Bug 75935 – OPENSWAN NAT-Traversal is always disabled and not useable

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description Jochen Buchholz 2004-12-28 12:09:42 UTC]

aftern emerging openswan 2.2.0 it is impossible to use the NAT Traversal feature. I tried it with gentoo-dev-sources, with the gentoo-sources kernel, hand patched vanilla kernel and got always the same result. NAT-Traversal is always disabled.

Reproducible: Always
Steps to Reproduce:
1.emerge gentoo-sources
2.genkernel --menuconfig all
3.Switch all ipsec options on (CONFIG_IPSEC_NAT_TRAVERSAL=y ...)
4.Reboot with new kernel
5.emerge openswan
6.nat_traversal=yes in /etc/ipsec.conf
7./etc/init.d/ipsec start
8.ipsec barf
9. Read the last 30 lines of the output
Actual Results:  
Output on gentoo:
Dec 28 21:02:32 ox pluto[19331]: Starting Pluto (Openswan Version 2.2.0
X.509-1.5.4 PLUTO_USES_KEYRR)
Dec 28 21:02:32 ox pluto[19331]:   including NAT-Traversal patch (Version 0.6c)
[disabled]
Dec 28 21:02:32 ox pluto[19331]: ike_alg_register_enc(): Activating
OAKLEY_AES_CBC: Ok (ret

Expected Results:  
Output on Fedora Core 2
Dec 28 20:13:39 localhost pluto[5793]: Starting Pluto (Openswan Version 2.2.0
X.509-1.5.4 PLUTO_USES_KEYRR)
Dec 28 20:13:39 localhost pluto[5793]:   including NAT-Traversal patch (Version
0.6c)
Dec 28 20:13:39 localhost pluto[5793]: ike_alg_register_enc(): Activating
OAKLEY_AES_CBC: Ok (ret=0)


I use openswan on my old Redhat Linux 8 and on a Fedora Core 2 box under kernel
2.6 without any problems. Now I want switch this boxes to gentoo linux, because
the Redhat has stopped the support for old distribs and the fedora core is
unstable (we had problems with memory overflows and so on, so we want to kick it
away). I need the NAT-T feature because some users have a NAT Wlan Router with a
private Network (192.168.0.0/16) behind it.

[Comment 1 Jochen Buchholz 2004-12-28 12:14:58 UTC]

Created attachment 47047 [details]
My ipsec config

[Comment 2 Jay Pfeifer (RETIRED) 2005-01-20 19:00:50 UTC]

try openswan-2.3.0 and use hds-2.6.10 if possible, i added some patches to help with nat-t.

[Comment 3 Jay Pfeifer (RETIRED) 2005-01-25 09:05:32 UTC]

nat-t is working fine here. please repoen if you still see this issue.