[Openswan Users] phase2alg confusedly

Fri Jul 20 06:25:21 EDT 2012

Dear Sirs,

I  used the openswan to connect another system.The algorithm are as below.I 
am very confused.Why the tunnel can be up and we can ping peer to peer PC.
Originally I think if use different algorithms,the tunnel should not 
work.But the final result is different.I have no idea in this 
question.Please help very thank's.

<openswan>
phase1=3des-md5;modp1024
phase2= aes256-hmac_sha1

<other system>
phase1=3des-md5;modp1024
phase2= 3des-md5;modp1024

Best Regards,
Ozai

# cat ipsec.conf
config setup
                nat_traversal=no
                oe=off
                protostack=netkey
                interfaces=%defaultroute

conn t1
                left=172.17.21.88
                leftsubnet=192.168.1.0/24
                rightsubnet=192.168.6.0/24
                connaddrfamily=ipv4
                right=172.17.21.87
                pfs=yes
                keyexchange=ike
                ike=3des-md5;modp1024
                salifetime=480m
                phase2=esp
                phase2alg=aes256-hmac_sha1
                ikelifetime=60m
                type=tunnel
                authby=secret
                auto=add
#

# ipsec auto --status
000 using kernel interface: netkey
000 interface lo/lo ::1
000 interface lo/lo 127.0.0.1
000 interface br0/br0 192.168.1.254
000 interface eth0.1/eth0.1 172.17.21.88
000 %myid = (none)
000 debug none
000
000 virtual_private (%priv):
000 - allowed 0 subnets:
000 - disallowed 0 subnets:
000 WARNING: Either virtual_private= is not specified, or there is a syntax
000          error in that line. 'left/rightsubnet=vhost:%priv' will not 
work!
000 WARNING: Disallowed subnets in virtual_private= is empty. If you have
000          private address space in internal use, it should be excluded!
000
000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, 
keysizema
x=64
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, 
keysize
max=192
000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, 
keysizem
ax=0
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, 
keysize
max=256
000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, 
keysizemin=128, k
eysizemax=256
000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, 
keysizemin=128, k
eysizemax=256
000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, 
keysizemin=128, k
eysizemax=256
000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, 
keysizemin=128, k
eysizemax=256
000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=8, 
keysizemin=128, k
eysizemax=256
000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=8, 
keysizemin=128, k
eysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, 
keysizemin=128,
 keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, 
keysizemin=160
, keysizemax=160
000 algorithm ESP auth attr: id=251, name=AUTH_ALGORITHM_NULL_KAME, 
keysizemin=0
, keysizemax=0
000
000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, 
keydeflen=19
2
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, 
keydeflen=12
8
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32
000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024
000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048
000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048
000
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,5,36} 
trans={0,5,360}
 attrs={0,5,480}
000
000 "t1": 
192.168.1.0/24===172.17.21.88<172.17.21.88>...172.17.21.87<172.17.21.8
7>===192.168.6.0/24; erouted; eroute owner: #4
000 "t1":     myip=unset; hisip=unset;
000 "t1":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; 
rekey_fuzz:
 100%; keyingtries: 0
000 "t1":   policy: 
PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; p
rio: 24,24; interface: eth0.1;
000 "t1":   newest ISAKMP SA: #3; newest IPsec SA: #4;
000 "t1":   IKE algorithms wanted: 3DES_CBC(5)_000-MD5(1)_000-MODP1024(2); 
flags
=-strict
000 "t1":   IKE algorithms found:  3DES_CBC(5)_192-MD5(1)_128-MODP1024(2)
000 "t1":   IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024
000 "t1":   ESP algorithms wanted: AES(12)_256-SHA1(2)_000; flags=-strict
000 "t1":   ESP algorithms loaded: AES(12)_256-SHA1(2)_160
000 "t1":   ESP algorithm newest: 3DES_000-HMAC_MD5; pfsgroup=<Phase1>
000
000 #7: "t1":500 STATE_QUICK_I1 (sent QI1, expecting QR1); EVENT_RETRANSMIT 
in 3
1s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate
000 #4: "t1":500 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 
3122
s; newest IPSEC; eroute owner; isakmp#3; idle; import:not set
000 #4: "t1" esp.7756b716 at 172.17.21.87 esp.454085f8 at 172.17.21.88 ref=0 
refhim=42
94901761
000 #3: "t1":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); 
EVENT_SA_REPLA
CE in 3121s; newest ISAKMP; lastdpd=8s(seq in:0 out:0); idle; import:admin 
initiate