[Openswan Users] Aggressive Mode + Email Identity (netscreen-remote)

S. Hermet seb at dxd2.com
Tue May 10 14:03:19 CEST 2005


Hello,

here is my problem :
112 "customerB" #40: STATE_AGGR_I1: initiate
010 "customerB" #40: STATE_AGGR_I1: retransmission; will wait 20s for 
response
... then 40s.... and the it stops...

I want to replace my netscreen-remote client (a client to connect to a 
JUNIPER machine) with openswan. I need to connect to our customer (called B)

I've already got a vpn running on my 2.6 debian, with openswan 2.3.0. 
It's connected to our customer (called A).

With customer A, I use main mode... preshared-key and I can only connect 
with my IP.

With customer B, I use aggressive mode.. pre-sharedkey and I don't know 
what to do with My Identity..
I have an email ID type (Me at customerB) and I don't know where to provide 
it.... and when...
furthermore I have a xauth login/password.

here is my ipsec.conf, ipsec.secrets store its key.

conn customerB
        keyexchange=ike
        # rightid=Me at customerB # here ??
        left=134.109.66.42
        leftsubnet=109.133.0.0/16
        leftid="E=Me at customerB"   ## is it useful ??
       # MY DEBIAN...
        right=134.6.124.215
        rightsubnet=192.168.20.1/32
       
        authby=secret
        auth=esp
       esp=3des-sha1-96
        # PFS must be enabled, in aggressive mode, pfs key group = 
Diffie-hellman group 2
        pfs=yes
        aggrmode=yes
        ike=3des-sha1-modp1024

        auto=add
        xauth=yes
      
      







More information about the Users mailing list