<html><body><div>Hi there.</div><div><br></div><div>I understand what you're saying and it was my understanding too. I tried getting one of our tunnels working with 3des-md5 on 'auto' on our side and the Cisco at the other end wouldn't negotiate correctly hence why i had to specify the phase1/2.</div><div><br></div><div>Anyhow, can I ask, why is it you need to use blowfish ? Can you post your config and explain which devices you're trying to connect to - perhaps with a simple ansi diagram - like you get from the " ipsec auto status " output </div><div><br></div><div>Dan</div><div>On Jul 22, 2015, at 06:16 PM, "Mihir Shirali -X (mshirali - INFOSYS LIMITED at Cisco)" <mshirali@cisco.com> wrote:<br><br></div><div><div><blockquote type="cite"><div class="msg-quote" lang="EN-US"><div class="WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;">Hi Dan,</span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;"> </span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;">My understanding is that it’s not really necessary to split the phase 2 algorithms as you’ve suggested. If you don’t phase 2 inherits the DH group setting of phase 1. In fact I have this working with 3des. AES128 and AES256. It’s just that I have an issue with blowfish cipher. I also went ahead and tried your suggestion i.e. replace esp with phase2 and phase2alg like this:</span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;"> phase2=esp</span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;"> phase2alg=blowfish448-sha1</span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;"> </span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;">This hasn’t helped. The logs do not indicate any error. When I used des, the logs indicated it’s a weak cipher and cannot be used. In the case of Blowfish I see no such thing and neither an error in the logs.</span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;"> </span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;">Regards,</span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;">Mihir</span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;"> </span></p><div><div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in" data-mce-style="border: none; border-top: solid #B5C4DF 1.0pt; padding: 3.0pt 0in 0in 0in;"><p class="MsoNormal"><strong><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"" data-mce-style="font-size: 10.0pt; font-family: 'Tahoma','sans-serif';">From:</span></strong><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"" data-mce-style="font-size: 10.0pt; font-family: 'Tahoma','sans-serif';"> Daniel Cave [mailto:dan.cave@icloud.com] <br> <strong>Sent:</strong> Wednesday, July 22, 2015 9:54 AM<br> <strong>To:</strong> Mihir Shirali -X (mshirali - INFOSYS LIMITED at Cisco)<br> <strong>Cc:</strong> <a href="mailto:users@lists.openswan.org" data-mce-href="mailto:users@lists.openswan.org">users@lists.openswan.org</a><br> <strong>Subject:</strong> Re: [Openswan Users] Question on ciphers</span></p></div></div><p class="MsoNormal"> </p><div><p class="MsoNormal">Mihir.. </p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Firstly, this is really easy to answer... </p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">the grep you did is correct, however you may be using the wrong cipher -IF you comment out the AH/ESP parameters, openswan will *try* and automatically negotiate the connection when a proposal is made.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">You can (and probably should) specify the ESP and AH ciphers separately.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">ike=aes-128</p></div><div><p class="MsoNormal">phase2alg=blowfish</p></div><div><p class="MsoNormal">phase2=esp</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">(on my openswan to cisco ASA I've done this</p></div><div><p class="MsoNormal"> </p></div><div><p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB" data-mce-style="margin: 0in; margin-bottom: .0001pt; background: #FFF7AB;"><span style="font-size:9.0pt;font-family:"PT Mono","serif"" data-mce-style="font-size: 9.0pt; font-family: 'PT Mono','serif';">###############################</span></p><p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB" data-mce-style="margin: 0in; margin-bottom: .0001pt; background: #FFF7AB;"><span style="font-size:9.0pt;font-family:"PT Mono","serif"" data-mce-style="font-size: 9.0pt; font-family: 'PT Mono','serif';"># Settings</span></p><p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB" data-mce-style="margin: 0in; margin-bottom: .0001pt; background: #FFF7AB;"><span style="font-size:9.0pt;font-family:"PT Mono","serif"" data-mce-style="font-size: 9.0pt; font-family: 'PT Mono','serif';">###############################</span></p><p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB" data-mce-style="margin: 0in; margin-bottom: .0001pt; background: #FFF7AB;"><span style="font-size:9.0pt;font-family:"PT Mono","serif"" data-mce-style="font-size: 9.0pt; font-family: 'PT Mono','serif';"> ike=3des-md5</span></p><p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB" data-mce-style="margin: 0in; margin-bottom: .0001pt; background: #FFF7AB;"><span style="font-size:9.0pt;font-family:"PT Mono","serif"" data-mce-style="font-size: 9.0pt; font-family: 'PT Mono','serif';"> phase2alg=3des-md5</span></p><p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB" data-mce-style="margin: 0in; margin-bottom: .0001pt; background: #FFF7AB;"><span style="font-size:9.0pt;font-family:"PT Mono","serif"" data-mce-style="font-size: 9.0pt; font-family: 'PT Mono','serif';"> phase2=esp</span></p><p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB" data-mce-style="margin: 0in; margin-bottom: .0001pt; background: #FFF7AB;"><span style="font-size:9.0pt;font-family:"PT Mono","serif"" data-mce-style="font-size: 9.0pt; font-family: 'PT Mono','serif';">###############################</span></p><p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB" data-mce-style="margin: 0in; margin-bottom: .0001pt; background: #FFF7AB;"><span style="font-size:9.0pt;font-family:"PT Mono","serif"" data-mce-style="font-size: 9.0pt; font-family: 'PT Mono','serif';"> ikelifetime=86400s</span></p><p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB" data-mce-style="margin: 0in; margin-bottom: .0001pt; background: #FFF7AB;"><span style="font-size:9.0pt;font-family:"PT Mono","serif"" data-mce-style="font-size: 9.0pt; font-family: 'PT Mono','serif';"># keyexchange=ike</span></p><p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB" data-mce-style="margin: 0in; margin-bottom: .0001pt; background: #FFF7AB;"><span style="font-size:9.0pt;font-family:"PT Mono","serif"" data-mce-style="font-size: 9.0pt; font-family: 'PT Mono','serif';"> keylife=28800s</span></p><p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB" data-mce-style="margin: 0in; margin-bottom: .0001pt; background: #FFF7AB;"><span style="font-size:9.0pt;font-family:"PT Mono","serif"" data-mce-style="font-size: 9.0pt; font-family: 'PT Mono','serif';"> ## was## keylife=86400s</span></p><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Obviously both sides have to match.