<html><head></head><body><div class="ydp563697a5yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div></div>
<div dir="ltr" data-setdir="false">Not to worry, found a work around using the Digi and the Cisco.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">All good.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Cheers,</div><div dir="ltr" data-setdir="false">John</div><div><br></div>
</div><div id="yahoo_quoted_6201720088" class="yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Wednesday, July 29, 2020, 04:56:56 PM GMT+8, John Serink <jserink2004@yahoo.com> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div id="yiv5333601262"><div><div class="yiv5333601262yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr">Hello:</div><div dir="ltr"><br></div><div dir="ltr">I have an IOS router running 15.4 that allows me to connect using a preshared key with the following isakmp profile:</div><div dir="ltr"><div><div>crypto isakmp profile LanToLan</div><div> description Lan to lan profile for CORS set connections</div><div> keyring hubspokes</div><div> match identity address 0.0.0.0 </div><div><br></div><div dir="ltr">And this is perfect as the same profile is used for other road worriers, instrumentation and windows10's L2TP.</div><div dir="ltr"><div><div> keyingtries=0</div><div> left=%defaultroute</div><div> leftsourceip=2.2.22.22</div><div> leftsubnet=2.2.22.22/32</div><div> leftid=@jserinki7</div><div> authby=secret</div><div> ike=aes256-sha2;modp2048</div><div> phase2alg=aes256-sha2;modp2048</div><div> auto=add</div><div> type=tunnel</div><div> right=A.B.C.D</div><div> rightsubnet=1.1.1.1/32</div><div> rightsourceip=1.1.1.1</div><div> #rightid=@CCrouter</div><div> ike-frag=yes</div><div> ikev2=no</div><div> pfs=yes</div><div><br></div><div>But on the above mentioned router, for libreswan to work I needed to change the isakmp profile to :<br></div></div><div dir="ltr"><div><div>crypto isakmp profile LanToLan</div><div> description Lan to lan profile for CORS set connections</div><div> keyring hubspokes</div><div> match identity address 0.0.0.0 </div><div> match identity host jserinki7</div><div><br></div></div>This works fine for my digi routers and libre swan but it breaks Windows L2TP tunnel negotiation.</div><div dir="ltr">If I create another isakmp profile for windows 10 then I have two profiles with a PSK for IP 0.0.0.0 and things don't behave.</div><div dir="ltr"><br></div><div dir="ltr">So, I'd like to figure out if I can remove the "match identity host jserinki7" in the cisco and make this work by adjusting some sort of libreswan settings.</div><div dir="ltr"><br></div><div dir="ltr">Cheers,</div><div dir="ltr">John</div></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div><br></div></div><br></div></div></div></div></div>
</div>
</div></body></html>