Re: Re-4: VPN not working ...

You are using self-signed certs. This definitively won't
work. Please generate a self-signed root CA cert first
and then create a gateway and a client cert both signed
by this root CA.

- the root CA cert goes into /etc/ipsec.d/cacerts

- the gateway cert goes into /etc/ipsec.d/certs
   and you load it via ipsec.conf with

      leftcert=gatewayCert.pem

- the gateway private key goes into /etc/ipsec.d/private
   and you load it via ipsec.secrets with

      : RSA gatewayKey.pem "optional passphrase"

- On the windows side you install the client cert, the client
   private key and the CA cert all bundled in a .p12 file
   in the registry.

- in the Windows ipsec.conf define the root CA via

    rightca="C=.., .., CN=Root CA"

If you still have problems please generate a barf with the
debug options

    plutodebug=all

set in ipsec.conf

Regards

Andreas

[email protected] wrote:
> Hi,
> 
> here is my output from ipsec barf.
> 
> Greetings,
>   Kai
> 
> 
> --------- BARF OUTPUT ---------

> + ipsec auto --status
> 000 interface lo/lo ::1
> 000 interface lo/lo 127.0.0.1
> 000 interface eth0/eth0 192.6.2.12
> 000 interface ppp0/ppp0 80.130.191.226
> 000 %myid = (none)
> 000 debug none
> 000
> 000 "L2TP-CERT": 80.130.191.226[C=DE, O=Multinova GmbH, CN=Multinova CA]:17/1701---217.5.98.30...%any[C=DE, O=Multinova GmbH, OU=VPN, CN=VPNCA]:17/1701; unrouted; eroute owner: #0
> 000 "L2TP-CERT":   CAs: 'C=DE, O=Multinova GmbH, CN=Multinova CA'...'%any'
> 000 "L2TP-CERT":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3
> 000 "L2TP-CERT":   policy: RSASIG+ENCRYPT+TUNNEL+DONTREKEY; prio: 32,32; interface: ppp0;
> 000 "L2TP-CERT":   newest ISAKMP SA: #0; newest IPsec SA: #0;
> 000
> 000

> + _________________________ ipsec/listall
> + ipsec auto --listall
> 000
> 000 List of Public Keys:
> 000
> 000 Aug 09 08:54:43 2004, 2048 RSA Key AwEAAcRDN, until May 04 09:34:26 2007 ok
> 000        ID_DER_ASN1_DN 'C=DE, O=Multinova GmbH, CN=Multinova CA'
> 000        Issuer 'C=DE, O=Multinova GmbH, CN=Multinova CA'
> 000
> 000 List of X.509 End Certificates:
> 000
> 000 Aug 09 08:54:43 2004, count: 1
> 000        subject: 'C=DE, O=Multinova GmbH, CN=Multinova CA'
> 000        issuer:  'C=DE, O=Multinova GmbH, CN=Multinova CA'
> 000        serial:   01
> 000        pubkey:   2048 RSA Key AwEAAcRDN
> 000        validity: not before Aug 07 09:34:26 2004 ok
> 000                  not after  May 04 09:34:26 2007 ok
> 000        subjkey:  95:69:34:87:11:8c:13:ca:44:db:3b:1b:4e:e3:fc:1e:0e:2e:61:5c
> 000        authkey:  0a:f9:ce:f7:f4:fc:19:8a:e3:f9:6e:9e:f0:ec:23:d8:6f:5c:c0:24
> 000        aserial:  00
> 000
> 000 List of X.509 CA Certificates:
> 000
> 000 Aug 09 08:54:42 2004, count: 1
> 000        subject: 'C=DE, O=Multinova GmbH, CN=Multinova CA'
> 000        issuer:  'C=DE, O=Multinova GmbH, CN=Multinova CA'
> 000        serial:   00
> 000        pubkey:   2048 RSA Key AwEAAeYoP
> 000        validity: not before Aug 07 09:22:08 2004 ok
> 000                  not after  Sep 15 09:22:08 2008 ok
> 000        subjkey:  0a:f9:ce:f7:f4:fc:19:8a:e3:f9:6e:9e:f0:ec:23:d8:6f:5c:c0:24
> 000        authkey:  0a:f9:ce:f7:f4:fc:19:8a:e3:f9:6e:9e:f0:ec:23:d8:6f:5c:c0:24
> 000        aserial:  00

=======================================================================
Andreas Steffen                   e-mail: [email protected]
strongSec GmbH                    home:   http://www.strongsec.com
Alter Zürichweg 20                phone:  +41 1 730 80 64
CH-8952 Schlieren (Switzerland)   fax:    +41 1 730 80 65
==========================================[strong internet security]===