Hi Andreas,<br><br>Sorry for continuous queries but needed some info on ipsec.conf for certificates so please do the needful .<br><br> From your last mial do you mean leftid=%fromcert will set id type as subjectDN by default? i.e with below value in my case?<br>
subject: "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=ATCA_cla, E=<a href="mailto:gianluigi.ongaro@nsn.com" target="_blank">gianluigi.ongaro@nsn.com</a>"<br>
<br>Also, if 10.0.0.1 (please refer my previous mail) is the initiator with leftid type as always ipaddress and i want to accept all peer id types(fqdn/dn/ipaddress) how should be the values of right, left , rightid and leftid on 10.0.0.1 side ? Can this be achieved by magic values or wild card entries in simple way, without explicitly specifying them.<br>
<br>(Or )<br><br>Any ipsec.conf option exist to ignore identity check of peer .<br><br><br><br>Thanks,<br>Reshma<br><br><b># /usr/local/6bin/ipsec stroke listall</b><br>List of X.509 End Entity Certificates:<br><br> altNames: <a href="http://cla.atca.nsn.com/" target="_blank">cla.atca.nsn.com</a><br>
subject: "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=ATCA_cla, E=<a href="mailto:gianluigi.ongaro@nsn.com" target="_blank">gianluigi.ongaro@nsn.com</a>"<br>
issuer: "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=<a href="http://www.nokiasiemensnetworks.com/" target="_blank">www.nokiasiemensnetworks.com</a>, E=<a href="mailto:gianluigi.ongaro@nsn.com" target="_blank">gianluigi.ongaro@nsn.com</a>"<br>
serial: 03<br> validity: not before Mar 31 09:14:01 2012, ok<br> not after Apr 30 09:14:01 2012, ok (expires in 28 days) <br> pubkey: RSA 1024 bits, has private key<br> keyid: 82:8e:cf:f7:a0:81:9e:00:77:0b:<div>
d7:ee:6f:f7:43:8a:d2:73:e4:af<br>
subjkey: 5f:ed:01:a0:a6:18:fd:12:dd:18:e1:fe:d4:76:a2:ea:4c:8f:e2:74<br><br>List of X.509 CA Certificates:<br><br> subject: "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=<a href="http://www.nokiasiemensnetworks.com/" target="_blank">www.nokiasiemensnetworks.com</a>, E=<a href="mailto:gianluigi.ongaro@nsn.com" target="_blank">gianluigi.ongaro@nsn.com</a>"<br>
issuer: "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=<a href="http://www.nokiasiemensnetworks.com/" target="_blank">www.nokiasiemensnetworks.com</a>, E=<a href="mailto:gianluigi.ongaro@nsn.com" target="_blank">gianluigi.ongaro@nsn.com</a>"<br>
serial: 00:a9:d9:3d:5e:b8:7b:a3:4d<br> validity: not before Mar 31 09:14:01 2012, ok<br> not after Apr 30 09:14:01 2012, ok (expires in 28 days) <br> pubkey: RSA 1024 bits<br> keyid: b0:de:5e:b4:0d:d3:1c:4d:25:e7:cf:4c:bc:f3:31:d1:47:03:1e:d5<br>
subjkey: 29:95:a1:57:17:5e:2b:7a:e0:9d:6d:56:f6:bf:5d:c8:41:1f:44:6f<br> authkey: 29:95:a1:57:17:5e:2b:7a:e0:9d:6d:56:f6:bf:5d:c8:41:1f:44:6f<div><div><img src="http://images/cleardot.gif"></div>
</div></div><br><br><div class="gmail_quote">On Mon, Apr 2, 2012 at 3:48 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Reshma,<br>
<br>
by default the certificate's subjectDistinguishedName is used as<br>
an ID. There is no mechanism to automatically assign subjectAltNames.<br>
<br>
What should we do if several subjectAltNames exist?<br>
<br>
Regards<br>
<br>
Andreas<br>
<div><br>
On 02.04.2012 11:14, Reshma Begam wrote:<br>
> Hi Andreas,<br>
><br>
> Thanks for the response and this works.<br>
><br>
> Also, how can we assign identity info from cert files to leftid/rightid<br>
> ? instead of explicitly defining them.<br>
><br>
> Example: I am looking something like leftid=%fromcert<br>
><br>
> leftid=%fromcert and leftid=%leftcert --> I tried both these options on<br>
> responder side instead of leftid=<a href="http://cla.atca.nsn.com" target="_blank">cla.atca.nsn.com</a><br>
</div>> <<a href="http://cla.atca.nsn.com/" target="_blank">http://cla.atca.nsn.com/</a>>, but it doesn't work.<br>
<div>><br>
> Could you please comment what should be the wild card entries on both<br>
> sides to acheive this assignments using certs?<br>
><br>
> Thanks,<br>
> Reshma<br>
><br>
<br>
</div><div><div>======================================================================<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a><br>
strongSwan - the Linux VPN Solution! <a href="http://www.strongswan.org" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
===========================================================[ITA-HSR]==<br>
<br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div> </div>
<div>Regards,</div>
<div>Reshma</div><br>