Interoperating with FreeS/WAN

The FreeS/WAN project needs you! We rely on the user community to keep up to date. Mail [email protected] with your interop success stories.

Please note: Most of our interop examples feature Linux FreeS/WAN 1.x config files. You can convert them to 2.x files fairly easily with the patch in our Upgrading Guide.

Interop at a Glance

Key

Basic Interop Rules

Vanilla FreeS/WAN implements these parts of the IPSec specifications. You can add more with Openswan, but what we offer may be enough for many users.

• To use X.509 certificates with FreeS/WAN, you will need the X.509 patch or Openswan, which includes that patch.
• To use Network Address Translation (NAT) traversal with FreeS/WAN, you will need Arkoon Network Security's NAT traversal patch or Openswan, which includes it.

We offer a set of proposals which is not user-adjustable, but covers all combinations that we can offer. FreeS/WAN always proposes triple DES encryption and Perfect Forward Secrecy (PFS). In addition, we propose Diffie Hellman groups 5 and 2 (in that order), and MD5 and SHA-1 hashes. We accept the same proposals, in the same order of preference.

Other interop notes:

• FreeS/WAN used to support Authentication Header (before 2.05) and Transport Mode (before 2.06). Both features were taken out to make FreeS/WAN a simpler, more streamlined OE product.
• A SHA-1 bug in FreeS/WAN 2.00, 2.01 and 2.02 may affect some interop scenarios. It does not affect 1.x versions, and is fixed in 2.03 and later.
• Some other implementations will close a connection with FreeS/WAN after some time. This may be a problem with rekey lifetimes. Please see this tip and this workaround.

Longer Stories

For More Compatible Implementations

FreeS/WAN

See our documentation at freeswan.org, and the Openswan docs (formerly Super FreeS/WAN, they still have some good docs posted up on the SFS site). Some user-written HOWTOs for FreeS/WAN-FreeS/WAN connections are listed in our Introduction.

See also:

• A German FreeS/WAN-FreeS/WAN page by Markus Wernig (X.509)

Back to chart

isakmpd (OpenBSD)

OpenBSD FAQ: Using IPsec
Hans-Joerg Hoexer's interop Linux-OpenBSD (PSK)
Skyper's configuration (PSK)
French page with configs (X.509)

Back to chart

Kame

• For FreeBSD and NetBSD. Ships with Mac OS X; see also our Mac section.
• Also known as racoon, its keying daemon.

Kame homepage, with FAQ
NetBSD's IPSec FAQ
Ghislaine's post explaining some interop peculiarities

Itojun's Kame-FreeS/WAN interop tips (PSK)
Ghislaine Labouret's French page with links to matching FreeS/WAN and Kame configs (RSA)
Markus Wernig's HOWTO (X.509, BSD gateway)
Frodo's Kame-FreeS/WAN interop (X.509)
Kame as a WAVEsec client.

Back to chart

PGPNet/McAfee

• Now called McAfee VPN Client.
• PGPNet also came in a freeware version which did not support subnets
• To support dhcp-over-ipsec, you need the X.509 patch, which is included in Openswan.

Tim Carr's Windows Interop Guide (X.509)
Hans-Joerg Hoexer's Guide for Linux-PGPNet (PSK)
Kai Martius' instructions using RSA Key-Extractor Tool (RSA)
    Christian Zeng's page (RSA) based on Kai's work. English or German.
Oscar Delgado's PDF (X.509, no configs)
Ryan's HOWTO for FreeS/WAN-PGPNet (X.509). Through a Linksys Router with IPsec Passthru enabled.
Jean-Francois Nadeau's Practical Configuration (Road Warrior with PSK)
Wouter Prins' HOWTO (Road Warrior with X.509)

Rekeying problem with FreeS/WAN and older PGPNets

DHCP over IPSEC HOWTO for FreeS/WAN (requires X.509 and dhcprelay patches)

Back to chart

Microsoft Windows 2000/XP

• IPsec comes with Win2k, and with XP Support Tools. May require High Encryption Pack. WinXP users have also reported better results with Service Pack 1.
• The Road Warrior setup works either way round. Windows (XP or 2K) IPsec can connect as a Road Warrior to FreeS/WAN. However, FreeS/WAN can also successfully connect as a Road Warrior to Windows IPsec (see Nate Carlson's configs below).
• FreeS/WAN version 1.92 or later is required to avoid an interoperation problem with Windows native IPsec. Earlier FreeS/WAN versions did not process the Commit Bit as Windows native IPsec expected.

