[Openswan Users] OpenSwan Configuration for Manual Keys

[Brian Candler]

On Fri, Apr 14, 2006 at 10:39:40AM -0500, Jay Potter wrote:
> Just getting started with openswan and trying to set up a simple  vpn on 
> my local network using manual PSKs  I am trying to connect to an XP client.
> The Server is 172.21.210.2
> the xp client is 172.21.210.3
> 
> In my ipsec.conf
> 
>    I have added
> 
> conn sample
>    left=172.21.210.2
>    right=172.21.210.3
>    spi=0x200
>    esp=3des-sha1
>    espenckey="la...ma"   ( full key is 24 characters long - same as 
> given to windows MMC)
>    espauthkey="la..ma"   ( full key is 24 characters long)

Windows doesn't support manual keying or assignment of SPI. You must use IKE
to negotiate the keys automatically.

Remove 'spi', 'espenckey', 'espauthkey'. The PSK which matches the one
Windows uses is to be found in ipsec.secrets

>    aggrmode=yes
>    pfs = yes

Windows doesn't support aggrmode, you must leave it off. Windows can support
pfs, but it needs special configuration to do so. Better to leave it off to
start.

At least, the above is true if you are using the Microsoft IPSEC client. If
you're using some other software on the Windows side, then you should say
what it is (but I probably can't help you, as I only know the MS IPSEC
stack). But since you say MMC, I think you're using the MS IPSEC stack.

Regards,

Brian.