<br>
<b>Cc:</b> users@lists.openswan.org<br>
<b>Subject:</b> Re: [Openswan Users] Question on ciphers<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Mihir.. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Firstly, this is really easy to answer... <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">the grep you did is correct, however you may be using the wrong cipher -IF you comment out the AH/ESP parameters, openswan will *try* and automatically negotiate the connection when a proposal is made.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">You can (and probably should) specify the ESP and AH ciphers separately.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">ike=aes-128<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">phase2alg=blowfish<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">phase2=esp<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">(on my openswan to cisco ASA I've done this<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt;font-family:"PT Mono","serif"">###############################<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt;font-family:"PT Mono","serif""># Settings<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt;font-family:"PT Mono","serif"">###############################<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt;font-family:"PT Mono","serif""> ike=3des-md5<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt;font-family:"PT Mono","serif""> phase2alg=3des-md5<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt;font-family:"PT Mono","serif""> phase2=esp<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt;font-family:"PT Mono","serif"">###############################<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt;font-family:"PT Mono","serif""> ikelifetime=86400s<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt;font-family:"PT Mono","serif""># keyexchange=ike<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt;font-family:"PT Mono","serif""> keylife=28800s<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt;font-family:"PT Mono","serif""> ## was## keylife=86400s<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Obviously both sides have to match.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I would start by looking at the logs and output from ipsec auto status to see if they both negotiate both phases,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">hope that helps<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Dan.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">On Jul 22, 2015, at 05:22 PM, "Mihir Shirali -X (mshirali - INFOSYS LIMITED at Cisco)" <<a href="mailto:mshirali@cisco.com">mshirali@cisco.com</a>> wrote:<o:p></o:p></p>
</div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hi All,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I’m using RHEL 6.6 and openswan-2.6.32-37.el6.x86_64<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I had a couple of questions related to ciphers:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">1 - When I run the ipsec auto –status, I do see Blowfish listed as one of the available ciphers:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">ipsec auto --status | grep BLOW<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">However, when I plug this into my config file, the tunnel does not come up. Could you please let me know if Blowfish is something which is unsupported<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><snip><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> esp=blowfish448-sha1<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"></snip><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">2 – I believe esp cipher can be specified as follows<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> aes-sha1 OR<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> aes128-sha1<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">How does OpenSwan treat these 2 internally. Are they treated as 2 separate ciphers or the same one?<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Regards,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Mihir<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span class="body-text-content">_______________________________________________</span><br>
<span class="body-text-content"><a href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a></span><br>
<span class="body-text-content"><a href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a></span><br>
<span class="body-text-content">Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">
https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a></span><br>
<span class="body-text-content">Building and Integrating Virtual Private Networks with Openswan:</span><br>
<span class="body-text-content"><a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a></span><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>