Openswan hacks and other interop tweaks

Openswan hacks and other interop tweaks

Listed here are hacks and tweaks that are not part of the regular operation of Openswan. This could be because it is not compliant or violates the various RFC standards, or because the solution is so hacked up it should not be in the regular openswan distribution.

{{toc}}

Juniper Netscreen and its overlapip hack

Openswan uses SArefs to work with overlapping IP issues – that is multiple tunnels that have the same internal IP range.
Juniper (and perhaps other vendors) uses a different approach. They “assign” from their own pool one or more static IP
addresses from the RFC1918 address space, and then NAT the incoming IPsec packets so they can distinguish different customers on their identical IP’s.

Unfortunately, their implementation is non-RFC compliant, and requires some severe hacking.

Juniper NAT-IPsec hack workaround

UDP passive keep-alive scenario success

Hacking TTL’s to have the server end send NAT-T keepalives, without bothering the battery powered client

UDPPassiveKeepAliveHack

Using whack directly without any scripts or ipsec.conf file

UsingWhackDirectly

Cisco ASA5505 Interop with Traffic Selectors (protoport=) for leftsubnet=0.0.0.0/0

CiscoASA5505TrafficSelectors