<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Rescued from the spam bucket. Please remember to subscribe to the mailing list before posting to it.<br class=""><div><br class=""><div class=""><div class=""><span class="" style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif; color: rgb(127, 127, 127);"><b class="">From: </b></span><span class="" style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif;">Daniel Cave <<a href="mailto:dan.cave@icloud.com" class="">dan.cave@icloud.com</a>></span></div><div class=""><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; margin: 0px;" class=""><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif; color: rgb(127, 127, 127);" class=""><b class="">Subject:<span class="Apple-converted-space"> </span></b></span><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif;" class=""><b class="">Re: [Openswan Users] Question on ciphers</b><br class=""></span></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; margin: 0px;" class=""><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif; color: rgb(127, 127, 127);" class=""><b class="">Date:<span class="Apple-converted-space"> </span></b></span><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif;" class="">July 22, 2015 at 12:54:28 PM EDT<br class=""></span></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; margin: 0px;" class=""><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif; color: rgb(127, 127, 127);" class=""><b class="">To:<span class="Apple-converted-space"> </span></b></span><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif;" class="">"Mihir Shirali -X (mshirali - INFOSYS LIMITED at Cisco)" <<a href="mailto:mshirali@cisco.com" class="">mshirali@cisco.com</a>><br class=""></span></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; margin: 0px;" class=""><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif; color: rgb(127, 127, 127);" class=""><b class="">Cc:<span class="Apple-converted-space"> </span></b></span><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif;" class=""><a href="mailto:users@lists.openswan.org" class="">users@lists.openswan.org</a><br class=""></span></div><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Mihir.. </div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""> </div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Firstly, this is really easy to answer... </div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">the grep you did is correct, however you may be using the wrong cipher -IF you comment out the AH/ESP parameters, openswan will *try* and automatically negotiate the connection when a proposal is made.</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">You can (and probably should) specify the ESP and AH ciphers separately.</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">ike=aes-128</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">phase2alg=blowfish</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">phase2=esp</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">(on my openswan to cisco ASA I've done this</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div style="margin: 0px; font-size: 12px; line-height: normal; font-family: 'PT Mono'; background-color: rgb(255, 247, 171);" class="">###############################</div><div style="margin: 0px; font-size: 12px; line-height: normal; font-family: 'PT Mono'; background-color: rgb(255, 247, 171);" class=""># Settings</div><div style="margin: 0px; font-size: 12px; line-height: normal; font-family: 'PT Mono'; background-color: rgb(255, 247, 171);" class="">###############################</div><div style="margin: 0px; font-size: 12px; line-height: normal; font-family: 'PT Mono'; background-color: rgb(255, 247, 171);" class=""> ike=3des-md5</div><div style="margin: 0px; font-size: 12px; line-height: normal; font-family: 'PT Mono'; background-color: rgb(255, 247, 171);" class=""> phase2alg=3des-md5</div><div style="margin: 0px; font-size: 12px; line-height: normal; font-family: 'PT Mono'; background-color: rgb(255, 247, 171);" class=""> phase2=esp</div><div style="margin: 0px; font-size: 12px; line-height: normal; font-family: 'PT Mono'; background-color: rgb(255, 247, 171);" class="">###############################</div><div style="margin: 0px; font-size: 12px; line-height: normal; font-family: 'PT Mono'; background-color: rgb(255, 247, 171);" class=""> ikelifetime=86400s</div><div style="margin: 0px; font-size: 12px; line-height: normal; font-family: 'PT Mono'; background-color: rgb(255, 247, 171);" class=""># keyexchange=ike</div><div style="margin: 0px; font-size: 12px; line-height: normal; font-family: 'PT Mono'; background-color: rgb(255, 247, 171);" class=""> keylife=28800s</div><div style="margin: 0px; font-size: 12px; line-height: normal; font-family: 'PT Mono'; background-color: rgb(255, 247, 171);" class=""> ## was## keylife=86400s</div><div class=""><br class=""></div><div class="">Obviously both sides have to match.</div><div class=""><br class=""></div><div class="">I would start by looking at the logs and output from ipsec auto status to see if they both negotiate both phases,</div><div class=""><br class=""></div><div class="">hope that helps</div><div class=""><br class=""></div><div class="">Dan.</div><div class=""><br class=""></div>On Jul 22, 2015, at 05:22 PM, "Mihir Shirali -X (mshirali - INFOSYS LIMITED at Cisco)" <<a href="mailto:mshirali@cisco.com" class="">mshirali@cisco.com</a>> wrote:<br class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class=""><blockquote type="cite" class=""><div class="msg-quote" lang="EN-US"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hi All,</div><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"> </p><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I’m using RHEL 6.6 and openswan-2.6.32-37.el6.x86_64</div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I had a couple of questions related to ciphers:</div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">1 - When I run the ipsec auto –status, I do see Blowfish listed as one of the available ciphers:</div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">ipsec auto --status | grep BLOW</div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448</div><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"> </p><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">However, when I plug this into my config file, the tunnel does not come up. Could you please let me know if Blowfish is something which is unsupported</div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><snip></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> esp=blowfish448-sha1</div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""></snip></div><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"> </p><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">2 – I believe esp cipher can be specified as follows</div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> aes-sha1 OR</div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> aes128-sha1</div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">How does OpenSwan treat these 2 internally. Are they treated as 2 separate ciphers or the same one?</div><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"> </p><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Regards,</div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Mihir</div></div><div class="_stretch"><span class="body-text-content">_______________________________________________<br class=""><a href="mailto:Users@lists.openswan.org" data-mce-href="mailto:Users@lists.openswan.org" style="color: purple; text-decoration: underline;" class="">Users@lists.openswan.org</a><br class=""><a href="https://lists.openswan.org/mailman/listinfo/users" data-mce-href="https://lists.openswan.org/mailman/listinfo/users" style="color: purple; text-decoration: underline;" class="">https://lists.openswan.org/mailman/listinfo/users</a><br class="">Micropayments:<span class="Apple-converted-space"> </span><a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" data-mce-href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" style="color: purple; text-decoration: underline;" class="">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br class="">Building and Integrating Virtual Private Networks with Openswan:<br class=""><a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" data-mce-href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" style="color: purple; text-decoration: underline;" class="">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br class=""></span></div></div></blockquote></div></div></div></div></div><br class=""></body></html>