<div dir="ltr"><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div>Hi<br><br></div>I'm trying to install a net2net tunnel with <br><br></div><div>my linux vpn server <br></div><div><br></div>Debian 8.2 Linux kernel 3.16.0.4 Strongswan 5.2.1<br><br></div>to a remote site with <br><br>Checkpoin VPN gateway <br><br></div><br><br></div>The Checkpoint parameters proposed are <br></div><div><br>IKE version 1<br><br></div><div><font face="Palatino Linotype, serif"><span lang="en-GB"><b>VPN
AUTHENTICATION METHOD:</b></span></font><font face="Palatino Linotype, serif"><span lang="en-GB"> Pre-Shared
Key (32 characters agreed upon during the conference call)</span></font>
<p class="" style="margin-bottom:0in;line-height:100%"><font face="Palatino Linotype, serif"><span lang="en-GB"><b>VPN
PHASE 1:</b></span></font><font color="#ff0000"><font face="Palatino Linotype, serif"><span lang="en-GB"><u><b>AES-256</b></u></span></font></font><font face="Palatino Linotype, serif"><span lang="en-GB"></span><span lang="en-GB"> </span></font><font color="#ff0000"><font face="Palatino Linotype, serif"><span lang="en-GB"><u><b>SHA1</b></u></span></font></font><font face="Palatino Linotype, serif"><span lang="en-GB"></span><span lang="en-GB"> DH </span></font><font color="#ff0000"><font face="Palatino Linotype, serif"><span lang="en-GB"><u><b>Group
2</b></u></span></font></font><font face="Palatino Linotype, serif"><span lang="en-GB"> <br></span></font></p><p class="" style="margin-bottom:0in;line-height:100%"><font face="Palatino Linotype, serif"><span lang="en-GB"><b>Rekeying
Parameters:</b></span></font></p>
<ul><li>
<p class="" style="margin-bottom:0in;line-height:100%">
<font face="Palatino Linotype, serif"><span lang="en-GB">Renegotiate
IKE (phase 1) Security associations every </span></font><font color="#ff0000"><font face="Palatino Linotype, serif"><span lang="en-GB"><u><b>60
minutes</b></u></span></font></font></p>
</li><li>
<p class="" style="margin-bottom:0in;line-height:100%">
<font face="Palatino Linotype, serif"><span lang="en-GB">Renegotiate
IPsec (IKE phase 2) Security associations every </span></font><font color="#ff0000"><font face="Palatino Linotype, serif"><span lang="en-GB"><u><b>15
minutes</b></u></span></font></font></p>
</li></ul>
<p class="" style="margin-bottom:0in;line-height:100%"> </p>
<p class="" style="margin-bottom:0in;line-height:100%"><font face="Palatino Linotype, serif"><span lang="en-GB"><b>VPN
PHASE 2:</b></span> </font><font color="#ff0000"><font face="Palatino Linotype, serif"><u><b>AES-256</b></u></font></font><font face="Palatino Linotype, serif"><span lang="en-GB"> </span></font><font color="#ff0000"><font face="Palatino Linotype, serif"><span lang="en-GB"><u><b>SHA1</b></u></span></font></font><font face="Palatino Linotype, serif"><span lang="en-GB"> <br></span></font></p><ul><li>
<p class="" style="margin-bottom:0in;line-height:100%">
<font face="Palatino Linotype, serif"><span lang="en-GB">Compression
method: </span></font><font color="#ff0000"><font face="Palatino Linotype, serif"><span lang="en-GB"><u><b>None</b></u></span></font></font><font face="Palatino Linotype, serif"><span lang="en-GB">
(preferred) (DEFLATE is also accepted)</span></font></p>
</li><li>
<p class="" style="margin-bottom:0in;line-height:100%">
<font face="Palatino Linotype, serif"><span lang="en-GB">Use Perfect
Forward Secrecy (PFS): </span></font><font color="#ff0000"><font face="Palatino Linotype, serif"><span lang="en-GB"><u><b>DH
group 2</b></u></span></font></font><font face="Palatino Linotype, serif"><span lang="en-GB"><u><b>
</b></u></span></font><font face="Palatino Linotype, serif"><span lang="en-GB">(preferred)
(Group 5 is also accepted)</span></font></p>
</li></ul>
<br><br><br></div>my configuration is :<br><br></div><div>ipsec.conf<br></div><div><br>config setup<br> # strictcrlpolicy=yes<br> # uniqueids = no<br><br>conn %default<br> ikelifetime=1440m<br> keylife=60m<br> rekeymargin=3m<br> keyingtries=1<br> keyexchange=ikev1<br> mobike=no<br> authby=secret<br><br>conn checkpoint<br> type=tunnel<br> left=1.2.3.4<br> leftsubnet=<a href="http://10.10.20.2/32">10.10.20.2/32</a><br> right=1.2.3.5<br> rightsubnet=<a href="http://10.10.10.1/32">10.10.10.1/32</a><br> keyexchange=ikev1<br> ikelifetime=1h<br> auth=esp<br> ike=aes256-sha1-modp1024<br> esp=aes256-sha1-modp1024<br> pfs=yes<br> auto=start<br> authby=secret<br><br><br></div>with ipsec.secrets<br><br></div>1.2.3.4 1.2.3.5 : PSK "*************"<br><br><br><br></div>when I start the tunnel the Checkpoint side see this ISAKMP packet with : <br><br></div>vendor id (13) : XAUTH<br></div>vendor id (13) : RFC 3706 <br>vendor id (13) : RFC 3947<br>vendor id (13) : draft-ietf-ipsec-nat-t-ike-02<br><br></div>and the Checkpoint tech side doesn't respond to this proposal<br><br><br></div>what can I do ?<br><br><br></div>thank you <br></div>Leo <br><div><div><div><div><div><div><div><br><div><br></div></div></div></div></div></div></div></div></div>