Tim Carr's Windows Interop Guide (X.509)
James Carter's instructions (X.509, NAT-T)
Jean-Francois Nadeau's Net-net Configuration (PSK)
Telenor's Node-node Config (Transport-mode PSK). As of release 2.06, FreeS/WAN no longer supports transport mode.
Marcus Mueller's HOWTO using his VPN config tool (X.509). Tool also works with PSK.
Nate Carlson's HOWTO using same tool (Road Warrior with X.509). Unusually, FreeS/WAN is the Road Warrior here.
Oscar Delgado's PDF (X.509, no configs)
Tim Scannell's Windows XP Additional Checklist (X.509)

Microsoft's page on Win2k TCP/IP security features
Microsoft's Win2k IPsec debugging tips
MS VPN may fall back to 1DES

Back to chart

SSH Sentinel

• Popular and well tested.
• Also rebranded in Zyxel Zywall. Our Zyxel interop notes are here.
• SSH supports IPsec-over-UDP NAT traversal.
• There is this potential problem if you're not using the Legacy Proposal option.

SSH's Sentinel-FreeSWAN interop PDF (X.509)
Nadeem Hassan's SUSE-to-Sentinel article (Road warrior with X.509)
O-Zone's Italian HOWTO (Road Warrior, X.509, DHCP)

Back to chart

Safenet SoftPK/SoftRemote

• People recommend SafeNet as a low cost Windows client.
• SoftRemote seems to be the newer name for SoftPK.

Whit Blauvelt's SoftRemote tips
Tim Wilson's tips (X.509) Workaround for a "gotcha"

Jean-Francois Nadeau's Practical Configuration (Road Warrior with PSK)
Terradon Communications' PDF (Road Warrior with PSK)
Seaan.net's PDF (Road Warrior to Subnet, with PSK)
Red Baron Consulting's PDF (Road Warrior with X.509)

Back to chart

For Other Implementations

6Wind

French page with configs (X.509)

Back to chart

Alcatel Timestep

Alain Sabban's settings (PSK or PSK road warrior; through static NAT)
Derick Cassidy's configs (PSK)
David Kerry's Timestep settings (PSK)
Kevin Gerbracht's ipsec.conf (X.509)

Back to chart

Apple Macintosh System 10+

• Since the system is based on FreeBSD, this should interoperate just like FreeBSD.
• To use Appletalk over IPsec tunnels, run it over TCP/IP, or use Open Door Networks' Shareway IP tool, described here.
• See also the Equinux VPN Tracker for Mac OS X.

James Carter's instructions (X.509, NAT-T)

Back to chart

AshleyLaurent VPCom

Successful interop report, no details

Back to chart

Borderware

• I suspect the Borderware client is a rebranded Safenet. If that's true, our Safenet section will help.

Philip Reetz' configs (PSK)
Borderware server does not support FreeS/WAN road warriors
Older Borderware may not support Diffie Hellman groups 2, 5

Back to chart

Check Point VPN-1 or FW-1

• Caveat about IP-range inclusion on Check Point.
• Some versions of Check Point may require an aggressive mode patch to interoperate with FreeS/WAN.
  Openswan now features this patch.
• A Linux FreeS/WAN-Checkpoint connection may close after some time. Try this tip toward a workaround.

AERAsec's Firewall-1 NG site (PSK, X.509, Road Warrior with X.509, other algorithms)
     AERAsec's detailed Check Point-FreeS/WAN support matrix
Checkpoint.com PDF: Linux as a VPN Client to FW-1 (PSK)
PhoneBoy's Check Point FAQ (on Check Point only, not FreeS/WAN)

Chris Harwell's tips & FreeS/WAN configs (PSK)
Daniel Tombeil's configs (PSK)

Back to chart

Cisco

• Cisco supports IPsec-over-UDP NAT traversal.
• Cisco VPN Client appears to use nonstandard IPsec and does not work with FreeS/WAN. This message concerns Cisco VPN Client 4.01.
• A Linux FreeS/WAN-Cisco connection may close after some time. Here is a workaround, and here is another comment on the same subject.
• Older Ciscos purchased outside the United States may not have 3DES, which FreeS/WAN requires.
• RSA keying may not be possible between Cisco and FreeS/WAN.
• In ipsec.conf, VPN3000 DN (distinguished name) must be in binary (X.509 only)

