From owner-freebsd-questions Wed Jul 31 4:29:42 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5197137B400 for ; Wed, 31 Jul 2002 04:29:39 -0700 (PDT) Received: from fep6.cogeco.net (smtp.cogeco.net [216.221.81.25]) by mx1.FreeBSD.org (Postfix) with ESMTP id C44F043E6A for ; Wed, 31 Jul 2002 04:29:38 -0700 (PDT) (envelope-from dlavigne6@cogeco.ca) Received: from d226-33-213.home.cgocable.net (d226-33-213.home.cgocable.net [24.226.33.213]) by fep6.cogeco.net (Postfix) with ESMTP id A965D580D; Wed, 31 Jul 2002 07:29:37 -0400 (EDT) Date: Wed, 31 Jul 2002 07:34:58 -0400 (EDT) From: Dru X-X-Sender: dlavigne6@x1-6-00-80-c8-3a-b8-46.kico2.on.cogeco.ca To: Cezary Nolewajka Cc: freebsd-questions@FreeBSD.ORG Subject: Re: FreeBSD and CISCO Pix IPSec VPN - problem (long) In-Reply-To: <003301c2385c$29d1fed0$6500000a@getin.corp> Message-ID: <20020731072720.L596-100000@x1-6-00-80-c8-3a-b8-46.kico2.on.cogeco.ca> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Wed, 31 Jul 2002, Cezary Nolewajka wrote: > Hello everybody, > > I have a general problem setting up a IPSec VPN connection between freebsd > and a cisco router/pix. > > I got to the stage where both machines can see each other, start the > negotiation phase 1 that succeeds and fail at the stage 2. The racoon -F > info says that get_ph2approvalx(): not matched and therefore no policy is > found. > > It seems that I have a problem with my or Pixes configuration. I browsed all > the net > archives and pages I could have found on the VPN/IPSec freebsd installation > and configuration and failed to find a solution. > > If there is anything that you could suggest or even solved such a problem, I > would be grateful for any kind of help or support. > > Below I attached some of the configuration and debugging information > concerning the IPSec setup. Hello Cezary, On the PIX configs, make sure you use both the "no-xauth" and "no-config-mode" options on the "isakmp key" and "isakmp peer" commands as forgetting those will hang Phase 2 negotiations. If you're still stuck, write me off list and I'll send you the configs for a working tunnel. Dru To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message