Re: linux-ipsec: Pluto/IKE policy configuration?

| From: Ian Calderbank <ianc@uk.uu.net>
|
| I ran into a snag when trying to esablish isakmp via pluto to a Cisco

Yes.

| If so then this causes me a problem, as the

Pluto can support plain DES.

What hashing does your router support? Pluto will only work with MD5 or SHA1.

| From ipsec_pluto manpage:

The proposals are generated from tables in spdb.c. These tables are initialized variables. You need to change the initializers.

There are two kinds of proposals: one for Main Mode, and one for Quick Mode. Main Mode proposals cover the IKE communication; Quick Mode proposals cover the IPsec communication.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

The Main Mode proposal is generated from the value ot the variable oakley_pc. It makes more sense to add an entry to oakley_trans, which is a list of alternatives in preference order. Add a line something like

        { KEY_IKE, AD(ot1024desmd5) },
as an additional alternative (perhaps after line 137). For this to work, there must be a definition for ot768desmd5; there is, but it is suppressed by a "#if 0" -- change that to "#if 1" (line 75).

The Quick Mode proposal is generated from the value of the variable ipsec_sadb, an array subscripted by the "goal". If you don't specify --encrypt to whack, no encryption will be used. (If you wanted encryption, you wouldn't want 3DES :-). If you do want 3DES, you could replace every "ESP_3DES" in lines 182 to 196 with "ESP_DES".

[None of this advice is tested!]

Hugh Redelmeier
hugh@mimosa.com voice: +1 416 482-8253 Received on Wed Dec 23 18:49:29 1998