Amazon EC2 Cloud VPC instance connection via VPG connection with IPSEC.
I wanted to share some information for anyone else trying to do this. The problem lies in not being able to granularly adjust the security/encryption settings for the connection phases and other options in the OPENSWAN software used for UT IPSEC module. What we would see is 1 hour of VPN operation then failure when the tunnel attempts to rekey and negotiate. This had to do with Amazon wanting AES encryption and UT using 3DES by default.
Our only option was to hack and hack we did. Here are the missing lines from the /etc/IPsec.conf file that seemed to make all the difference in connecting to Amazon EC2 cloud.
To prevent the Web UI from overwriting /etc/IPsec.conf we have to protect the file from root via the below command:
The only configuration files we tweaked were in IPsec.conf so we didn't mess with the rest of the configuration files automatically created by the IPSEC module.
I really wish UT opens more options in the IPSEC module WEB UI to allow for higher built in interoperability.
Related to former posts here:
http://forums.untangle.com/openvpn/8...iguration.html
http://forums.untangle.com/openvpn/1...rver-conf.html
Bugzilla please vote:
http://bugzilla.untangle.com/show_bug.cgi?id=11204
I wanted to share some information for anyone else trying to do this. The problem lies in not being able to granularly adjust the security/encryption settings for the connection phases and other options in the OPENSWAN software used for UT IPSEC module. What we would see is 1 hour of VPN operation then failure when the tunnel attempts to rekey and negotiate. This had to do with Amazon wanting AES encryption and UT using 3DES by default.
Our only option was to hack and hack we did. Here are the missing lines from the /etc/IPsec.conf file that seemed to make all the difference in connecting to Amazon EC2 cloud.
Code:
salifetime=1h
ike=aes128-sha1-modp1024
esp=aes128-sha1
dpddelay=30
dpdtimeout=120
dpdaction=restartCode:
chattr +i ipsec.confI really wish UT opens more options in the IPSEC module WEB UI to allow for higher built in interoperability.
Related to former posts here:
http://forums.untangle.com/openvpn/8...iguration.html
http://forums.untangle.com/openvpn/1...rver-conf.html
Bugzilla please vote:
http://bugzilla.untangle.com/show_bug.cgi?id=11204
