[Openswan Users] 2.6.33 fix for compile failure withoutUSE_EXTRACRYPTO=true

[Swartz, Patrick H]

Hi All,

Was hoping the list would be so kind to help me better understand the
proper configuration when one side is behind a NAT router.

Here is what I have so far (which of course isn't working ...)

(LEFT SIDE)
config setup
        protostack=netkey
        nat_traversal=yes
        virtual_private=%v4:192.168.10.0/24    ## Was guessing here,
tried without but no go

conn rhel5secr-rhel5gp1
        connaddrfamily=ipv4
        type=tunnel
        authby=secret
        left=172.27.10.2
        right=%any    ## tried using both the NAT addres (172.27.10.4
and the real address (192.168.10.2)
        rightsubnet=vhost:%priv			## Was guessing here,
tried without but no go
        esp=3des
        keyexchange=ike
        pfs=no
        auto=start

ipsec.secrets
172.27.10.2 172.27.10.4: PSK "c78250df64812af440e0"


(RIGHT SIDE)
config setup
        protostack=netkey
        nat_traversal=yes

conn rhel5secr-rhel5gp1
        connaddrfamily=ipv4
        type=tunnel
        authby=secret
        left=172.27.10.2
        right=172.27.10.4
        esp=3des
        keyexchange=ike
        pfs=no
        auto=start

ipsec.secrets
172.27.10.2 172.27.10.4: PSK "c78250df64812af440e0"


diagram --
LEFT								RIGHT
rhel5gp1 (eth1 - 172.27.10.2)	<router/NAT-T>	rhel5secr (eth0 -
192.168.10.2)
						1:1 NAT
192.168.10.2:172.27.10.4

Router is a Cisco2811 w/this configuration
interface FastEthernet0
 ip address 172.27.10.1 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface FastEthernet1
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto

Red Hat 5.4 
Linux Openswan U2.6.14/K2.6.18-164.el5 (netkey)

I'm sure I'm messing up with the right/left configuration, but nothing
I've tried works.  This is a lab POC before we roll out to a larger
environment.

Thank you for any help ya can throw my way!!

Patrick Swartz
UNIX Planning & Engineering (DSUSSE)
First Data 
402-777-7337 desk
402-201-1192 Company cell


-----------------------------------------
The information in this message may be proprietary and/or
confidential, and protected from disclosure.  If the reader of this
message is not the intended recipient, or an employee or agent
responsible for delivering this message to the intended recipient,
you are hereby notified that any dissemination, distribution or
copying of this communication is strictly prohibited. If you have
received this communication in error, please notify First Data
immediately by replying to this message and deleting it from your
computer.