Re: [Design] Re: [Users] multiple ipsec.secrets entries

On Wed, 26 Feb 2003, Paul Wouters wrote:

Doing a followup on my own ramblings:  

> However, I believe that scheme is no longer properly functioning, though

Adding a @FQDN to the normal secret works in that OE connections work again, so changing:

: RSA { to:

@plaything.xtdnet.nl: RSA {

Fixes that, but still causes the wrong things for the x509, which seems to be fighting with the OE conn:

Feb 26 16:23:22 plaything pluto[16270]: packet from 159.18.124.34:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
Feb 26 16:23:22 plaything pluto[16270]: packet from 159.18.124.34:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
Feb 26 16:23:22 plaything pluto[16270]: packet from 159.18.124.34:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
Feb 26 16:23:22 plaything pluto[16270]: "roadwarrior"[1] 159.18.124.34 #13: responding to Main Mode from unknown peer 159.18.124.34
Feb 26 16:23:22 plaything pluto[16270]: "roadwarrior"[1] 159.18.124.34 #13: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
Feb 26 16:23:22 plaything pluto[16270]: "roadwarrior"[1] 159.18.124.34 #13: Peer ID is ID_DER_ASN1_DN: 'C=CA, L=Toronto, O=Freeswan Project, CN=laptop.freeswan.ca, E=kenb@freeswan.ca'
Feb 26 16:23:22 plaything pluto[16270]: "eth0_2-to-anyone"[1] 193.110.157.14/32=== ...159.18.124.34===? #13: deleting connection "roadwarrior" instance with peer 159.18.124.34
Feb 26 16:23:22 plaything pluto[16270]: | NAT-T: new mapping 159.18.124.34:500/4500)
Feb 26 16:23:22 plaything pluto[16270]: "eth0_2-to-anyone"[1] 193.110.157.14/32=== ...159.18.124.34===? #13: sent MR3, ISAKMP SA established
Feb 26 16:23:23 plaything pluto[16270]: "eth0_2-to-anyone"[1] 193.110.157.14/32=== ...159.18.124.34===? #13: Informational Exchange message for an established ISAKMP SA must be encrypted
Feb 26 16:23:33 plaything pluto[16270]: "eth0_2-to-anyone"[1] 193.110.157.14/32=== ...159.18.124.34===? #13: retransmitting in response to duplicate packet; already STATE_MAIN_R3
Feb 26 16:23:33 plaything pluto[16270]: "eth0_2-to-anyone"[1] 193.110.157.14/32=== ...159.18.124.34===? #13: Informational Exchange message for an established ISAKMP SA must be encrypted
Do you need help?
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software:
Learn more about Pantek's Technical Support offerings
Place an order for 24/7/365 Technical Support here
Learn more about Pantek, who we are, and what we do
Chat with a Live Operator
Related lists.freeswan.org Links
1998-fall
1998-spring
1998-summer
1998-winter
1999-winter
announce
briefs
bugs
design
freeswan-list
hipsec
ietf-sectest
users
users-admin
Request more information about Pantek
Feb 26 16:26:07 plaything pluto[16270]: "eth0_2-to-anyone"[1] 193.110.157.14/32=== ...159.18.124.34===?: deleting connection "eth0_2-to-anyone" instance with peer 159.18.124.34

Trying to add the x509 ID in ipsec.secrets seems to die on the space in the O= section:

Feb 26 16:32:52 plaything pluto[19432]: "/etc/ipsec.secrets" line 1: unknown OID in ID_DER_ASN1_DN "@"C=NL,L=Amsterdam,O=Xtended"
Feb 26 16:32:52 plaything pluto[19432]: "/etc/ipsec.secrets" line 1: unknown OID in ID_DER_ASN1_DN "Internet,CN=plaything.xtdnet.nl,"
Feb 26 16:32:52 plaything pluto[19432]:   loaded private key file '/etc/ipsec.d/private/plaything.xtdnet.nl.key' (951 bytes)

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

So, I'm still not sure how to combine OE+x509 based connections where leftid='s are different and the connections are being made *at the same time* (active OE initiating on incoming x509 request)

Paul