Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to setup IPSec between 2 VM launched by OpenNebula. I'm using OpenSWAN for that. This is the ipsec.conf file

config setup        

conn host-to-host

    left= # Local IP address
    right= # Remote IP address
    ike=aes128 # IKE algorithms (AES cipher)
    esp=aes128 # ESP algorithns (AES cipher)

I'm able to establish the connection with netkey but klips doesnt work.

ipsec barf shows

#71: ERROR: asynchronous network error report on eth0 (sport=500) for message to port 500, complainant No route to host [errno 113, origin ICMP type 3 code 1 (not authenticated)]

Tcpdump shows

22:50:20.592685 IP > isakmp: phase 1 I ident
22:50:25.602182 ARP, Request who-has tell, length 46
22:50:26.602082 ARP, Request who-has tell, length 46
22:50:27.601985 ARP, Request who-has tell, length 46

ipsec eroute shows

0    ->    => %trap

What could be the problem?

share|improve this question

Depending on your kernel you might need a patch. Newer kernels come with NETKEY support by default

To enable only NETKEY use protostack=netkey

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.