Re: Doubt with IPSEC

2012-07-12 Thread Rodrigo Mosconi
2012/7/12 Christian Weisgerber : > Rodrigo Mosconi wrote: > >> ike esp transport from hubble to spitzer \ >> main \ >> auth hmac-sha2-512 \ >> enc aes-256 \ >> group modp4096 \ >> srcid hubble.domain \ >> dstid spitzer.domain \ >> psk >> '/+

Re: Doubt with IPSEC

2012-07-12 Thread Christian Weisgerber
Rodrigo Mosconi wrote: > ike esp transport from hubble to spitzer \ > main \ > auth hmac-sha2-512 \ > enc aes-256 \ > group modp4096 \ > srcid hubble.domain \ > dstid spitzer.domain \ > psk '/+V1gt9G6FTQ"_}/Rn#nny!ZCgmd5+jIe^dKXf+)40R6%ZS(zD

Re: Doubt with IPSEC

2012-07-11 Thread Rodrigo Mosconi
2012/7/11 Paulm : > One of the two hosts needs to use 'passive' in ipsec.conf so that > it acts as server and listens/responds to incoming requests from peers. > > > > On Wed, Jul 11, 2012 at 02:23:13PM -0300, Rodrigo Mosconi wrote: >> Hi, >> >> I`m having a problem to establish a IPSEC transport b

Re: Doubt with IPSEC

2012-07-11 Thread Paulm
One of the two hosts needs to use 'passive' in ipsec.conf so that it acts as server and listens/responds to incoming requests from peers. On Wed, Jul 11, 2012 at 02:23:13PM -0300, Rodrigo Mosconi wrote: > Hi, > > I`m having a problem to establish a IPSEC transport between two > openbsd hosts (o

Re: Doubt with IPSEC

2012-07-11 Thread Paulm
I would suggest passing the -vL option to iskampd. -v enables verbose logging which will report errors when trying to setup the SA. The -L option will create pcap file in /var/run which contains the packets exchanged to set up the SA. If you look at this pcap file w/ the verbose (-vv) option to