<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=text/html;charset=iso-8859-2 http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.19046"></HEAD>
<BODY style="PADDING-LEFT: 10px; PADDING-RIGHT: 10px; PADDING-TOP: 15px"
id=MailContainerBody leftMargin=0 topMargin=0 CanvasTabStop="true"
name="Compose message area">
<DIV><FONT size=2 face=Arial>Hi,</FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial>I tried to migrate our Openswan VPN (2.6.21) to
Strongswan VPN (4.5.1) on our CentOS 5 server. Openswan package is from official
CentOS repository (openswan-2.6.21-5.el5_6.4), Strongswan package have been
built from this spec file: <A
href="http://developer.intra2net.com/git/?p=strongswan-rpm;a=blob_plain;f=strongswan.spec;hb=e2bb0076fce6d44ee80cff4b20d90a0eee1fa689"><FONT
title="http://developer.intra2net.com/git/?p=strongswan-rpm;a=blob_plain;f=strongswan.spec;hb=e2bb0076fce6d44ee80cff4b20d90a0eee1fa689
Klepnutím na odkaz se stisknutou klávesou CTRL přejděte na odkaz."
size=3
face="Times New Roman">http://developer.intra2net.com/git/?p=strongswan-rpm;a=blob_plain;f=strongswan.spec;hb=e2bb0076fce6d44ee80cff4b20d90a0eee1fa689</FONT></A></FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial>I slightly modified configuration for IKEv1
keying, ipsec.conf looks like:</FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial>config setup<BR>
charonstart=no<BR> plutodebug="control"</FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial>conn %default<BR>
keyexchange=ikev1<BR> authby=secret<BR></FONT><FONT size=2
face=Arial></FONT></DIV>
<DIV><FONT size=2 face=Arial>conn CONN</FONT></DIV>
<DIV><FONT size=2 face=Arial> type=tunnel<BR>
left=A.A.A.A</FONT></DIV>
<DIV><FONT size=2 face=Arial>
leftsubnet=192.168.52.0/24<BR> right=B.B.B.B<BR>
rightsubnet=10.10.0.0/16<BR> auto=start<BR>
auth=esp<BR> ikelifetime=28800s<BR>
keylife=3600s<BR> compress=no<BR>
ike=3des-sha1-modp1024<BR> esp=3des-sha1<BR>
pfs=yes<BR> dpddelay=30<BR>
dpdtimeout=120<BR> dpdaction=restart<BR></FONT></DIV>
<DIV><FONT size=2 face=Arial>Both ISAKMP and IPsec SA were succesfully
established, ip xfrm policy output was the same as output from Openswan.
But...</FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial>In tcpdump, I saw incoming ESP traffic from
B.B.B.B, but no ESP traffic from our address A.A.A.A. Ping to 10.10.255.1
returned no response, so I think that policies were in
place (with turned off VPN, ping returned "host unreachable" from far away
gateway). I added "iptables -I FORWARD -j ACCEPT" rule to iptables to rule out
problem with firewall.</FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial>Do you have any idea what can be
wrong?</DIV></FONT>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial>Thanks,</FONT></DIV>
<DIV><FONT size=2 face=Arial>Regards,</FONT></DIV>
<DIV><FONT size=2 face=Arial>Pavel Arnost</FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV></BODY></HTML>