SANS Institute HOWTO (PSK). Detailed, with extensive references.
Short HOWTO (PSK)
French page with configs for Cisco IOS, PIX and VPN 3000 (X.509)
Dave McFerren's sample configs (PSK)
Wolfgang Tremmel's sample configs (PSK road warrior)
Old doc from Pete Davis, with William Watson's updated Tips (PSK)

Some PIX specific information:
Waikato Linux Users' Group HOWTO. Nice detail (PSK)
John Leach's configs (PSK)
Greg Robinson's settings (PSK)
Scott's ipsec.conf for PIX (PSK, FreeS/WAN side only)
Rick Trimble's PIX and FreeS/WAN settings (PSK)

Cisco VPN support page
Cisco IPsec information page

Back to chart

Equinux VPN tracker (for Mac OS X)

• Graphical configurator for Mac OS X IPsec. May be an interface to the native Mac OS X IPsec, which is essentially KAME.
• To use Appletalk over IPsec tunnels, run it over TCP/IP, or use Open Door Networks' Shareway IP tool, described here.

Equinux provides this excellent interop PDF (PSK, RSA, X.509).

Back to chart

F-Secure

• F-Secure supports IPsec-over-UDP NAT traversal.

pingworks.de's "Connecting F-Secure's VPN+ to Linux FreeS/WAN" (PSK road warrior)
    Same thing as PDF
Success report, no detail (PSK)
Success report, no detail (Manual)

Back to chart

Gauntlet GVPN

Richard Reiner's ipsec.conf (PSK)
Might work without that pesky firewall... (PSK)
In late July, 2003 Alexandar Antik reported success interoperating with Gauntlet 6.0 for Solaris (X.509). Unfortunately the message is not properly archived at this time.

Back to chart

IBM AIX

IBM's "Built-In Network Security with AIX" (PSK, X.509)
IBM's tip: importing Linux FreeS/WAN settings into AIX's ikedb (PSK)

Back to chart

IBM AS/400

• Road Warriors may act flaky.

Richard Welty's tips and tricks

Back to chart

Intel Shiva LANRover / Net Structure

• Intel Shiva LANRover is now known as Intel Net Structure.
• Shiva seems to have two modes: IPsec or the proprietary "Shiva Tunnel". Of course, FreeS/WAN will only create IPsec tunnels.

Snowcrash's configs (PSK)
Old configs from an interop (PSK)
The day Shiva tickled a Pluto bug (PSK)
     Follow up: success!

Back to chart

LanCom (formerly ELSA)

• This router is popular in Germany.

Jakob Curdes successfully created a PSK connection with the LanCom 1612 in August 2003.

Back to chart

Linksys

• Linksys may be used as an IPsec tunnel endpoint, OR as a router in "IPsec passthrough" mode, so that the IPsec tunnel passes through the Linksys.

As tunnel endpoint

Ken Bantoft's instructions (Road Warrior with PSK)
Nate Carlson's caveats

In IPsec passthrough mode

Sample HOWTO through a Linksys Router
Nadeem Hasan's configs
Brock Nanson's tips

Back to chart

Lucent

Partial success report; see also the next message in thread

Back to chart

Netasq

French page with configs (X.509)

Back to chart

Netcelo

French page with configs (X.509)

Back to chart

Netgear fvs318

• With a recent Linux FreeS/WAN, you will require the latest (12/2002) Netgear firmware, which supports Diffie-Hellman (DH) group 2. For security reasons, we phased out DH 1 after Linux FreeS/WAN 1.5.
• This message reports the incompatibility between Linux FreeS/WAN 1.6+ and Netgear fvs318 without the firmware upgrade.
• We believe Linux FreeS/WAN 1.5 and earlier will interoperate with any NetGear firmware.

John Morris' setup (PSK)

Back to chart

Netscreen 100 or 5xp

Errol Neal's settings (PSK)
Corey Rogers' configs (PSK, no PFS)
Jordan Share's configs (PSK, 2 subnets, through static NAT)
Set src proxy_id to your protected subnet/mask
French page with ipsec.conf, Netscreen screen shots (X.509, may need to revert to PSK...)

A report of a company using Netscreen with FreeS/WAN on a large scale (FreeS/WAN road warriors?)

