From: Sergey Prysiazhnyi (apelsinatmnis.com)
Date: Sun Aug 12 2007 - 17:30:11 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello community, I wana do something like:

http://openbsd.org/papers/asiabsdcon07-ipsec/mgp00065.html

I have:

cat /etc/ipsec.conf

ike dynamic from any to any \
        main auth hmac-sha1 enc aes group modp1024 \
        quick auth hmac-sha1 enc aes psk secret

; ike passive, ike passive esp, ike esp, etc - no results.

Client side:

http://www.thegreenbow.com/vpn.html

Server side:

isakmpd -4dKv && ipsecctl -F -f /etc/ipsec.conf :

143203.134966 Default isakmpd: phase 1 done: initiator id c0a80321: 192.168.3.33, responder id 5851eaa2: XX.XX.XX.XX, src: XX.XX.XX.XX dst:
++YY.YY.YY.YY
143203.154202 Default responder_recv_HASH_SA_NONCE: peer proposed invalid phase 2 IDs: initiator id c0a80321: 192.168.3.33, responder id
+0a0+10100/ffffff00: 10.1.1.0/255.255.255.0
143203.154348 Default dropped message from YY.YY.YY.YY port 59312 due to notification type NO_PROPOSAL_CHOSEN
143210.166313 Default responder_recv_HASH_SA_NONCE: peer proposed invalid phase 2 IDs: initiator id c0a80321: 192.168.3.33, responder id
+0a0+10100/ffffff00: 10.1.1.0/255.255.255.0

; In this case I'm not along:
                                      http://marc.info/?l=openbsd-misc&m=118429600703803&w=2
                                      http://marc.info/?l=openbsd-misc&m=118434909801312&w=2

Parts from /etc/pf.conf relating to Subj:

scrub in no-df

pass in on $ext_if proto udp to ($ext_if) port { 500 4500 }
pass in on $ext_if proto esp to ($ext_if)
pass on enc0

Any ideas? Thoughts? Or maybe I'm just missed something? I sincerely appreciate any assistance.
Thank you.

PS: http://www.thegreenbow.com/vpn_faq.html - done, no results.
    http://www.allard.nu/openbsd/ - done, no results.

PS2: Tried with different algorithms : 3des, aes, etc - no results. System: OpenBSD 4.1-stable.

My continued thanks for any assistance,
    
--
Sergey Prysiazhnyi

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]