Re: Allowing roadwarrior connections from aggressive and main mode clients?

[Sean Knox <sean_(_at_)_obstacle9_(_dot_)_com>]

FYI, Hakan tells me this isn't possible now, but might be someday.



Sean Knox wrote:
> [I didn't get much response on the openbsd-ipsec list, so I'm reposting 
> here]
>
>
> I'm having problems allowing roadwarrior connections from aggressive and
>   main mode clients to connect isakmpd at the same time. At the moment,
> I can only allow one, either main mode or aggressive by specifying a
> "Default" ISAKMP SA negotiation root, a la:
>
>
> [Phase 1]
> Default        = road-aggressive
> #Default        = road-main-mode
>
>
> If I don't specify a default phase 1 connection, isakmpd uses the
> road-main-mode connection:
>
> 160001.993149 Default exchange_setup_p1: expected exchange type ID_PROT
> got AGGRESSIVE
>
>
> I've tried setting the Phase 1 Local-Addresses to listen on different
> IPs, but isakmpd still uses the road-main-mode connection for incoming
> aggressive connections. Can isakmpd be configured to accepted main mode 
> *and* aggressive mode clients?
>
> thanks,
> sk
>
>
> (connection settings from isakmpd.conf below)
>
> --- from isakmpd.conf ---
>
> [Phase 1]
> #Default        = road-aggressive-p1
> #Default        = road-main-mode-p1
>
> [Phase 2]
> Passive-Connections=    roadwarriors-aggr,roadwarriors-main
>
> ##########################
> ## Phase 1 definitions
> ##########################
>
> [road-aggressive-p1]
> Phase               = 1
> Local-Address       = 10.10.10.1
> Configuration       = aggr-mode-psk
> Authentication      = supersecretpw
> Flags               = IKECFG
>
>
> [road-main-mode-p1]
> Phase               = 1
> Local-Address       = 10.10.10.2
> Configuration       = main-mode-rsa
> Flags               = IKECFG
>
> #########################
> ## Phase 2 definitions
> #########################
>
>
> [roadwarriors-aggr]
> Phase                   = 2
> Configuration           = Default-quick-mode
> Local-ID                = lan
> Remote-ID               = anybody
> ISAKMP-peer             = road-aggressive-p1
>
>
> [roadwarriors-main]
> Phase                   = 2
> Configuration           = Default-quick-mode
> Local-ID                = lan
> Remote-ID               = anybody
> ISAKMP-peer             = road-main-p1
>
> #########################
> ## IDs
> #########################
>
> [anybody]
> ID-type=                IPV4_ADDR
> Address=                0.0.0.0
>
> [lan]
> ID-type         = IPV4_ADDR_SUBNET
> Network         = 192.168.5.0
> Netmask         = 255.255.255.0\