Re: [leaf-user] Follow Up To: DS2.2.20+FS1.99+WIN2K = Tunnelled butcan't ping

[Charles Steinkuehler]

Victor B. Berdin wrote:

Hello everyone,

...and here are snips from my barf, wherein the last 2 lines of my auth.log
suggests a known problem with WIN2K being able to operate using 3DES,
then secretly revert to 1DES as discussed in this link:
http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/07/msg00151.html.

But I'm under the impression that this only happens if I hadn't installed
SP2.
Actually I've installed SP3 along with ALL other patches available for my
WIN2K machine as recommended by Win Update.

As mentioned before, I don't think this is your problem, or you wouldn't be negotiating an SA.

I'd be more concerned about the last log message, where FreeS/WAN is ignoring something from the windows box...you might have some incompatible feature enabled, or required feature disabled on the windows side.

Any hints as to what else I can try out to fix this? Using third party tools
such
as ssh sentinel (w/c looks very promising) or pgpnet is currently not an
option
(as these are commercial wares).

Have you been to any of the windows <> FreeS/WAN interop sites where they post HOWTO's for getting windows IPSec setup properly? Read through the interop docs on the FreeS/WAN site?

And btw, is l2tp a stable alternative to this? Along with l2tpd in Linux?
Any
comments about l2tp?

l2tp is *NOT* a vpn protocol. It is a protocol to "bridge" two remote networks at the wire level (Level 2 tunneling protocol), allowing Microsoft to send broadcast packets across a WAN that is typically tunneled inside a VPN protocol (like ipsec).

I suggest staying away from l2tp unless absolutely required.

--
Charles Steinkuehler
[EMAIL PROTECTED]




-------------------------------------------------------
This SF.NET email is sponsored by: FREE SSL Guide from Thawte
are you planning your Web Server Security? Click here to get a FREE
Thawte SSL guide and find the answers to all your SSL security issues.
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0026en
------------------------------------------------------------------------
leaf-user mailing list: [EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/leaf-user
SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html