[Openswan Users] esp string error: enc_alg not found

Steve Zeng SteveZ at airg.com
Fri May 21 15:22:46 EDT 2010


Paul,

I reply back because manually creating the tunnel interface actually leads me in a dead corner now.

My currently situation is as follows:

My_subnet(192.168.1.0/24) -- my_vpn_gateway -- internet -- amazon_vpn_gateway -- vpc (10.0.0.0/24)  

My_vpn_gateway currently has two interfaces:
Public interface: 209.90.164.199
Private interface: 192.168.1.152

amazon_vpn_gateway: (I am not sure how many interfaces but at least one public IP and one tunnel IP available)
public interface: 72.21.109.125
tunnel interface: 169.254.255.1/30

what amazon tells me is:
==========================================================================
The Customer Gateway inside IP address should be configured on your tunnel
interface.

Outside IP Addresses:
  - Customer Gateway:        : 209.90.164.199
  - Amazon VPN Gateway       : 72.21.109.125

Inside IP Addresses
  - Customer Gateway         : 169.254.255.2/30
  - Amazon VPN Gateway       : 169.254.255.1/30
==========================================================================

So I configure my ipsec.conf as below:

==========================================================================
config setup
        interfaces=%defaultroute
        protostack=netkey
        klipsdebug=none
        plutodebug=none

conn ec2-tunnel-01
        type=           tunnel
        authby=         secret
        auth=           esp
        keyexchange=    ike
        ike=            aes128-sha1-modp1024
        ikelifetime=    28800s
        pfs=            yes
        esp=            aes128-sha1
        salifetime=     3600s
        dpdtimeout=     10
        dpddelay=       3
        left=           209.90.164.199
        right=          72.21.109.125
        leftsubnet=     169.254.255.2/30
        rightsubnet=    169.254.255.1/30
        auto=           start
==========================================================================

Now two symptoms is observed:

1) if I create a tunnel interface 169.254.255.2, then I can ping amazon's tunnel interface successfully. If I remove the tunnel interface, the ping will fail. 

2) if I ping from one machine within mynetwork(192.168.1.0/24) to one instance within Amazon VPC (10.0.0.0/24), it does not get any response. 

When I look back my ipsec.conf, I realized that there is no subnet configs for either 192.168.1.0/24 or 10.0.0.0/24. I suspect that is the cause. So How can I add them in? I tried with 

	  leftsubnets=    169.254.255.2/30, 192.168.1.0/24
        rightsubnet=    169.254.255.1/30, 10.0.0.0/24

but it does not seems the right syntax. 
syntax error, unexpected STRING, expecting EOL [192.168.1.0/24]

thanks for any hints.

Steve
 

  




-----Original Message-----
From: users-bounces at openswan.org [mailto:users-bounces at openswan.org] On Behalf Of Steve Zeng
Sent: May 18, 2010 11:22 AM
To: Paul Wouters
Cc: users at openswan.org
Subject: Re: [Openswan Users] esp string error: enc_alg not found

I manully configured the tunnel interface and I now can ping the other peer. 

# tunl0 for openswan
DEVICE=tunl0
BOOTPROTO=static
IPADDR=169.254.255.2
NETMASK=255.255.255.252
ONBOOT=yes

Thanks Paul, I appreciate your help. 

Steve

-----Original Message-----
From: users-bounces at openswan.org [mailto:users-bounces at openswan.org] On Behalf Of Steve Zeng
Sent: May 18, 2010 10:53 AM
To: Paul Wouters
Cc: users at openswan.org
Subject: Re: [Openswan Users] esp string error: enc_alg not found

It turns out that the problem is the pre-shared key. After re-create it again. Now I got one more step further. I see something like "IPsec SA established" and "ISAKMP SA established" when I run "ipsec auto --status".

000 #2: "ec2-tunnel-01":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 2098s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate
000 #2: "ec2-tunnel-01" esp.91e019af at 72.21.209. esp.c948fbc8 at 209.90.164.199 tun.0 at 72.21.109.125 tun.0 at 209.90.164.199 ref=0 refhim=4294901761
000 #1: "ec2-tunnel-01":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 27682s; newest ISAKMP; lastdpd=2s(seq in:17821 out:0); idle; import:admin initiate
000


>As stated numerous times now. Openswan will NOT GIVE you a tunnel interface.
I understand that openswan will not give me a tunnel interface. I am not sure if I need to create a tunnel interface as below or not. I could give it a try, though.
/etc/sysconfig/network-scripts/ifcfg-tunl0
# tunl0 for IPIP and LVS-TUN
DEVICE=tunl0
BOOTPROTO=static
IPADDR=204.92.101.25
NETMASK=255.255.255.255
ONBOOT=yes

Thanks for your hints, paul. 

Steve

-----Original Message-----
From: users-bounces at openswan.org [mailto:users-bounces at openswan.org] On Behalf Of Steve Zeng
Sent: May 18, 2010 10:29 AM
To: Paul Wouters
Cc: users at openswan.org
Subject: Re: [Openswan Users] esp string error: enc_alg not found

Right. I recreated a new preshared key already. Thanks, paul. 

Steve

-----Original Message-----
From: Paul Wouters [mailto:paul at xelerance.com] 
Sent: May 18, 2010 9:55 AM
To: Steve Zeng
Cc: users at openswan.org
Subject: RE: [Openswan Users] esp string error: enc_alg not found

On Tue, 18 May 2010, Steve Zeng wrote:

> Unfortunetely there is nothing I can configure on amazon side. All I got is the following instruction. So I think there maybe something missing on my side. Because I did not figured out the tunnel interface part yet. i.e. there is no tunnel interface up. or maybe I am in a dead corner?

As stated numerous times now. Openswan will NOT GIVE you a tunnel interface.

>  - Authentication Method    : Pre-Shared Key
>  - Pre-Shared Key           : jjwzQIHrPjr.ec31DU_ZGvucsE5lVikIZDZcqAkm

Anyone with access to the mailing list can now connect to that machine. I suggest
you immediately contact the remote sysadmin and change the Pre-Shared Key!!

> The Customer Gateway inside IP address should be configured on your tunnel
> interface.

That will require a leftsubnet= option on your end.

Paul
_______________________________________________
Users at openswan.org
http://lists.openswan.org/mailman/listinfo/users
Building and Integrating Virtual Private Networks with Openswan: 
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155
_______________________________________________
Users at openswan.org
http://lists.openswan.org/mailman/listinfo/users
Building and Integrating Virtual Private Networks with Openswan: 
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155
_______________________________________________
Users at openswan.org
http://lists.openswan.org/mailman/listinfo/users
Building and Integrating Virtual Private Networks with Openswan: 
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155


More information about the Users mailing list