<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body>
<p>I can't get my ipsec infrastructure working.</p>
<p>My goal is to authenticate on vpn server the wifi network.</p>
<p>The vpn server is protected by the firewall.</p>
<p>The wifi network has to surf the internal network (10. class)</p>
<p>My conf is this:</p>
<p>192.168.1.0/24 192.168.1.4 10.10.1.254 10.10.1.213</p>
<p>---------------------- ----------------------- ------------------------</p>
<p>| wifi network | -> | firewall | -> | vpn server |</p>
<p>---------------------- ------------------------ ------------------------</p>
<p> </p>
<p>Now, my configuration is:</p>
<pre>config setup<br /> # plutodebug=all<br /> # crlcheckinterval=600<br /> # strictcrlpolicy=yes<br /> # cachecrls=yes<br /> # nat_traversal=yes<br /> charonstart=yes<br /> plutostart=yes<br /> nat_traversal=yes<br /> virtual_private=%v4:192.168.1.0/24<br /><br />conn L2TP<br /> authby=psk<br /> pfs=no<br /> rekey=no<br /> type=transport<br /> esp=aes128-sha1<br /> ike=aes128-sha-modp1024<br /> left=10.10.1.213<br /> leftnexthop=%defaultroute<br /> leftprotoport=17/1701<br /> right=%any<br /> rightprotoport=17/%any</pre>
<pre> auto=add<br /> forceencaps=yes<br /><br />include /var/lib/strongswan/ipsec.conf.inc</pre>
<pre> </pre>
<pre>When I start ipsec everything goes well, but when I try to authenticate what I get (mainly) is:</pre>
<pre> </pre>
<pre>srvvpn pluto[19642]: "L2TP"[1] 192.168.1.104:4500 #1: cannot respond to IPsec SA request because no connection is known for 192.168.1.4/32===10.10.1.213:4500:17/1701...192.168.1.104:4500:17/%any</pre>
<pre> </pre>
<pre> </pre>
<pre>Moreover my ipsec statusall shows:</pre>
<pre>ipsec statusall<br />000 interface lo/lo ::1:500<br />000 interface lo/lo 127.0.0.1:4500<br />000 interface lo/lo 127.0.0.1:500<br />000 interface eth0/eth0 10.10.1.213:4500<br />000 interface eth0/eth0 10.10.1.213:500<br />000 %myid = (none)<br />000 debug none</pre>
<pre>000 <br />000 "L2TP": 10.10.1.213:17/1701---10.10.1.254...%any:17/%any; unrouted; eroute owner: #0<br />000 "L2TP": ike_life: 10800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3<br />000 "L2TP": policy: PSK+ENCRYPT+DONTREKEY; prio: 32,32; interface: eth0; <br />000 "L2TP": newest ISAKMP SA: #0; newest IPsec SA: #0; <br />000 "L2TP": IKE algorithms wanted: 7_128-2-2, <br />000 "L2TP": IKE algorithms found: 7_128-2_160-2, <br />000 "L2TP": ESP algorithms wanted: 12_128-2, <br />000 "L2TP": ESP algorithms loaded: 12_128-2_160, <br />000</pre>
<pre>Performance:<br /> uptime: 8 minutes, since Oct 11 13:29:07 2011<br /> worker threads: 9 idle of 16, job queue load: 0, scheduled events: 0<br /> loaded plugins: curl ldap random x509 pubkey xcbc hmac openssl agent gmp kernel-netlink stroke updown <br />Listening IP addresses:<br /> 10.10.1.213<br />Connections:<br />Security Associations:<br /> none</pre>
<pre> </pre>
<pre>What should I do?</pre>
<pre>Thanks in advance,</pre>
<pre>Pietro Vassalli</pre>
<pre> </pre>
<div>
<pre>--</pre>
<pre>Pietro Vassalli<br />Organize Systems S.A.<br />Via Carvina 1<br />6807 Taverne<br />Tel.+41919453322<br />Fax+41919453320</pre>
</div>
</body></html>