[strongSwan] Transport mode for Windows Vista/7 RoadWarriors?

[Tristan Ball]

Hi,
                Can someone tell me if the following is doable? I'd like to be able to provide a transport mode connection to a single server for a pool of Windows vista/7 road warriors - who may or may not be behind NAT depending on the day.

The end users are the roaming users for a customer of mine, and they're opposed to VPN's for complexity and maintenance reasons - however I have a need to provide secure access to applications running on a server I host for them. I had hoped to use the windows firewall connection profiles to start a tunnel mode connection, which to the end user would be essentially transparent and hopefully negate some of the pushback against VPN's.

All the strongswan documentation seems to refer to tunnel mode, and the windows examples in particular seem to hard code end point IP addresses - I don't think that's going to work for roaming users.

For my lab setup I've been attempting to start a connection using preshared keys, but I can't get past "initial Main Mode message received on 203.89.x.x:500 but no connection has been authorized with policy=PSK" in the pluto logs.

My ipsec.conf is pretty simple:

conn winclient
    type=transport
    left=%defaultroute
    right=%any
    authby=secret
    pfs=no
    auto=add

Can anyone provide assistance with this setup?

Many thanks.

Tristan


[Pronto Hosted Services]

Tristan Ball - Hosted Services Manager VIC
Pronto Hosted Services
20 Lakeside Drive, Burwood East, VIC 3151
Phone: +61 3 9887 7770 | Email: tristanb at pronto.com.au<mailto:tristanb at pronto.com.au>
Mobile: +61 408 397 473



For PHS helpdesk support, please email phs at pronto.com.au<mailto:phs at pronto.com.au>
For urgent after hours support phone: 1800 622 556





---Legal Notice---
The email message and any attachments are confidential and subject to copyright. If you are not the intended recipient, any use, interference with, disclosure or copying of this material is unauthorised and prohibited. No part may be reproduced, adapted or transmitted without the written permission of the copyright owner. If you have received this email in error, please immediately advise the sender by return email and delete the message from your system. Before opening or using attachments, check for viruses and defects. Our liability is limited to re-supplying any affected attachments.




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20111004/cbe5b975/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: phs-logo4ff.png
Type: image/png
Size: 2421 bytes
Desc: phs-logo4ff.png
URL: <http://lists.strongswan.org/pipermail/users/attachments/20111004/cbe5b975/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: personal298a.png
Type: image/png
Size: 403 bytes
Desc: personal298a.png
URL: <http://lists.strongswan.org/pipermail/users/attachments/20111004/cbe5b975/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: personal240e3.png
Type: image/png
Size: 403 bytes
Desc: personal240e3.png
URL: <http://lists.strongswan.org/pipermail/users/attachments/20111004/cbe5b975/attachment-0002.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: personal255dc.png
Type: image/png
Size: 403 bytes
Desc: personal255dc.png
URL: <http://lists.strongswan.org/pipermail/users/attachments/20111004/cbe5b975/attachment-0003.png>