[Vpn-help] Help needed to configure Windows client

Mustafa Jamil mustafa_jamil at yahoo.com
Fri Apr 18 17:32:47 CDT 2008


Hello folks.

I am an IPSec newbie (which explains why I'm having to post on this list) that is trying to map configuration between what I enter in /etc/ipsec.conf on a linux system and what goes into the GUI in the ShrewSoft VPN Client.  I'm failing to get anywhere.

Here's my (very simple) ipsec.conf:

-- START --
#!/usr/sbin/setkey -f

# Flush the SAD and SPD
flush;
spdflush;

add 10.20.128.217 10.17.26.90 ah 0x200 -A hmac-md5 
0xa731649644c5dee92cbd9c2e7e188ee6;
add 10.17.26.90 10.20.128.217 ah 0x300 -A hmac-md5 
0x27f6d123d7077b361662fc6e451f65d9;

add 10.20.128.217 10.17.26.90 esp 0x201 -E 3des-cbc 
0x656c8523255ccc23a66c1917aa0cf30991fce83532a4b224;
add 10.17.26.90 10.20.128.217 esp 0x301 -E 3des-cbc
0xc966199f24d095f3990a320d749056401e82b26570320292;

spdadd 10.20.128.217 10.17.26.90 any -P out ipsec
           esp/transport//require
           ah/transport//require;

spdadd 10.17.26.90 10.20.128.217 any -P in ipsec
           esp/transport//require
           ah/transport//require;
-- END --

As you can tell, I'm using AH to authenticate, and ESP to encrypt, data between two hosts in transport mode.  The keys are manually provided in the file, so no IKE processing is necessary.

If my destination host is a linux box, enabling this configuration is trivial: I just copy this file to that machine, switch the in/out params in the policy statements, and voila - things work.

But I'm baffled with how to enable this simple configuration through the Windows ShrewSoft VPN Client GUI.

Can someone please help me out?

Thanks!

Mustafa

P.S.  Separate question: does the Unix client work on the BSD-derived Mac OS X Mach kernel?





      ____________________________________________________________________________________
Be a better friend, newshound, and 
know-it-all with Yahoo! Mobile.  Try it now.  http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ



More information about the vpn-help mailing list