OpenBSD 5.1 ipsec pre-shared key not sending?

[sparky]

Hi,

I recently managed to configure an IPSEC over GRE tunnel between a Cisco router and OpenBSD 5 RELEASE 64bit edition.


I am now attempting to do the same between OpenBSD 5.1 x64 RELEASE however, the router is complaining that OpenBSD isn't sending the 'pre-shared-key'???


My previous posting for the initial configuration was here:

http://www.daemonforums.org/showthread.php?t=6911


ipsec.conf file having permissions 600 has this inside it:

ike esp from 0.0.0.0/0 to 0.0.0.0/0 peer 192.168.0.1 main auth hmac-md5 enc 3des group modp1536 \
quick auth hmac-md5 enc 3des psk "secret"

the "secret" after "psk" has been put in properly however, for some reason the Cisco is complaining that it isn't being sent?

This is a different router using a different IOS version so that might have something to do with it. though it is unlikely as the configuration of both systems is the same with only the IP addresses and pre-shared-key different.


Outside of /var/log/daemon where does ipsec and isakmp log to?


Can anyone help me out or suggest anything?


Thanks.

[jggimi]

I recommend polling a wider audience. IPSec use among active members here is relatively tiny, and our knowledge thin. *

Consider posting to the misc@ mailing list. See http://www.openbsd.org/mail.html for guidance if you are unfamiliar with the Project mailing lists.

* I use IPSec, but I employ simple ipsec.conf(5) configurations, and neither gre(4) nor Cisco products are involved.

[sparky]

Ok thanks!

I have used the misc mailing list before but it's not that welcoming and can be quite a hostile environment.

[ocicat]

Originally Posted by sparky

I have used the misc mailing list before but it's not that welcoming and can be quite a hostile environment.

Perhaps, & especially for those who have not done their homework, but those who can articulate their situations with technical accuracy, the depth of knowledge expressed by the developers is not seen anywhere else.

[sparky]

I understand that however, if someone is inexperienced and hasn't been around for long a lot of mistakes can be made or confusion caused.


I do accept though that research should be done so that one ends up giving as much information as possible otherwise how can someone trying to help 'read the OP's mind'.

And yeah the level of knowledge is exceptionally high! ....it's almost scray


As to my issue, considering nothing on the ipsec.conf part changed from OpenBSD 5.0 to 5.1, the problem might be the Cisco IOS itself.

The Cisco device does seem to be behaving strangely when put into certain senarios.