[Openswan Users] Question about ike configuration

[mix.kao]

Hi,

the ike option is difference between two gateways, but seems the 
connection is still can build.

gateway1: ipsec whack --status

000 "site_192.168.123.0_24-192.168.1.0_24": 
192.168.123.0/24===10.29.3.225<10.29.3.225>[+S=C]...10.2.3.156<10.2.3.156>[+S=C]===192.168.1.0/24; 
erouted; eroute owner: #6
000 "site_192.168.123.0_24-192.168.1.0_24":     myip=unset; hisip=unset; 
myup=/ramfs/ipsec/bin/_updown; hisup=/ramfs/ipsec/bin/_updown;
000 "site_192.168.123.0_24-192.168.1.0_24":   ike_life: 28800s; 
ipsec_life: 86400s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "site_192.168.123.0_24-192.168.1.0_24":   policy: 
PSK+ENCRYPT+TUNNEL+PFS+DONTREKEY+UP+IKEv2ALLOW+lKOD+rKOD; prio: 24,24; 
interface: eth2;
000 "site_192.168.123.0_24-192.168.1.0_24":   dpd: action:clear; 
delay:10; timeout:15;
000 "site_192.168.123.0_24-192.168.1.0_24":   newest ISAKMP SA: #0; 
newest IPsec SA: #6;
000 "site_192.168.123.0_24-192.168.1.0_24":   IKE algorithms wanted: 
AES_CBC(7)_128-SHA1(2)-MODP1536(5); flags=-strict
000 "site_192.168.123.0_24-192.168.1.0_24":   IKE algorithms found:  
AES_CBC(7)_128-SHA1(2)_160-5,
000 "site_192.168.123.0_24-192.168.1.0_24":   ESP algorithms wanted: 
AES(12)_256-SHA1(2); flags=-strict
000 "site_192.168.123.0_24-192.168.1.0_24":   ESP algorithms loaded: 
AES(12)_256-SHA1(2)_096
000 "site_192.168.123.0_24-192.168.1.0_24":   ESP algorithm newest: 
AES_256-HMAC_SHA1; pfsgroup=<Phase1>
000
000 #38: "site_192.168.123.0_24-192.168.1.0_24":500 STATE_MAIN_I1 (sent 
MI1, expecting MR1); EVENT_RETRANSMIT in 23s; nodpd; idle; import:admin 
initiate
000 #38: pending Phase 2 for "site_192.168.123.0_24-192.168.1.0_24" 
replacing #0
000 #6: "site_192.168.123.0_24-192.168.1.0_24":500 STATE_QUICK_R2 (IPsec 
SA established); EVENT_SA_EXPIRE in 83134s; newest IPSEC; eroute owner; 
isakmp#5; idle; import:not set
000 #6: "site_192.168.123.0_24-192.168.1.0_24" used 48s ago; 
esp.e6c8d0cd at 10.2.3.156 esp.b3b17a68 at 10.29.3.225 tun.1003 at 10.2.3.156 
tun.1004 at 10.29.3.225 ref=7 refhim=5
000 #36: "site_192.168.123.0_24-192.168.1.0_24":500 STATE_MAIN_I1 (sent 
MI1, expecting MR1); EVENT_RETRANSMIT in 23s; nodpd; idle; import:not set
000 #41: "site_192.168.123.0_24-192.168.1.0_24":500 STATE_MAIN_I1 (sent 
MI1, expecting MR1); EVENT_RETRANSMIT in 23s; nodpd; idle; import:not set
000

gateway2: ipsec whack --status

000 "site_192.168.1.0_24-192.168.123.0_24": 
192.168.1.0/24===10.2.3.156...10.29.3.225===192.168.123.0/24; erouted; 
eroute owner: #7
000 "site_192.168.1.0_24-192.168.123.0_24":     srcip=unset; 
dstip=unset; srcup=/ramfs/bin/ipsec_updown.exe; 
dstup=/ramfs/bin/ipsec_updown.exe;
000 "site_192.168.1.0_24-192.168.123.0_24":   ike_life: 28800s; 
ipsec_life: 86400s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "site_192.168.1.0_24-192.168.123.0_24":   policy: 
PSK+ENCRYPT+TUNNEL+PFS+DONTREKEY+UP+failureDROP; prio: 24,24; interface: 
eth2;
000 "site_192.168.1.0_24-192.168.123.0_24":   dpd: action:clear; 
delay:10; timeout:15;
000 "site_192.168.1.0_24-192.168.123.0_24":   newest ISAKMP SA: #0; 
newest IPsec SA: #7;
000 "site_192.168.1.0_24-192.168.123.0_24":   IKE algorithms wanted: 
7_256-2-5, 7_256-2-2, 7_256-2-1, flags=strict
000 "site_192.168.1.0_24-192.168.123.0_24":   IKE algorithms found:  
7_256-2_160-5, 7_256-2_160-2, 7_256-2_160-1,
000 "site_192.168.1.0_24-192.168.123.0_24":   ESP algorithms wanted: 
12_256-2, ; pfsgroup=2; flags=strict
000 "site_192.168.1.0_24-192.168.123.0_24":   ESP algorithms loaded: 
12_256-2, ; pfsgroup=2; flags=strict
000 "site_192.168.1.0_24-192.168.123.0_24":   ESP algorithm newest: 
AES_256-HMAC_SHA1; pfsgroup=MODP1024
000
000 #7: "site_192.168.1.0_24-192.168.123.0_24":500 STATE_QUICK_I2 (sent 
QI2, IPsec SA established); EVENT_SA_REPLACE_IF_USED in 82340s; newest 
IPSEC; eroute owner
000 #7: "site_192.168.1.0_24-192.168.123.0_24" used 27s ago; 
esp.b3b17a68 at 10.29.3.225 esp.e6c8d0cd at 10.2.3.156 tun.1004 at 10.29.3.225 
tun.1003 at 10.2.3.156


On 03/01/2010 02:57 PM, Paul Wouters wrote:
> On Mon, 1 Mar 2010, mix.kao wrote:
>
>> i have a question about the openswan config.
>> I am trying to build a tunnel between two gateways.
>> gateway1's ike set to AES256-SHA1-MODP768
>> gateway2's ike set to AES128-SHA1-MODP1536
>> and finally the tunnel use ==> IKE algorithm newest: 
>> AES_CBC_256-SHA1-MODP768
>
> I do not understand this.
>
> If the two gateway's set an ike= option, ONLY that proposal is 
> allowed. If two
> gateways set two different ike= options, they will never setup a 
> tunnel. If
> the ike= options (and other options/auth) match, the tunnel will work. If
> you want to allow two proposals, you can allow them both. In your 
> example:
> gateway2 would use: ike=AES256-SHA1-MODP768,AES128-SHA1-MODP1536
>
> However note that modp768 does NOT WORK with opensan because it is
> insecure. The minimum openswan will use is modp1024
>
> Paul
>
>