|
||||||||||
Look in the archives. About a month ago, I posted my IPSEC mono to mono setup. At least two people emailed me saying it worked for them. My monowalls are even different versions and I have no problems. (one is 1.1b16, and the other is 1.2b2) Also, don't forget to open the set a rule to allow ESP (also check the "allow fragments" for that ESP rule) to your m0n0 IP. ------------------------------------------------------------ Jason J Ellingson Technical Consultant 615.301.1682 : nashville 612.605.1132 : minneapolis www.ellingson.com jason at ellingson dot com -----Original Message----- From: Chris Breish [mailto:cbreish at pchelpservice dot com] Sent: Monday, November 15, 2004 5:00 PM To: 'Andreas Gracco' Cc: m0n0wall at lists dot m0n0 dot ch Subject: RE: [m0n0wall] m0n0wall to m0n0wall IPSec Issues I switched to main, and changed both sides to "My IP address" Still no joy... Thanks for the suggestions so far. Here is another log post of what I'm getting: m0n0wall 1: Nov 15 17:50:36 racoon: INFO: main.c:172:main(): @(#)package version freebsd-20040617a Nov 15 17:50:36 racoon: INFO: main.c:174:main(): @(#)internal version 20001216 sakane at kame dot net Nov 15 17:50:36 racoon: INFO: main.c:175:main(): @(#)This product linked OpenSSL 0.9.7d 17 Mar 2004 (http://www.openssl.org/) Nov 15 17:50:36 racoon: INFO: isakmp.c:1368:isakmp_open(): 127.0.0.1[500] used as isakmp port (fd=7) Nov 15 17:50:36 racoon: INFO: isakmp.c:1368:isakmp_open(): 10.0.1.1[500] used as isakmp port (fd=8) Nov 15 17:50:36 racoon: INFO: isakmp.c:1368:isakmp_open(): 192.168.2.2[500] used as isakmp port (fd=9) Nov 15 17:50:36 racoon: INFO: isakmp.c:1368:isakmp_open(): 68.*.*.*[500] used as isakmp port (fd=10) Nov 15 17:50:37 racoon: ERROR: pfkey.c:2292:pk_recvspddump(): such policy already exists. anyway replace it: 192.168.2.0/24[0] 192.168.2.2/32[0] proto=any dir=in Nov 15 17:50:37 racoon: ERROR: pfkey.c:2292:pk_recvspddump(): such policy already exists. anyway replace it: 10.0.0.0/24[0] 192.168.2.0/24[0] proto=any dir=in Nov 15 17:50:37 racoon: ERROR: pfkey.c:2292:pk_recvspddump(): such policy already exists. anyway replace it: 192.168.2.2/32[0] 192.168.2.0/24[0] proto=any dir=out Nov 15 17:50:37 racoon: ERROR: pfkey.c:2292:pk_recvspddump(): such policy already exists. anyway replace it: 192.168.2.0/24[0] 10.0.0.0/24[0] proto=any dir=out M0n0wall 2: Nov 15 17:50:37 racoon: INFO: main.c:172:main(): @(#)package version freebsd-20040617a Nov 15 17:50:37 racoon: INFO: main.c:174:main(): @(#)internal version 20001216 sakane at kame dot net Nov 15 17:50:37 racoon: INFO: main.c:175:main(): @(#)This product linked OpenSSL 0.9.7d 17 Mar 2004 (http://www.openssl.org/) Nov 15 17:50:38 racoon: INFO: isakmp.c:1368:isakmp_open(): 127.0.0.1[500] used as isakmp port (fd=7) Nov 15 17:50:38 racoon: INFO: isakmp.c:1368:isakmp_open(): 66.*.*.*[500] used as isakmp port (fd=8) Nov 15 17:50:38 racoon: INFO: isakmp.c:1368:isakmp_open(): 10.0.0.1[500] used as isakmp port (fd=9) Nov 15 17:50:38 racoon: ERROR: pfkey.c:2292:pk_recvspddump(): such policy already exists. anyway replace it: 10.0.0.0/24[0] 10.0.0.1/32[0] proto=any dir=in Nov 15 17:50:38 racoon: ERROR: pfkey.c:2292:pk_recvspddump(): such policy already exists. anyway replace it: 192.168.2.0/24[0] 10.0.0.0/24[0] proto=any dir=in Nov 15 17:50:38 racoon: ERROR: pfkey.c:2292:pk_recvspddump(): such policy already exists. anyway replace it: 10.0.0.1/32[0] 10.0.0.0/24[0] proto=any dir=out Nov 15 17:50:38 racoon: ERROR: pfkey.c:2292:pk_recvspddump(): such policy already exists. anyway replace it: 10.0.0.0/24[0] 192.168.2.0/24[0] proto=any dir=out Chris Breish -----Original Message----- From: Andreas Gracco [mailto:A dot Gr at ims dot ch] Sent: Monday, November 15, 2004 5:17 PM To: Chris Breish Cc: m0n0wall at lists dot m0n0 dot ch Subject: AW: [m0n0wall] m0n0wall to m0n0wall IPSec Issues Hi I had a lot of problems using Aggressive Negotiation mode, try main mode wich is also more secure. What did you use in "My identifier", I suggest to use "My IP Address" ... Andreas --------------------------------------------------------------------- To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch |