<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body smarttemplateinserted="true" bgcolor="#FFFFFF" text="#000000">
<div id="smartTemplate4-template">Hello everyone:<br>
I have recently setup a config for both our peer on a PIX as well as the config within strongSwan. I had to dance around our customer's previous config of the PIX before I could understand and attempt writing the configuration so that the NAT is done correctly.<br>
I have finally had them apply the config to their PIX and I have configured our side of the tunnel with strongSwan 5.1.1dr4 (I installed this release prior to the official release of 5.1.1 to test out the patch for the CHILD_SA re-negotiation deleting the tunnel
altogether [issue 317 if I am not mistaken]).<br>
<br>
Here is the config I had them apply on the PIX:<br>
<br>
isakmp policy 35 authentication pre-share<br>
isamkp policy 35 encryption 3des<br>
isamkp policy 35 hash md5<br>
isakmp policy 35 group 2<br>
isamkp policy 35 lifetime 86400<br>
<br>
isakmp key 0UR-PSKH3R3 address 54.208.x.y netmask 255.255.255.255<br>
<br>
access-list vpn_to_wepa_dr permit ip 172.20.2.0 255.255.255.0 192.168.188.0 255.255.252.0<br>
access-list inside_pnat_wepa_dr permit ip 10.2.1.0 255.255.255.0 192.168.188.0 255.255.252.0<br>
access-list inside_nat0_outbound permit ip 172.20.2.0 255.255.255.0 192.168.188.0 255.255.252.0
<br>
<br>
crypto map outside_map 35 ipsec-isakmp<br>
crypto map outside_map 35 match address vpn_to_wepa_dr<br>
crypto map outside_map 35 set peer 54.208.x.y<br>
crypto map outside_map 35 set transform-set ESP-3DES-MD5<br>
<br>
static (inside,outside) 172.20.2.0 access-list inside_pnat_wepa_dr<br>
<br>
<br>
And the strongSwan side which I control in AWS:<br>
conn school-tunnel04<br>
type=tunnel<br>
auto=start<br>
keyexchange=ikev1<br>
ikelifetime=12h<br>
lifetime=11h<br>
margintime=1h<br>
rekeyfuzz=100%<br>
authby=secret<br>
auth=esp<br>
ike=3des-md5-modp1024!<br>
esp=3des-md5!<br>
left=10.201.50.70<br>
leftid=wepa<br>
leftsubnet=192.168.188.0/22<br>
leftfirewall=yes<br>
right=W.X.Y.Z<br>
rightid=W.X.Y.Z<br>
rightsubnet=172.20.2.0/24<br>
<br>
where W.X.Y.Z is their public IP address in the strongSwan ipsec.conf file and 54.208.x.y is our full public IP of the strongSwan box in AWS.<br>
<br>
Now, the tunnel is stuck in the following with ipsec statusall:<br>
school-tunnel04[12]: ESTABLISHED 83 seconds ago, 10.201.50.70[wepa]...W.X.Y.Z[W.X.Y.Z]<br>
school-tunnel04[12]: IKEv1 SPIs: 382ed50ff688b46f_i* 51a5b24472d03430_r, pre-shared key reauthentication in 10 hours<br>
school-tunnel04[12]: IKE proposal: 3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024<br>
school-tunnel04[12]: Tasks active: QUICK_MODE <br>
<br>
All other tunnels are installed and routed. I have a deep feeling it is because I am trying to accomplish the left-side NAT within the strongSwan config. Can someone please assist?<br>
Please realize we have 4 other tunnels in strongSwan configuration and I need the NAT to only apply for this single connection on our side.<br>
<br>
Thanks,<br>
Izz<br>
<br>
<b>Izz Abdullah</b><br>
<i>Senior Systems Engineer</i><br>
<a class="moz-txt-link-abbreviated" href="http://www.wepanow.com">www.wepanow.com</a><br>
<div style="line-height:50%"> <br>
</div>
</div>
<br>
</body>
</html>