IPSEC help

Hi,

        I am new to ipsec and trying to connect my bsd server with win 2000. I have succeeded to tunnel using pre-shared key. But regarding certificate , I failed to get success.

      The following are configuration :

racoon.conf

path certificate "/usr/local/openssl/certs" ;

# "log" specifies logging level.  It is followed by either "notify",
 "debug"
# or "debug2".
log debug;

remote anonymous
{
    exchange_mode main,aggressive,base;
    #exchange_mode main,base;
        my_identifier asn1dn;
    peers_identifier asn1dn;

    certificate_type x509 "bsd.public" "bsd.priv" ;

    lifetime time 24 hour ;    # sec,min,hour

    #initial_contact off ;
    #passive on ;

    # phase 1 proposal (for ISAKMP SA)
    proposal {
        encryption_algorithm 3des;
        hash_algorithm sha1;
        authentication_method rsasig ;
        dh_group 2 ;
    }

    # the configuration makes racoon (as a responder) to obey the
    # initiator's lifetime and PFS group proposal.
    # this makes testing so much easier.
    proposal_check obey;
}

# phase 2 proposal (for IPsec SA).
# actual phase 2 proposal will obey the following items:
# - kernel IPsec policy configuration (like "esp/transport//use)
# - permutation of the crypto/hash/compression algorithms presented
 below
sainfo anonymous
{
#    pfs_group 2;
    lifetime time 12 hour ;
    encryption_algorithm 3des, cast128, blowfish 448, des, rijndael ;
    authentication_algorithm hmac_sha1, hmac_md5 ;
    compression_algorithm deflate ;
}

--------------------------END------------------------------------------------------------------
certificate are created in bsd with following commands:

openssl req -new -nodes -newkey rsa:1024 -sha1  -days 1095 -keyout bsd.private -out request.pem
openssl x509 -req -in request.pem -days 1095 -signkey bsd.private -out bsd.public

openssl pkcs12 -export -inkey bsd.private -in bsd.public -out win.p12 -name "win cert"

ln -s bsd.public `openssl x509 -noout -hash -in bsd.public`.0

     I have used win.p12 in windows 2000 prof. box for this process.

   Please anyone help me out to configure it.

Thankyou,

Regards,
John

---------------------------------
Get easy, one-click access to your favorites.  Make Yahoo! your homepage.
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"