🚀 go-pugleaf

Hello all,

I have a situation where we are establishing a vpn between Linux Freeswan
and FW1, but there seems to be a problem configuring one of the key
exchanges. In FW1's log, the first key shows that Phase 1 is established
using 3DES+SHA1(or MD5) as configured in the network objects and the Encrypt
IKE properties, but the Phase 2 exchange in Key 2 shows DES+MD5+PFS
regardless of anything I try. Is there a separate location in FW1 that
allows for configuration of the second key? Freeswan will not support DES or
PFS and these need to be changed somehow.

As presently configured, whenever a ping is sent through the tunnel to the
private network behind the firewall, the VPN rule drops the packets claiming
in the log that the peer is using the wrong methods scheme. Unfortunately,
the only mention of this in FW1 documentation states that the host
configuration needs to be changed to conform to the configuration on the
gateway, but Freeswan is already configured as it should be for 3DES and
SHA1/MD5 and NO PFS.

Any constructive ideas would be greatly appreciated. Thanks,

Edgar Faulkner
edgarf@crossport.com