3

I have an Ubuntu server (14.04.1 LTS ) that should connect to a Cisco ASA 5510 (Adaptive Security Appliance). I have tried - to use Racoon without any success. Not even phase 1 is successful.

The topology looks like this;

enter image description here

The Cisco ASA 5510 dictates the following settings should be used (just a policy by the owners);

Phase 1:

Authentication Method: PSK
Encryption Scheme: IKE
Diffie-Hellman Group: Group 2
Encryption Algorithm: 3DES
Hashing Algorithm: MD5
Main or Aggressive Mode: Main Mode
Lifetime (for renegotiation): 28800 seconds

Phase 2

Encapsulation (ESP or AH): ESP
Encryption Algorithm: 3DES
Authentication Algorithm: MD5
Perfect Forward Secrecy: NO PFS
Lifetime (for renegotiation): 3600
Lifesize in KB (for renegotiation): 4608000 kilobytes

I have all IP addresses, and encryption domains for both ends. In my end, it's another server where all the "important" stuff happens. This one running the VPN actually acts as my gateway.

I have already invested some days trying to use Racoon unsuccessfully. I hereby ask for your help great people. I need to know a quick install, configure and use GUI tool to help me connect to this Cisco ASA 5510 device from the Ubuntu 14.04.1 LTS server.

Any assistance will be highly appreciated.

7

I finally managed to set up the tunnel. I can now ping the host behind the Cisco ASA device. Originally, I wanted a GUI tool, but I realized the digitalocean VPS console access has a wrong mouse pointer so I kept running into problems trying to use GUI tools like vpnc in the method described here. I ended up using openswan. Here is how.

  1. Install openswan.

    sudo apt-get install openswan
    
  2. Enable kernel IP packet forwarding and disable ICP redirects

    echo "net.ipv4.ip_forward = 1" |  tee -a /etc/sysctl.conf
    echo "net.ipv4.conf.all.accept_redirects = 0" |  tee -a /etc/sysctl.conf
    echo "net.ipv4.conf.all.send_redirects = 0" |  tee -a /etc/sysctl.conf
    echo "net.ipv4.conf.default.rp_filter = 0" |  tee -a /etc/sysctl.conf
    echo "net.ipv4.conf.default.accept_source_route = 0" |  tee -a /etc/sysctl.conf
    echo "net.ipv4.conf.default.send_redirects = 0" |  tee -a /etc/sysctl.conf
    echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" |  tee -a /etc/sysctl.conf
    
    sysctl -p
    
  3. Configure Openswan. The file is /etc/ipsec.conf Here's how mine ended up looking like;

    config setup
            dumpdir=/var/run/pluto/
            nat_traversal=yes
    virtual_private=%v4:!,%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
            oe=off
            protostack=netkey
            plutostderrlog=/var/log/openswan.log
            force_keepalive=yes
            keep_alive=60
    conn myVpnConn
        authby=secret
        pfs=no
        auto=start
        keyingtries=%forever
        ikelifetime=8h
        keylife=1h
        ike=3des-md5;modp1024
        phase2alg=3des-md5
        type=tunnel
        leftsourceip=202.x.x.101    #my_local_ip aka encryption domain
        left=202.x.x.100
        aggrmode=no
        right=41.x.x.x
        rightsourceip=172.x.x.x
        dpddelay=10
        dpdtimeout=3600
        dpdaction=restart
  4. Start ipsec/openswan

    service ipsec start

That was it in a short summary.

I stumbled upon well written articles showing how to configure openswan vpn.

  1. Remy van Elst's post
  2. Gregg's post

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.