[Openswan Users] Cisco PIX
obelix
obelix at rbsturbo.com.br
Mon Jan 18 16:54:20 EST 2010
I am triing to setup a Openswan connection to a CISCO pix. The both end
networks are the same 192.168.1.0/24.
I just need to access one IP in the other side, so we decided to create
a virtual interface with 192.168.5.0/30 (5.1 in my end, 5.2 in the Cisco
end) and nat-hide this connection, but I couldn't find how to create
this virtual IP.
*My ipsec.conf is :*
version 2
config setup
interfaces=%defaultroute
klipsdebug=none
plutodebug=none
nat_traversal=yes
conn %default
keyingtries=3
#keylife=1200s
#ikelifetime=1200s
conn swan-pix
authby=secret
type=tunnel
keyexchange=ike
ike=aes256-sha1
esp=aes256-sha1
pfs=no
left=10.10.1.20
right=x.x.x.x
auto=add
# disable opportunistic encryption
conn block
auto=ignore
conn private
auto=ignore
conn private-or-clear
auto=ignore
conn clear-or-private
auto=ignore
conn clear
auto=ignore
conn packetdefault
auto=ignore
*the PIX LOG error is:*
Rejecting IPSEC tunnel: no matching crypto map entry for remote proxy
0.0.0.0/0.0.0.0/0/0 local proxy 0.0.0.0/0.0.0.0/0/0 on interface Bizfour
I think he is waiting for a connection from 192.168.5.1
*the tcpdump log is:*
15:26:01.426700 IP openswanconnisakmp > pixconn.isakmp: isakmp: phase 1
I ident
15:26:01.456397 IP pixconn.isakmp > openswanconnisakmp: isakmp: phase 1
R ident
15:26:01.457949 IP openswanconnisakmp > pixconn.isakmp: isakmp: phase 1
I ident
15:26:01.509453 IP pixconn.isakmp > openswanconnisakmp: isakmp: phase 1
R ident
15:26:01.511079 IP openswanconnisakmp > pixconn.isakmp: isakmp: phase 1
I ident[E]
15:26:01.552014 IP pixconn.isakmp > openswanconnisakmp: isakmp: phase 1
R ident[E]
15:26:01.552612 IP openswanconnisakmp > pixconn.isakmp: isakmp: phase
2/others I oakley-quick[E]
15:26:01.609582 IP pixconn.isakmp > openswanconnisakmp: isakmp: phase
2/others R inf[E]
15:26:01.612739 IP pixconn.isakmp > openswanconnisakmp: isakmp: phase
2/others R inf[E]
15:26:01.613079 IP openswanconnisakmp > pixconn.isakmp: isakmp: phase
2/others I inf[E]
15:26:08.256883 IP openswanconnisakmp > pixconn.isakmp: isakmp: phase
2/others I oakley-quick[E]
15:26:11.260689 IP openswanconnisakmp > pixconn.isakmp: isakmp: phase
2/others I oakley-quick[E]
15:26:18.004849 IP openswanconnisakmp > pixconn.isakmp: isakmp: phase
2/others I oakley-quick[E]
15:26:20.007791 IP openswanconnisakmp > pixconn.isakmp: isakmp: phase
2/others I oakley-quick[E]
15:26:31.330577 IP openswanconnisakmp > pixconn.isakmp: isakmp: phase
2/others I oakley-quick[E]
which config do I need ?
Thanks in advance.
More information about the Users
mailing list