Back to chart

Nortel Contivity

• Nortel supports IPsec-over-UDP NAT traversal.
• Some older versions of Contivity and FreeS/WAN will not communicate.
• FreeS/WAN cannot be used as a "client" to a Nortel Contivity server, but can be used as a branch-office tunnel.
• Contivity does not send Distinguished Names in the order FS wants them (X.509).
• Connections may time out after 30-40 minutes idle.

JJ Streicher-Bremer's mini HOWTO for old & new software. (PSK with two subnets)
French page with configs (X.509). This succeeds using the above X.509 tip.

Back to chart

Radguard

Marko Hausalo's configs (PSK). Note: These do create a connection, as you can see by "IPsec SA established".
Claudia Schmeing's comments

Back to chart

Raptor (NT or Solaris)

• Now known as Symantec Enterprise Firewall.
• The Raptor does not normally come with X.509, but this may be available as an add-on.
• Raptor requires alphanumberic PSK values, whereas FreeS/WAN uses hex.
• Raptor's tunnel endpoint may be a host, subnet or group of subnets (see this message ). FreeS/WAN cannot handle the group of subnets; you must create separate connections for each in order to interoperate.
• Some versions of Raptor accept only single DES. According to this German message, the Raptor Mobile Client demo offers single DES only.

Peter Mazinger's settings (PSK)
Peter Gerland's configs (PSK)
Charles Griebel's configs (PSK).
Lumir Srch's tips (PSK)

John Hardy's configs (Manual)
Older Raptors want 3DES keys in 3 parts (Manual).
Different keys for each direction? (Manual)

Back to chart

Redcreek Ravlin

• Known issue #1: The Ravlin expects a quick mode renegotiation right after every Main Mode negotiation.
• Known issue #2: The Ravlin tries to negotiate a zero connection lifetime, which it takes to mean "infinite". Jim Hague's patch addresses both issues.
• Interop works with Ravlin Firmware > 3.33. Includes tips (PSK).

Back to chart

SonicWall

• Sonicwall cannot be used for Road Warrior setups
• At one point, only Sonicwall PRO supported triple DES.
• Older Sonicwalls (before Nov 2001) feature Diffie Hellman group 1 only.

Paul Wouters' config (PSK)
Dilan Arumainathan's configuration (PSK)
Dariush's setup... only opens one way (PSK)
Andreas Steffen's tips (X.509)

Back to chart

Sun Solaris

• Solaris 8+ has a native (in kernel) IPsec implementation.
• Solaris does not seem to support tunnel mode, but you can make IP-in-IP tunnels instead, like this.

Reports of some successful interops from a fellow @sun.com. See also these follow up posts.
Aleks Shenkman's configs (Manual in transport mode) As of release 2.06, FreeS/WAN no longer supports transport mode.

Back to chart

Symantec

• The Raptor, covered above, is now known as Symantec Enterprise Firewall.
• Symantec's "distinguished name" is a KEY_ID. See Andreas Steffen's post, below.
• One Symantec version has a bug which causes a malformed ISAKMP HDR payload. See Ryley Breiddal's description and solution.

Andreas Steffen's configs for Symantec 200R (PSK)

Back to chart

Watchguard Firebox

• Automatic keying works with WatchGuard 5.0+ only.
• Seen to interoperate with WatchGuard 1000, II, III; firmware v. 5, 6..
• For manual keying, Watchguard's Policy Manager expects SPI numbers and encryption and authentication keys in decimal (not hex).

WatchGuard's HOWTO (PSK)
Ronald C. Riviera's Settings (PSK)
Walter Wickersham's Notes (PSK)
Max Enders' Configs (Manual)

Old known issue with auto keying
Tips on key generation and format (Manual)

Back to chart

Xedia Access Point/QVPN

Hybrid IPsec/L2TP connection settings (X.509)
Xedia's LAN-LAN links don't use multiple tunnels
     That explanation, continued

Back to chart

Zyxel

• The Zyxel Zywall is a rebranded SSH Sentinel box. See also our section on SSH.
• There seems to be a problem with keeping this connection alive. This is caused at the Zyxel end. See this brief discussion and solution.

Zyxel's Zywall to FreeS/WAN instructions (PSK)
Zyxel's Prestige to FreeS/WAN instructions (PSK). Note: not all Prestige versions include VPN software.
Fabrice Cahen's HOWTO (PSK)
    

Back to chart