(racoon 817) Windows XP Road Warrior with x509 and/or PSK

Greetings, I've recently started playing with the KAME-tools and back ported
2.6 IPSec stack that RedHat includes in RHEL3 (running Tao Linux which is a
RHEL 'clone').

I'm really battling with 2 problems and haven't been able to find self-help
available on the net after searching for close on 2 days...

I'm battling with 2 'problems' at the moment:

1. Whilst I get PSK authentication working perfectly I still need to
manually update the psk.txt file every time my IP address changes on the
roaming machine. Is there no way I can configure racoon or Windows XP to
supply a set identification string and/or get the psk.txt file to match on
wildcards?

i.e.: instead of:
      '165.165.169.160      sharedpskpassword'
      having something like
      '165.165.0.0/16      sharedpskpassword'


2. I next tried getting x509 certificates to work with the Windows XP
roaming machine. I've followed several documents on how to create the
relevant certificates but none of them show the required steps in how one
gets Windows XP to 'bind' the certificate to the required VPN connection...
Windows XP doesn't even attempt the connection out as it can not locate the
right certificate.

I found some reference to a 'mini-HOWTO with Windows XP using certificates'
but the domain doesn't exist anymore... Would someone possibly still have
this document lying around? Broken link:
http://www.fatcanary.com.au/docs/xp_freebsd_cert_ipsec.txt

Problem is that both the host and the client machine are on Dynamic IPs so I
can not simply use the local security policy to activate the certificate on
the IPSec link based on the IP filter...


My Configuration:

I assume everything is setup ok otherwise I wouldn't be able to connect
using PSK (although I have to manually update the /etc/racoon/psk.txt file
with my current IP address before attempting to establish the relevant IPSec
connection.

ADSL connection runs /etc/ppp/ip-up.local as and when the IP changes, the $4
gets replaced with the current IP address
------------------ begin ------------------
#!/bin/sh
/sbin/setkey -FP;
/sbin/setkey -F;
/sbin/setkey -c << EOF
spdadd $4[1701] 0.0.0.0/0[0] any -P out ipsec esp/transport//require;
EOF
------------------ end ------------------

My /etc/racoon/racoon.conf file:
------------------ begin ------------------
path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";

#log debug;

padding {
        randomize on;           # enable randomize length.
        maximum_length 20;      # maximum padding length.
        exclusive_tail on;      # extract last one octet.
        strict_check off;       # enable strict check.
}

remote anonymous {
        exchange_mode aggressive,main;
        passive on;
        doi ipsec_doi;
        generate_policy on;
        proposal_check obey;
        lifetime time 21600 sec;
#       certificate_type x509 "vpn-gateway.cert" "vpn-gateway.key";
#       peers_certfile "remote.cert";
#       my_identifier asn1dn;
#       peers_identifier asn1dn;
        proposal {
                encryption_algorithm 3des;
                hash_algorithm sha1;
                authentication_method pre_shared_key;
#               authentication_method rsasig;
                dh_group modp1024;
        }
}

sainfo anonymous {
        pfs_group modp1024;
        lifetime time 21600 sec;
        encryption_algorithm 3des, blowfish 448, rijndael;
        authentication_algorithm hmac_sha1, hmac_md5;
        compression_algorithm deflate;
}
------------------ end ------------------



Syrex Intranets - Customised Solutions

	David Herselman
	Systems Engineer
 	
	cell	 +27 (0)82 784 7222	
	tel	 +27 (0)86 11 syrex (79739)
	fax	 +27 (0)86 12 syrex (79739)
	27 7th avenue parktown north 2193
	email [email protected]
	www.syrex.co.za