http://www.systemengineers.de/ 2010-09-09T06:58:22+02:00 http://www.systemengineers.de/ http://www.systemengineers.de/lib/images/favicon.ico text/html 2009-09-12T12:46:12+02:00 http://www.systemengineers.de/cisco/config/vpn/ipsec/cisco-adsl-to-freeswan?rev=1252752372 The situation has changed somewhat: this configuration is designed for using a FreeS/WAN machine as a head end VPN concentrator for a number of Cisco ADSL routers at branch offices. In this example, the IPSec head end sits behind a Nokia M1122, so some NAT workarounds are included. These will be marked and easy to work around. text/html 2009-09-12T12:46:12+02:00 http://www.systemengineers.de/cisco/config/vpn/ipsec/general-information?rev=1252752372 IPSEC nutzt fast jede Firma - doch kaum einer weiss was es damit auf sich hat. Erklärungen gibt es dazu viele, doch leider auch zu viele unverständliche oder zu ausführliche, die keiner versteht. Das Problem liegt nicht nur an der Komplexität des IPSEC Protokolls, sondern zu allem Übel an den verschiedenartigsten Möglichkeiten, wie man IPSEC konfigurieren kann. Dadurch kann der Eindruck entstehen, verschiedene IPSEC- Erklärungen die man im Internet findet, würden gegensätzliches aussag… text/html 2009-09-12T12:46:12+02:00 http://www.systemengineers.de/cisco/config/vpn/ipsec/generic-cisco-to-openswan?rev=1252752372 How to configure openswan to cisco vpn I used a base install of archlinux with iptables, iproute, and openswan installed from the package repos. The cisco device was a 2621 running 12.3.22 , with ipfw crypto. You can verify crypto on the cisco side by doing a „show crypto isakmp sa“ and „show crypto ipsec sa“. On openswan do a „ipsec barf | more“. text/html 2009-09-12T12:46:12+02:00 http://www.systemengineers.de/cisco/config/vpn/ipsec/pix-to-openswan?rev=1252752372 The Cisco PIX is a powerful hardware firewall solution sold by Cisco Systems. OpenSWAN is an opensource project enabling IPSEC functionality on the Linux platform. This document is merely a quick summary of what I did to get a VPN established between OpenSWAN and the PIX. Interesting about OpenSWAN as a solution is that it does not require a kernel patch if you do not require NAT traversal. The loadable module ipsec.o is all you need.