[Openswan Users] openSWAN to Cisco IOS
brechbuehler at gmail.com
Wed Nov 15 10:26:45 EST 2006
On 11/14/06, Peter McGill <petermcgill at goco.net> wrote:
> Main mode connects so it is probably correct, I'd stay away from
> aggressive mode.
> There's no ike line (I don't think openswan 2.4.4 supports it). I tried
> adding esp=3des-sha1, but with no luck (still stalls at
> > STATE_QUICK_I1). What should it be?
> It supports it, but it's usually unnecessary, without it openswan just
> accepts/trys anything.
> Sometimes though other vendors only listen to the first suggestion so the
> ike and esp settings become important.
> Above is equivalent to:
> You'd expect phase 2 to use the same like this
> But that obviosly isn't working if you tried it, so the cisco must have
> different options for the different phases'
> that's highly irregular, his/her setup might be incorrect or they might
> not know what their doing.
> Either way, you still need to aggree on a phase 2 connect method as
> suggested by Paul and Andy as well.
That esp seems right after all. To summarize what I wrote to Frank Mayer,
They instructed us to set it up as follows,
On a hunch I changed leftsubnet to 192.168.232.10/32 -- and BINGO! IPsec SA
established. So Openswan seems happy, although no packets go through. I
suspect now it's a routing/firewalling issue.
I'm particulary confused about the meaning and use of the nexthop
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Users