[Swan] Connection to Cisco ISR4431, IOS Version 16.8.1
jserink2004 at yahoo.com
Wed Jul 29 10:01:59 UTC 2020
Not to worry, found a work around using the Digi and the Cisco.
On Wednesday, July 29, 2020, 04:56:56 PM GMT+8, John Serink <jserink2004 at yahoo.com> wrote:
I have an IOS router running 15.4 that allows me to connect using a preshared key with the following isakmp profile:crypto isakmp profile LanToLan description Lan to lan profile for CORS set connections keyring hubspokes match identity address 0.0.0.0
And this is perfect as the same profile is used for other road worriers, instrumentation and windows10's L2TP. keyingtries=0 left=%defaultroute leftsourceip=18.104.22.168 leftsubnet=22.214.171.124/32 leftid=@jserinki7 authby=secret ike=aes256-sha2;modp2048 phase2alg=aes256-sha2;modp2048 auto=add type=tunnel right=A.B.C.D rightsubnet=126.96.36.199/32 rightsourceip=188.8.131.52 #rightid=@CCrouter ike-frag=yes ikev2=no pfs=yes
But on the above mentioned router, for libreswan to work I needed to change the isakmp profile to :
crypto isakmp profile LanToLan description Lan to lan profile for CORS set connections keyring hubspokes match identity address 0.0.0.0 match identity host jserinki7
This works fine for my digi routers and libre swan but it breaks Windows L2TP tunnel negotiation.If I create another isakmp profile for windows 10 then I have two profiles with a PSK for IP 0.0.0.0 and things don't behave.
So, I'd like to figure out if I can remove the "match identity host jserinki7" in the cisco and make this work by adjusting some sort of libreswan settings.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Swan