This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problems with IPSEC! V 4

Hello,

i update from 3.17 to 4.0. After the update i have the problem that my vpn connections to my customer with checkpoint an cisco pix don´t work. Connections to linux with freeswan works without problem. In the log i see this message: ignoring informational payload, type NO_PROPOSAL_CHOSEN

anyone an idea ?
It´s very important for me...

Michael

This thread was automatically locked due to age.

0 ECKEROTH over 22 years ago

Same problem here, with a FW-1. Please read: https://community.sophos.com/products/unified-threat-management/astaroorg/f/51/t/19728
Cancel
Vote Up 0 Vote Down

Cancel
0 mpeter over 22 years ago in reply to ECKEROTH

Hi,

with version 3.17 all connections works without problems.........

what says astaro to this problems ?
Cancel
Vote Up 0 Vote Down

Cancel
0 mpeter over 22 years ago in reply to mpeter

Hello!

I have find the problem!!! I have add a connection to ipsec.conf-default:

conn customer_1
        type="tunnel"
        keyexchange="ike"
        keylife="3600"
        ikelifetime="28800"
        esp="3des-md5"
        ike="3des-md5"
        pfs="no"
        left="xxx.xxx.xxx.xxx"
        right="xxx.xxx.xxx.xxx"
        leftupdown="/opt/_updown 2>/tmp/log 1>/tmp/log"
        rightupdown="/opt/_updown 2>/tmp/log 1>/tmp/log"
        auto="start"
        leftsubnet="192.168.xxx.xxx/255.255.255.0"
        rightsubnet="172.16.xxx.xxx/255.255.255.0"
        leftid="xxx.xxx.xxx.xx"
        rightid="xxx.xxx.xxx.xxx"
        authby="secret"

Astaro set in there configuration ike="3des-md5-modp1024".
Without "-modp1024" all my connections to cisco, checkpoint and freewan works!!!!

Michael
Cancel
Vote Up 0 Vote Down

Cancel
0 Marcel_01 over 22 years ago in reply to mpeter

so try editing your ipsec-policies ... some new algo's have been added...

please try changing dh-group / auth algo...

/marcel
Cancel
Vote Up 0 Vote Down

Cancel
0 mpeter over 22 years ago in reply to Marcel_01

Which DH Group must i select ?

if i select dh group 1 the middleware set in ipsec.conf 3des-md5-modp768
if i select dh group 2 the middleware set in ipsec.conf 3des-md5-modp1024 and so ...

michael
Cancel
Vote Up 0 Vote Down

Cancel
0 Marcel_01 over 22 years ago in reply to mpeter

you should select the same as on your remote endpoint !?
Cancel
Vote Up 0 Vote Down

Cancel
0 ECKEROTH over 22 years ago in reply to Marcel_01

When will this be fixed ?
Cancel
Vote Up 0 Vote Down

Cancel
0 Marcel_01 over 22 years ago in reply to ECKEROTH

we'll take out the pfsgroup when no pfs is selected.. this should be fixed in an up2date... (can't tell you _when_ exactly, sorry)

/marcel
Cancel
Vote Up 0 Vote Down

Cancel
0 pablito over 22 years ago

I'm trying to resurect a Linux FreeSwan box for a net-net with ASL.  I have the latest 2.4 kernel and 1.99 FreeSwan installed and need the best config that works against the latest ASL 3.

Could you post your FreeSwan config please?  I'm using RSA and FQDN on ASL-ASL.

thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 Marcel_01 over 22 years ago in reply to pablito

configure ASL and have a look at /var/chroot-ipsec/etc/ipsec.conf ...

hth
/marcel
Cancel
Vote Up 0 Vote Down

Cancel