<div dir="ltr">Hi,<div>I'm on a debian jessie 8.0, openswan 2.6.37 and I need to migrate to StrongSWAN 5.2.1</div><div><div>I'm a client (roadwarrior), the other side is a Checkpoint FW1 NG</div><div><br></div><div>This configuration IS WORKING FINE under openswan (i.e.: I can connect and work without any trouble):</div><div>==================================================</div><div><div>version<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>2.0<span class="gmail-Apple-tab-span" style="white-space:pre"> </span># conforms to second version of ipsec.conf specification<br></div><div><br></div><div>config setup</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>dumpdir=/var/run/pluto/</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>nat_traversal=yes</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10">10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10</a></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>oe=off</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>protostack=netkey # I set this to avoid warning message at connection startup</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>keep_alive=20</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>force_keepalive=yes</div><div><br></div><div>conn roadwarrior</div><div> left=%defaultroute</div><div> leftcert=my_cert.pem</div><div> leftrsasigkey=%cert</div><div> leftid=%fromcert</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>leftsourceip=A.B.C.D # CP-known client IP (not necessarily my ip), I need to set it because I'm using also a "rightsubnets" list</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>leftsubnet=A.B.C.D/32 # CP-known client IP(not necessarily my ip), I need to set it because I'm using also a "rightsubnets" list</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>#<br></div><div> right=X.Y.Z.W (FW1_IP_ADDESS)</div><div> rightid=X.Y.Z.W (I cannot use FW cert or other values, I MUST use the firewall public IP)</div><div> rightsubnets={ <a href="http://192.168.1.0/24">192.168.1.0/24</a> <a href="http://192.168.2.0/24">192.168.2.0/24</a> ecc... }</div><div> rightcert=firewall_cert.pem</div><div> rightrsasigkey=%cert</div><div> #<br></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>#</div><div> auto=start</div><div><br></div><div># after establishing the vpn, run these script to allow routes from my client to server behind the firevall</div><div>#</div><div># /sbin/iptables -t nat -I POSTROUTING -d <a href="http://192.168.1.0/24">192.168.1.0/24</a> -j SNAT --to my_ip</div><div># /sbin/iptables -t nat -I POSTROUTING -d <a href="http://192.168.2.0/24">192.168.2.0/24</a> -j SNAT --to my_ip</div><div><br></div></div><div><div>==============================================================</div><div><br></div><div>Now I'm trying to use StrongSWAN to setup a connection, but I'm not able to connect.</div><div>This is my StrongSWAN ipsec.conf:</div><div><br></div><div>==============================================================</div><div><div><br></div><div># ipsec.conf - strongSwan IPsec configuration file</div><div><br></div><div>config setup<br></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span># strictcrlpolicy=yes</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span># uniqueids = no</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>charondebug = dmn 2, mgr 2, ike 2, chd 2, job 0, cfg 2, knl 2, net 2, asn 0, enc 0, lib 0, esp 2, tls 2, tnc 2, imc 2, imv 2, pts 2</div><div><br></div><div>conn home</div><div> ikelifetime=60m</div><div> keylife=20m</div><div> rekeymargin=3m</div><div> keyingtries=1</div><div> keyexchange=ikev1</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>left=%any<br></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>leftcert=my_cert.pem<br></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>leftrsasigkey=%cert</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>leftid="my certificate subject"<br></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>#leftauth=pubkey</div><div> leftfirewall=yes</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>#<br></div><div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>leftsourceip=A.B.C.D # CP-known client IP (not necessarily my ip), I need to set it because I'm using also a "rightsubnets" list</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>leftsubnet=A.B.C.D/32 # CP-known client IP(not necessarily my ip), I need to set it because I'm using also a "rightsubnets" list</div></div><div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>#<br></div><div></div></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>rightcert=fwncest_2012-11-07_cert.pem<br></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>rightrsasigkey=%cert</div><div> right=X.Y.Z.W (FW1_IP_ADDESS)<br></div><div><div> rightid=X.Y.Z.W (I cannot use FW cert or other values, I MUST use the firewall public IP)</div><div> rightsubnet= <a href="http://192.168.1.0/24">192.168.1.0/24</a>, <a href="http://192.168.2.0/24">192.168.2.0/24</a>, ecc... </div><div> rightcert=firewall_cert.pem</div><div> rightrsasigkey=%cert</div></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>#<br></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>auto=start</div><div><div> # after establishing the vpn, run these script to allow routes from my client to server behind the firevall</div><div> #</div><div> # /sbin/iptables -t nat -I POSTROUTING -d <a href="http://192.168.1.0/24">192.168.1.0/24</a> -j SNAT --to my_ip</div><div> # /sbin/iptables -t nat -I POSTROUTING -d <a href="http://192.168.2.0/24">192.168.2.0/24</a> -j SNAT --to my_ip</div></div><div><br></div><div>include /var/lib/strongswan/ipsec.conf.inc</div></div><div><div><div><br></div></div><div></div></div><div>===========================================================================</div><div><br></div><div>But this setup is not working.</div><div>Can someone help me?</div><div><br></div><div>Thanks, larzeni</div><br>
</div></div></div>