Administrace komentářů

Zkousel jsem openswan - dokazu nainstalovat, ale kernel moduly (jadro 2.4 i 2.6) porad hazi segment fault, atd ...

Tak jsem zkusil Strongswan a to vypada gut. Verze 2.7.2, nicmene mam porad nekde chybu vkonfiguraci ... v certifikatech.

Tady je log:

Jul 6 10:38:03 sv pluto[4839]: | *received 252 bytes from 217.168.215.187:500 on eth0
Jul 6 10:38:03 sv pluto[4839]: | ICOOKIE: 0b 2d 8c 35 15 8e 89 7d
Jul 6 10:38:03 sv pluto[4839]: | RCOOKIE: ff 63 8c 2e ca 8f 06 1a
Jul 6 10:38:03 sv pluto[4839]: | peer: d9 a8 d7 bb
Jul 6 10:38:03 sv pluto[4839]: | state hash entry 18
Jul 6 10:38:03 sv pluto[4839]: | state object #1 found, in STATE_MAIN_I2
Jul 6 10:38:03 sv pluto[4839]: | requested CA: '%any'
Jul 6 10:38:03 sv pluto[4839]: | our certificate policy is ALWAYS_SEND
Jul 6 10:38:03 sv pluto[4839]: "net-net" #1: we have a cert and are sending it
Jul 6 10:38:03 sv pluto[4839]: "net-net" #1: unable to locate my private key for RSA Signature
Jul 6 10:38:03 sv pluto[4839]: "net-net" #1: sending encrypted notification AUTHENTICATION_FAILED to 217.168.215.187:500
Jul 6 10:38:03 sv pluto[4839]: | state transition function for STATE_MAIN_I2 failed: AUTHENTICATION_FAILED
Jul 6 10:38:03 sv pluto[4839]: | next event EVENT_RETRANSMIT in 3 seconds for #2

Pak mam jeste problem s tim, ze na tom jednom positaci, co je jadro se vytvori ipsec0 zarizeni, ale na tom co je jadro 2.6 se nevytvori zadne net zarizeni, ale obe strany spolu komunikuji, jak je videt ...

Konfig vypada takto:

# /etc/ipsec.conf - strongSwan IPsec configuration file

version 2.0 # conforms to second version of ipsec.conf specification

config setup
plutodebug=control
crlcheckinterval=180
strictcrlpolicy=no

conn net-net
left=%defaultroute
leftsubnet=192.168.1.0/24
leftcert=Cert.pem
right=85.193.29.43
rightsubnet=192.168.0.0/24
rightid="C=CZ, O=sv.centel.cz, CN=sv.centel.cz"
auto=start

Certifikaty mam na patricnych mistech, nevite, co delam spatne ??? Diky.