Tag Info

New answers tagged

0

Always make sure to disable the Source/Destination check on your Openswan instance. I see no mention of that being done.


0

Here is working part for ipsec setup from Mikrotik in IPSEC transport mode: admin@MikroTik] > /ip ipsec policy print Flags: T - template, X - disabled, D - dynamic, I - inactive, * - default 0 TX* group=default src-address=::/0 dst-address=::/0 protocol=all proposal=default template=yes 1 src-address==%MIKROTIK EXTERNAL IP%/32 src-port=any ...


-1

(The IPSEC VPN client was neither available, nor of any use for their configuration) Our solution, in the hops of allowing other people to figure this out without banging their heads against the wall for 3 days: Install openswan ( https://www.openswan.org/ ) to an intermediary linux box. Having tried 5 different VPN software on Windows, openswan appears ...


1

I had this same situation and fixed it by doing adding the policy from the SSL.vpn interface to the IPsec tunnel interface and then from the IPsec tunnel interface back to the SSL.vpn interface. The issue is what interfaces the traffic is allowed on. It will not hairpin to an interface that is not defined in a policy.


1

I had a similar problem. Connecting to a cisco VPN, sshing in to the remote machine and simply running ps aux would just completely freeze my session. The solution was indeed to tune the MTU. On CentOS you have to run ip addr to figure out the current MTU of your different network adapters. And you can change them via sudo ip link set eth0 mtu 1300 (this ...


1

According to this post on the Opensswan mailing list, the error is caused by an old perl version and can be ignored.


0

It seems you've run into the conundrum of bad Fortinet jargon. You want to NAT the source IP of IPsec packets? Oh... that'll be the Local Gateway Address. Jokes aside, it seems that your config is good, except for that darn IPsec NAT setting. Given: Internal src address => IPsec packets (qualified by src/dst) ~~ NATed to a public IP => ISP router ...


1

The path of least resistance is to ask the people who manage the destination firewall for a copy of the Cisco IPSEC VPN client or for access using an SSL AnyConnect VPN. See if they can provide a PCF configuration file to you.



Top 50 recent answers are included