<div dir="ltr"><div><div><div><div><div><div><div>Hello,<br><br></div>I'm have solution with Sonicwall.<br><br></div>I'm have a problem with ASA cisco.<br><br></div>My vpn is working only ping in cisco to strongswan, ping strongwsan to cisco not working.<br><br></div><b>ipsec statusall (not up tunnel)</b><br><br>Status of IKE charon daemon (strongSwan 5.2.1, Linux 3.16.0-4-amd64, x86_64):<br> uptime: 55 seconds, since Mar 21 13:07:21 2017<br> malloc: sbrk 1462272, mmap 0, used 295840, free 1166432<br> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0<br> loaded plugins: charon aes rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default stroke updown<br>Listening IP addresses:<br> 81.25.126.250<br> 10.200.1.1<br>Connections:<br> evindustria: 81.25.126.250...80.28.231.246 IKEv1<br> evindustria: local: uses pre-shared key authentication<br> evindustria: remote: uses pre-shared key authentication<br> evindustria: child: <a href="http://10.200.1.0/24">10.200.1.0/24</a> === <a href="http://192.168.1.0/24">192.168.1.0/24</a> TUNNEL<br>Security Associations (0 up, 0 connecting):<br> none<br><br></div><b>ipsec statusall (up tunnel ping cisco to strongswan):</b><br><br> ipsec statusall<br>Status of IKE charon daemon (strongSwan 5.2.1, Linux 3.16.0-4-amd64, x86_64):<br> uptime: 4 minutes, since Mar 21 13:07:21 2017<br> malloc: sbrk 1462272, mmap 0, used 312352, free 1149920<br> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 1<br> loaded plugins: charon aes rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default stroke updown<br>Listening IP addresses:<br> 81.25.126.250<br> 10.200.1.1<br>Connections:<br> evindustria: 81.25.126.250...80.28.231.246 IKEv1<br> evindustria: local: [81.25.126.250] uses pre-shared key authentication<br> evindustria: remote: uses pre-shared key authentication<br> evindustria: child: <a href="http://10.200.1.0/24">10.200.1.0/24</a> === <a href="http://192.168.1.0/24">192.168.1.0/24</a> TUNNEL<br>Security Associations (1 up, 0 connecting):<br> evindustria[31]: ESTABLISHED 12 seconds ago, 81.25.126.250[81.25.126.250]...80.28.231.246[80.28.231.246]<br> evindustria[31]: IKEv1 SPIs: 9e663b4657e88fe0_i* 75b645cf74cacf00_r, rekeying disabled<br> evindustria[31]: IKE proposal: 3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br> evindustria[31]: Tasks queued: QUICK_MODE<br> evindustria[31]: Tasks active: MODE_CONFIG<br> evindustria{1}: INSTALLED, TUNNEL, ESP SPIs: c3c119e2_i dc7652ea_o<br> evindustria{1}: 3DES_CBC/HMAC_SHA1_96, 400 bytes_i (4 pkts, 6s ago), 400 bytes_o (4 pkts, 6s ago), rekeying disabled<br> evindustria{1}: <a href="http://10.200.1.0/24">10.200.1.0/24</a> === <a href="http://192.168.1.0/24">192.168.1.0/24</a><br><b><br></b></div><b>iptables-save</b><br></div>is empty (but vpn to sonicwall is working perfectly).<br><br><div><div><b>ip route show table all</b><br>default via 81.25.126.1 dev eth0<br><a href="http://10.200.1.0/24">10.200.1.0/24</a> dev eth1 proto kernel scope link src 10.200.1.1<br><a href="http://81.25.126.0/24">81.25.126.0/24</a> dev eth0 proto kernel scope link src 81.25.126.250<br>broadcast 10.200.1.0 dev eth1 table local proto kernel scope link src 10.200.1.1<br>local 10.200.1.1 dev eth1 table local proto kernel scope host src 10.200.1.1<br>broadcast 10.200.1.255 dev eth1 table local proto kernel scope link src 10.200.1.1<br>broadcast 81.25.126.0 dev eth0 table local proto kernel scope link src 81.25.126.250<br>local 81.25.126.250 dev eth0 table local proto kernel scope host src 81.25.126.250<br>broadcast 81.25.126.255 dev eth0 table local proto kernel scope link src 81.25.126.250<br>broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1<br>local <a href="http://127.0.0.0/8">127.0.0.0/8</a> dev lo table local proto kernel scope host src 127.0.0.1<br>local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1<br>broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1<br>unreachable default dev lo table unspec proto kernel metric 4294967295 error -101<br>local ::1 dev lo proto kernel metric 256<br>fe80::/64 dev eth0 proto kernel metric 256<br>fe80::/64 dev eth1 proto kernel metric 256<br>unreachable default dev lo table unspec proto kernel metric 4294967295 error -101<br>local ::1 dev lo table local proto none metric 0<br>local fe80::dc16:64ff:fe75:7721 dev lo table local proto none metric 0<br>local fe80::f49f:97ff:feac:5e0f dev lo table local proto none metric 0<br>ff00::/8 dev eth0 table local metric 256<br>ff00::/8 dev eth1 table local metric 256<br>unreachable default dev lo table unspec proto kernel metric 4294967295 error -101<br><br></div><div><b>Config vpn:</b><br><br>config setup<br><br>conn evindustria<br> left=81.25.126.250<br> leftsourceip=10.200.1.1<br> leftsubnet=<a href="http://10.200.1.0/24">10.200.1.0/24</a><br> leftid=%any<br> right=80.28.231.246<br> rightid=%any<br> rightsubnet=<a href="http://192.168.1.0/24">192.168.1.0/24</a><br> #Encriptacio<br> keyingtries=3<br> esp=3des-sha1-modp1024<br> ike=3des-sha1-modp1024<br> authby=secret<br> keyexchange=ikev1<br> rekey=no<br> reauth=no<br> #lifetime<br> dpdtimeout=15s<br> dpddelay=5s<br> compress=yes<br> #fragmentation=yes<br> ikelifetime=60s<br> lifetime=86400s<br> # This allows the VPN to come up automatically when openswan starts<br> auto=add<br> type=tunnel<br><br></div><div>IPSEC Secrets:<br><br>81.25.126.250 80.28.231.246 : PSK 'PASSWORD CORRECT'<br><br><span id="gmail-result_box" class="gmail-" lang="en"><span>I am waiting for your answer.</span><br><br><span>Only the VPN works by pinging from the Cisco ASA to Strongwsan</span><br><br><span>On the other hand I have problems also with a Fortigate but we go in steps.</span><br><br><span>Thank you very much.</span></span><br><br><br><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2017-03-21 11:22 GMT+01:00 Noel Kuntze <span dir="ltr"><<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello Jordi,<br>
<br>
Please provide the required information as described on the wiki page about help requests[1].<br>
We can then help you effectively.<br>
<br>
[1] <a href="https://wiki.strongswan.org/projects/strongswan/wiki/HelpRequests" rel="noreferrer" target="_blank">https://wiki.strongswan.org/<wbr>projects/strongswan/wiki/<wbr>HelpRequests</a><br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
<br>
Mit freundlichen Grüßen/Kind Regards,<br>
Noel Kuntze<br>
<br>
GPG Key ID: 0x63EC6658<br>
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
<br>
<br>
</font></span></blockquote></div><br></div>