Re: Question regarding IPsec HMAC-SHA2 incompatibility after OpenBSD 4.6

Thanks, I will lock at that =) Best regards Johan 2012/5/12 Christian Weisgerber na...@mips.inka.de: Johan Ryberg jo...@securit.se wrote: I found this information that seems very interesting: http://www.openbsd.org/faq/upgrade47.html#hmac-sha2 ike esp from 192.168.1.1 to 10.0.0.17 peer

Re: Question regarding IPsec HMAC-SHA2 incompatibility after OpenBSD 4.6

One problem still exist I got this error message now from the OpenBSD 3.8 machine 125755.190614 Default responder_recv_HASH_SA_NONCE: peer proposed invalid phase 2 IDs: initiator id c0a80100/ff00: 192.168.1.0/255.255.255.0, responder id c0a80300/ff00: 192.168.3.0/255.255.255.0 OpenBSD

Question regarding IPsec HMAC-SHA2 incompatibility after OpenBSD 4.6

Hi. We have upgraded one cluster of firewalls that had OpenBSD 3.8 (with more to come) and we have problem with some of the IPsec tunnels. I found this information that seems very interesting: http://www.openbsd.org/faq/upgrade47.html#hmac-sha2 IPsec HMAC-SHA2 incompatibility: Two bugs in

Re: Question regarding IPsec HMAC-SHA2 incompatibility after OpenBSD 4.6

Johan Ryberg jo...@securit.se wrote: I found this information that seems very interesting: http://www.openbsd.org/faq/upgrade47.html#hmac-sha2 ike esp from 192.168.1.1 to 10.0.0.17 peer 192.168.10.1 psk mekmitasdigoat The man page of ipsec.conf says that hmac-sha1, aes, and modp1024 is