Re: [Users] freeswan configuration issue (at least i hope so)

-----BEGIN PGP SIGNED MESSAGE----- On Thu, 13 Feb 2003, Florian Maier wrote:

> Feb 13 16:34:45 s15113721 pluto[750]: | ***parse ISAKMP Security Association
> Payload:
> Feb 13 16:34:45 s15113721 pluto[750]: | next payload type:
> ISAKMP_NEXT_NONE
> Feb 13 16:34:45 s15113721 pluto[750]: | length: 148
> Feb 13 16:34:45 s15113721 pluto[750]: | DOI: ISAKMP_DOI_IPSEC
> Feb 13 16:34:45 s15113721 pluto[750]: packet from 62.157.124.243:500:
> initial Main Mode message received on 217.160.143.112:50
> 0 but no connection has been authorized
> Feb 13 16:34:45 s15113721 pluto[750]: | next event EVENT_SHUNT_SCAN in 68
> seconds

I think you've got all the debugging options on, thus you cannot see the forest for the trees. :)

Taking a look through your barf, the problem is that the connection is never added to Pluto's database. (You can see this in the output, or lack thereof, of "ipsec auto --status".) Digging through /var/log/secure, you see this error:

Feb 13 16:11:51 s15113721 ipsec__plutorun: ipsec_auto: fatal error in "dts-schlund": %defaultroute requested but not known

Here is the connection:

conn dts-schlund

        type=tunnel
        keylife=1h
        rekey=yes
        ikelifetime=8h
        left=217.160.143.112
        #leftsubnet=192.168.101.0/24
        leftnexthop=%defaultroute
        right=62.157.124.243
        leftsubnet=192.168.101.0/24
        rightnexthop=%defaultroute
        keyexchange=ike
        auth=esp
        pfs=no
        #authorisieren und mit dem dienst starten
        auto=start

You refer to %defaultroute for your values of nexthop: however, you're not using interfaces=%defaultroute!

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

config setup

        interfaces="ipsec0=eth0"

Looking at your barf, you do have a default gateway as you're a single host. So, change this to "interfaces=%defaultroute" and you should be fine. Until the next error, at least. :)

• -- Sam Sgro sam@freeswan.org

-----BEGIN PGP SIGNATURE-----

Version: 2.6.3ia
Charset: noconv
Comment: For the matching public key, finger the Reply-To: address.

iQCVAwUBPkwQR0OSC4btEQUtAQEwgQQAyBq6XR7lSNXL8YzWvdBEOsPYkegjR8NW ToUWDe1Lt/8C52QFq/ft4OgIyGQxwvCMuWvBWsb+lX7CkItguz/+kc06oQGKo+mG Gp64e6qwpw9i3Fp/vFrE99LkWLnJjLggj0tkLdR6+nuqTHFKtaAuZASQ8Clgw5Os +7unc7Qflvg=
=MgVh
-----END PGP SIGNATURE-----