Hello community, I wana do something like:
http://openbsd.org/papers/asiabsdcon07-ipsec/mgp00065.html
I have:
cat /etc/ipsec.conf
ike dynamic from any to any \
main auth hmac-sha1 enc aes group modp1024 \
quick auth hmac-sha1 enc aes psk secret
; ike passive, ike passive esp, ike esp, etc - no results.
Client side:
http://www.thegreenbow.com/vpn.html
Server side:
isakmpd -4dKv && ipsecctl -F -f /etc/ipsec.conf :
143203.134966 Default isakmpd: phase 1 done: initiator id c0a80321:
192.168.3.33, responder id 5851eaa2: XX.XX.XX.XX, src: XX.XX.XX.XX dst:
++YY.YY.YY.YY
143203.154202 Default responder_recv_HASH_SA_NONCE: peer proposed invalid phase
2 IDs: initiator id c0a80321: 192.168.3.33, responder id
+0a0+10100/ffffff00: 10.1.1.0/255.255.255.0
143203.154348 Default dropped message from YY.YY.YY.YY port 59312 due to
notification type NO_PROPOSAL_CHOSEN
143210.166313 Default responder_recv_HASH_SA_NONCE: peer proposed invalid phase
2 IDs: initiator id c0a80321: 192.168.3.33, responder id
+0a0+10100/ffffff00: 10.1.1.0/255.255.255.0
; In this case I'm not along:
http://marc.info/?l=openbsd-misc&m=118429600703803&w=2
http://marc.info/?l=openbsd-misc&m=118434909801312&w=2
Parts from /etc/pf.conf relating to Subj:
scrub in no-df
pass in on $ext_if proto udp to ($ext_if) port { 500 4500 }
pass in on $ext_if proto esp to ($ext_if)
pass on enc0
Any ideas? Thoughts? Or maybe I'm just missed something? I sincerely appreciate
any assistance.
Thank you.
PS: http://www.thegreenbow.com/vpn_faq.html - done, no results.
http://www.allard.nu/openbsd/ - done, no results.
PS2: Tried with different algorithms : 3des, aes, etc - no results. System:
OpenBSD 4.1-stable.
My continued thanks for any assistance,
--
Sergey Prysiazhnyi
