Re: IPSec unspec transport

2006-07-04 Thread Massimo Lusetti
On Mon, 2006-07-03 at 03:57 -0700, Clint Pachl wrote: > Agreed, that is not suitable and I don't do that. I guess I > misunderstood the point at which your failure was occurring. I believed > it to be initially or some short time after you started each end point. > In my experience, I am using

Re: IPSec unspec transport

2006-07-03 Thread Clint Pachl
Massimo Lusetti wrote: On Mon, 2006-07-03 at 00:51 -0700, Clint Pachl wrote: Are both end points trying to negotiate? Try using the "passive" keyword on one endpoint: "ike passive esp ..." Yes both active. Does that should cause problems? Here is what I have noticed while watching tcpdump:

Re: IPSec unspec transport

2006-07-03 Thread Massimo Lusetti
On Mon, 2006-07-03 at 00:51 -0700, Clint Pachl wrote: > Are both end points trying to negotiate? Try using the "passive" keyword > on one endpoint: "ike passive esp ..." Yes both active. Does that should cause problems? > I have experienced the same issue. I don't know the details of what > ex

Re: IPSec unspec transport

2006-07-03 Thread Clint Pachl
Massimo Lusetti wrote: I got a VPN network which works quite well, i mean works very well thanks to OpenBSD and its implementation but i got one end point over the 6 running which causing me troubles. The configuration is done with ipsec.conf and is identical to others which works well. Here som

IPSec unspec transport

2006-07-03 Thread Massimo Lusetti
I got a VPN network which works quite well, i mean works very well thanks to OpenBSD and its implementation but i got one end point over the 6 running which causing me troubles. The configuration is done with ipsec.conf and is identical to others which works well. Here some example config: ike esp