No anyone have good news?
I try write here what is my point (maybe i repeat something that other just write, but excuse me in this way we have all here).
1) in my opinion, the config web interface, related to the IPSec VPN Config, is very poor in this version: if you make a change in web interface, the configuration files not change
2) ipsec configuration option is based on 1 file:
/etc/ipsec/ipsec.conf3) all the time that the system reboot,
/etc/ipsec/ipsec.conf is recreated from
/etc/ipsec/ipsec.conf.tmpl ... so, if you desire modify the
/etc/ipsec/ipsec.conf structure, you must modify
/etc/ipsec/ipsec.conf.tmpl first
4) if you change some configuration parameter of the VPN connection, the Web Interface is not able to change the configuration file of the connection, from where
/etc/ipsec/ipsec.conf.tmpl pick-up all the parameter for create
/etc/ipsec/ipsec.conf ... this file is
/var/efw/vpn/config ... one-line for any VPN Connection configured
With this 4 point in mind, the first i realize is that the "
leftnexthop" parameter in the
/etc/ipsec/ipsec.conf is deprecated (i realize this because i try start and stop ipsec from the shell, and see the messages).
So, i must change mannually
/etc/ipsec/ipsec.conf.tmpl and remove all the "
leftnexthop" line and add "
modeconfig=push" line (follow an extract of the new section):
conn $conn.name
dpdaction=$conn.dpd_action
#if $conn.interface == 'GREEN'
left=$GREEN_ADDRESS
modeconfig=push
#end if
#if $conn.interface == 'BLUE'
left=$BLUE_ADDRESS
modeconfig=push
#end if
#if $conn.interface == 'ORANGE'
left=$ORANGE_ADDRESS
modeconfig=push
#end if
#if $conn.interface.startswith('UPLINK:')
left=$conn.uplink.IP
modeconfig=push
#end if
All the "if entry" are usefull for retrive parameter about the "Uplink" you choose from the web interface when you configure the VPN Connection (or from the
/var/efw/vpn/config file)
1,on,yyyyyyyy,,net,psk,xxxxxxxxxxxxxx,,LLLLLLLLLLL,ll.ll.ll.ll/24,RRRRRRRRR,rr.rr.rr.rr,rr.rr.rr.rr/24,off,off,off,off,1,8,aes128|3des,sha1|md5,1536|1024,aes128|3des,sha1|md5,1536|1024,off,Comment,UPLINK:main,restart,off,,1
After all this, i can see from ssh shell, with
ipsec statusall command, that the VPN Connection is "Established" from all two the Endian:
Status of IKE charon daemon (weakSwan 5.1.1, Linux 2.6.32.43-57.e51.i586, i686):
uptime: 26 minutes, since May 14 18:57:13 2014
malloc: sbrk 262144, mmap 0, used 173776, free 88368
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 11
loaded plugins: charon curl ldap aes des blowfish rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem fips-prf gmp agent xcbc cmac hmac attr kernel-netlink resolve socket-default farp stroke updown eap-identity eap-sim eap-aka eap-aka-3gpp2 eap-simaka-pseudonym eap-simaka-reauth eap-md5 eap-gtc eap-mschapv2 eap-radius xauth-generic xauth-pam dhcp lookip addrblock
Listening IP addresses:
xx.xx.xx.xx
yy.yy.yy.yy
zz.zz.zz.zz
Connections:
name: xx.xx.xx.xx ...right IP IKEv1, dpddelay=30s
name: local: [left] uses pre-shared key authentication
name: remote: [right] uses pre-shared key authentication
name: child: local network/24 === remote network/24 TUNNEL, dpdaction=restart
Security Associations (1 up, 0 connecting):
name[1]: ESTABLISHED 24 minutes ago, xx.xx.xx.xx[left]...remote Ip[right]
name[1]: IKEv1 SPIs: jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj, pre-shared key reauthentication in 22 minutes
name[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
name[1]: Tasks queued: QUICK_MODE
.... but all this is not sufficient, i continue to not be able to ping the remote side (i try ping all GREEN interface from one firewall shell to the other, and not works).
I hope that anyone that know IPSec VPN better than me, can understand what else the Web Interface not setup correctly.
P.S. another thing is: i try make Net-Net VPN Ipsec from an Endian Mercury 50 and one of this Community version. At the start i've the same problem. I open a ticket, the support team was connect ONLY TO THE MERCURY, make some settings and the VPN start work. They say that only force the IKE protocol on version 1 and all start work .... but here is not the solution.
Author