Hi,
ok. After I have lost nearly all of my nerves, I get the configuration
ASL --------------- RW(Openswan)
running (certificates using now E-Mail identifier). But with big and bad limits which makes this unusable at the moment.
This is because the connection can only be established, if the remote subnet is set to none, and I'm not using any virtual ip (but needed for NAT-T). Also routing into a complete network segment (for example 192.168.0.0/24 from an openswan client 192.168.1.11) result in a for example
" cannot respond to IPsec SA request because no connection is known for 192.168.0.1[postmaster@obster.org
]...192.168.0.4[michael@obster.org]===10.74.175.0/24"
This is from an internal test, if someone wonders about the IP.
So what the *** is missing in my configuration of the roadwarrior (openswan 2.4.6 (klips))?
Config:
---------------------------------------------------------------------------
version 2
config setup
interfaces=%defaultroute
nat_traversal=no #disabled this one temporarily because not needed for testing
conn %default
keyingtries=1
compress=yes
authby=rsasig
leftrsasigkey=%cert
rightrsasigkey=%cert
conn roadwarrior-wlan
leftsubnet=10.74.175.2/32
also=roadwarrior
conn roadwarrior-net
leftsubnet=192.168.0.0/255.255.255.0
also=roadwarrior
conn roadwarrior
left=%defaultroute
leftcert=CERTIFICATE_VPN-Road1.pem
leftid=michael@obster.org
right=192.168.0.1
rightcert=CERTIFICATE_VPN-Out1.pem
rightid=postmaster@obster.org
auto=add
pfs=yes
conn block
auto=ignore
conn private
auto=ignore
conn private-or-clear
auto=ignore
conn clear-or-private
auto=ignore
conn clear
auto=ignore
conn packetdefault
auto=ignore
---------------------------------------------------------------------------
So the only established connection is the roadwarrior, roadwarrior-net and roadwarrior-wlan doesn't work :-(.
Anyone who has some help for me?
Regards,
Michael
This thread was automatically locked due to age.