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">I would start by looking at the logs and output from ipsec auto status to see if they both negotiate both phases,</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">hope that helps</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Dan.</p></div><div><p class="MsoNormal"> </p></div><p class="MsoNormal" style="margin-bottom:12.0pt" data-mce-style="margin-bottom: 12.0pt;">On Jul 22, 2015, at 05:22 PM, "Mihir Shirali -X (mshirali - INFOSYS LIMITED at Cisco)" <<a href="mailto:mshirali@cisco.com" data-mce-href="mailto:mshirali@cisco.com">mshirali@cisco.com</a>> wrote:</p></div><div><div><blockquote style="margin-top:5.0pt;margin-bottom:5.0pt" data-mce-style="margin-top: 5.0pt; margin-bottom: 5.0pt;"><div><div><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">Hi All,</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"> </p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">I’m using RHEL 6.6 and openswan-2.6.32-37.el6.x86_64</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">I had a couple of questions related to ciphers:</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">1 - When I run the ipsec auto –status, I do see Blowfish listed as one of the available ciphers:</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">ipsec auto --status | grep BLOW</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"> </p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">However, when I plug this into my config file, the tunnel does not come up. Could you please let me know if Blowfish is something which is unsupported</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><snip></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"> esp=blowfish448-sha1</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"></snip></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"> </p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">2 – I believe esp cipher can be specified as follows</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"> aes-sha1 OR</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"> aes128-sha1</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">How does OpenSwan treat these 2 internally. Are they treated as 2 separate ciphers or the same one?</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"> </p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">Regards,</p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto" data-mce-style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">Mihir</p></div><div><p class="MsoNormal"><span class="body-text-content">_______________________________________________</span><br> <span class="body-text-content"><a href="mailto:Users@lists.openswan.org" data-mce-href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a></span><br> <span class="body-text-content"><a href="https://lists.openswan.org/mailman/listinfo/users" data-mce-href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a></span><br> <span class="body-text-content">Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" data-mce-href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy"> https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a></span><br> <span class="body-text-content">Building and Integrating Virtual Private Networks with Openswan:</span><br> <span class="body-text-content"><a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" data-mce-href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a></span></p></div></div></blockquote></div></div></div><div class="_stretch"><span class="body-text-content">_______________________________________________<br><a href="mailto:Users@lists.openswan.org" data-mce-href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a><br><a href="https://lists.openswan.org/mailman/listinfo/users" data-mce-href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a><br>Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" data-mce-href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>Building and Integrating Virtual Private Networks with Openswan:<br><a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" data-mce-href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br></span></div></div></blockquote></div></div><style class="_message-styles">.msg-quote p.msonormal, li.msonormal, div.msonormal {margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;}
.msg-quote a:link, span.msohyperlink {color: blue; text-decoration: underline;}
.msg-quote a:visited, span.msohyperlinkfollowed {color: purple; text-decoration: underline;}
.msg-quote p {margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif;}
.msg-quote span.body-text-content {}
.msg-quote p.msochpdefault, li.msochpdefault, div.msochpdefault {margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif;}
.msg-quote span.emailstyle17 {}
.msg-quote span.emailstyle171 {font-family: Calibri, sans-serif; color: windowtext;}
.msg-quote p.msochpdefault1, li.msochpdefault1, div.msochpdefault1 {margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: Calibri, sans-serif;}
.msg-quote span.emailstyle23 {font-family: Calibri, sans-serif; color: rgb(31, 73, 125);}
.msg-quote .msochpdefault {font-size: 10pt;}
.msg-quote @page WordSection1 {size: 8.5in 11in; margin: 1in;}
.msg-quote div.wordsection1 {page: WordSection1;}
</style></body></html>