(racoon 827) RE: Windows XP Road Warrior with x509 and/or PSK

Many thanks, I finally got my head around how the certificates work, how to
generate them and got Racoon working perfectly. The documentation below was
an invaluable source, together with the information at
'www.ipsec-howto.net'...

I'm going to try create a mini step by step 'guide' to hopefully make life
easier for other people in the future (I usually learn best if I can
implement a working configuration and then make modifications from there)...


Syrex Intranets - Customised Solutions

	David Herselman	 
	Systems Engineer
 	
	cell	 +27 (0)82 784 7222
	tel	 +27 (0)86 11 syrex (79739)
	fax	 +27 (0)86 12 syrex (79739)
	27 7th avenue parktown north 2193
	email [email protected]
	www.syrex.co.za 

-----Original Message-----
From: Roland Dirlewanger [mailto:[email protected]] 
Sent: 21 October 2004 10:36 AM
To: [email protected]
Cc: [email protected]
Subject: Re: (racoon 817) Windows XP Road Warrior with x509 and/or PSK

Jacco De Leeuw wrote a very good step by step guide for installing and
configuring FreeSwan  with L2TP/IPsec clients. The part concerning the
clients is not tighted to any ISAKMP or IPsec implementation. It contains a
chapter named "Importing certificates (Windows 2000/XP)" in the following
page :

http://www.jacco2.dds.nl/networking/win2000xp-freeswan.html

>Problem is that both the host and the client machine are on Dynamic IPs 
>so I can not simply use the local security policy to activate the 
>certificate on the IPSec link based on the IP filter...
>  
>
Your racoon.conf has  "generate_policy on" in phase 1. On a server with a
fixed address, this  generates the correct policy, so there's no need to
bother with setting the policy in  any other script. IMHO, it should also
work in your case.