Good morning, I hope this is just me being stupid; I built and deployed a new firewall for a client over the weekend (using 3.9), and testing it today I am getting error message:
but no connection has been authorized with policy=PSK This particular customer is using mac and windows to connect, so having bad experience trying to get certs working with both platforms before I wish this to be a psk connection. I have modelled my conn from a working openswan box, the logs tell me that everything is loading correctly. When I turn on plutodebug=all a connection ends with this: Sep 3 10:27:19 firewall pluto[10302]: | find_host_connection me=207.189.234.30:500 him=%any:500 policy=PSK Sep 3 10:27:19 firewall pluto[10302]: | find_host_pair_conn (find_host_connection): 207.189.234.30:500 %any:500 -> hp:none Sep 3 10:27:19 firewall pluto[10302]: | searching for connection with policy = PSK Sep 3 10:27:19 firewall pluto[10302]: | find_host_connection returns empty Sep 3 10:27:19 firewall pluto[10302]: packet from 199.247.177.61:500: initial Main Mode message received on 207.189.234.30:500 but no connection has been authorized with policy=PSK I am pretty sure, based on prior experience and doing a bit of checking on the web this morning, that the authby=secret line is supposed to authorize the connection with policy=PSK. Am I in error? Here is my config; did something change from openswan in the way I am supposed to set this up? Or maybe is there a setting I am missing? root@firewall:~# cat /etc/ipsec.conf version 2.0 config setup interfaces="%defaultroute" plutodebug=all klipsdebug=none nat_traversal=yes virtual_private=%v4:192.168.0.0/16,%v4:10.0.0.0/8,%v4:172.16.0.0/12,% v4:!192.168.191.0/24 protostack=netkey oe=off conn %default keyingtries=5 auto=start conn rw-l2tp-psk type=transport authby=secret left=199.247.234.30 leftnexthop=207.189.235.254 leftprotoport=17/%any right=%any rightprotoport=17/%any rightsubnet=vhost:%no,%priv auto=add pfs=no dpddelay=30 dpdtimeout=120 dpdaction=clear root@firewall:~# cat /etc/ipsec.secrets 207.189.234.30 %any : PSK "mysecret" -- Computerisms Bob Miller 867-334-7117 / 867-633-3760 http://computerisms.ca _______________________________________________ Swan mailing list [email protected] https://lists.libreswan.org/mailman/listinfo/swan
