<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Rescued from the Spam bucket. Please remeber to subscribe to the mailing list before posting to it.<br class=""><div><br class=""><div class=""><div class=""><span class="" style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif; color: rgb(127, 127, 127);"><b class="">From: </b></span><span class="" style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif;">David Jones <<a href="mailto:david@proficienthealth.com" class="">david@proficienthealth.com</a>></span></div><div class=""><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(127, 127, 127, 1.0);" class=""><b class="">Date: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">October 12, 2015 at 1:53:53 PM EDT<br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(127, 127, 127, 1.0);" class=""><b class="">To: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><a href="mailto:users@lists.openswan.org" class="">users@lists.openswan.org</a><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(127, 127, 127, 1.0);" class=""><b class="">Subject: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><b class="">OpenSwan and Cisco ASA?</b><br class=""></span></div><br class=""><br class=""><div dir="ltr" class="">HI,<div class=""><br class=""></div><div class="">I am running OpenSwan and have many clients connecting to us that use Cisco ASA's to establish IPSec tunnels. We use the same IP address for our gateway as we do an internal machine that the customers need to access. We just forward the port but require an IPSec. This confuses our Cisco ASA friends for some reason and we occasionally have a client that can't figure out how to get the tunnel to route properly. I don't know cisco well and can really help them.</div><div class=""><br class=""></div><div class="">Here us a sample of the config..</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-size: 12px; font-family: Courier; color: rgb(255, 240, 165); background-color: rgb(19, 119, 62);" class="">-A PREROUTING -d <a href="http://65.165.15.165/32" class="">65.165.15.165/32</a> -p tcp -m tcp --dport 34006 -j DNAT --to-destination <a href="http://10.10.10.112:6665/" class="">10.10.10.112:6665</a></div><div style="margin: 0px; font-size: 12px; font-family: Courier; color: rgb(255, 240, 165); background-color: rgb(19, 119, 62); min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; font-size: 12px; font-family: Courier; color: rgb(255, 240, 165); background-color: rgb(19, 119, 62); min-height: 14px;" class="">-A FORWARD -d <a href="http://10.10.10.112/32" class="">10.10.10.112/32</a> -p tcp -m policy --dir in --pol ipsec -m state --state NEW -m tcp --dport 6665 -j ACCEPT<br class=""></div><div style="margin: 0px; font-size: 12px; font-family: Courier; color: rgb(255, 240, 165); background-color: rgb(19, 119, 62); min-height: 14px;" class=""><br class=""></div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">The tunnel is up but packets are not making it through.</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-size: 12px; font-family: Courier; color: rgb(255, 240, 165); background-color: rgb(19, 119, 62);" class="">000 "conn10": <a href="http://65.165.15.165/32===65.165.15.165" class="">65.165.15.165/32===65.165.15.165</a><66.162.10.167>---65.165.15.161...74.223.63.179<75.225.65.175>===<a href="http://172.30.2.14/32" class="">172.30.2.14/32</a>; erouted; eroute owner: #305</div><div style="margin: 0px; font-size: 12px; font-family: Courier; color: rgb(255, 240, 165); background-color: rgb(19, 119, 62);" class="">000 "conn10": myip=65.165.15.165; hisip=unset;</div><div style="margin: 0px; font-size: 12px; font-family: Courier; color: rgb(255, 240, 165); background-color: rgb(19, 119, 62);" class="">000 "conn10": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 </div><div style="margin: 0px; font-size: 12px; font-family: Courier; color: rgb(255, 240, 165); background-color: rgb(19, 119, 62);" class="">000 "conn10": policy: PSK+ENCRYPT+TUNNEL+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 32,32; interface: eth1; </div><div style="margin: 0px; font-size: 12px; font-family: Courier; color: rgb(255, 240, 165); background-color: rgb(19, 119, 62);" class="">000 "conn10": newest ISAKMP SA: #696; newest IPsec SA: #305; </div><div style="margin: 0px; font-size: 12px; font-family: Courier; color: rgb(255, 240, 165); background-color: rgb(19, 119, 62);" class="">000 "conn10": IKE algorithm newest: 3DES_CBC_192-SHA1-MODP1024</div><div style="margin: 0px; font-size: 12px; font-family: Courier; color: rgb(255, 240, 165); background-color: rgb(19, 119, 62);" class="">000 #696: "conn10":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 3191s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:not set</div><div style="margin: 0px; font-size: 12px; font-family: Courier; color: rgb(255, 240, 165); background-color: rgb(19, 119, 62);" class="">000 #305: "conn10":500 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 9850s; newest IPSEC; eroute owner; isakmp#300; idle; import:not set</div><div style="margin: 0px; font-size: 12px; font-family: Courier; color: rgb(255, 240, 165); background-color: rgb(19, 119, 62);" class="">000 #305: "conn10" <a href="mailto:esp.a13d0d4@75.225.65.175" class="">esp.a13d0d4@75.225.65.175</a></div><div style="margin: 0px; font-size: 12px; font-family: Courier; color: rgb(255, 240, 165); background-color: rgb(19, 119, 62);" class=""><a href="mailto:esp.4ac15492@65.165.15.165" class="">esp.4ac15492@65.165.15.165</a> <a href="mailto:tun.0@75.225.65.175" class="">tun.0@75.225.65.175</a> <a href="mailto:tun.0@65.165.15.165" class="">tun.0@65.165.15.165</a> ref=0 refhim=4294901761</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Can anyone offer me any suggestions for the Cisco people, maybe a special checkbox or some term I can offer them to spark an idea?</div><div class=""><br class=""></div><div class="">I have been working with the same client for months and just keep going back and fourth with never a positive result.</div><div class=""><br class=""></div><div class="">Thanks,</div><div class=""><br class=""></div><div class="">David</div><div class=""><br class=""></div><div class=""><br class=""></div></div>
<br class="">
Confidential Notice: This email, including any attachments, is for the sole use
of the intended recipient(s) and may contain confidential and/or protected
health information. Under Federal Law (HIPAA), the intended recipient is
obligated to keep this information secure and confidential. Any disclosure or
dissemination to third parties without authorization from the sender is
prohibited and may be punishable under Federal Law. If you are not the intended
recipient, please contact the sender by reply e-mail and destroy all copies of
the original message.<br class=""><br class=""></div></div></div><br class=""></body></html>