From mkitchin.public at gmail.com  Sat Feb  4 18:37:48 2012
From: mkitchin.public at gmail.com (Matthew Kitchin (Public/Usenet))
Date: Sat, 04 Feb 2012 17:37:48 -0600
Subject: SSL error
In-Reply-To: <4F221E37.1030308@gmail.com>
References: <4F21BF6E.1050500@gmail.com> <4F221E37.1030308@gmail.com>
Message-ID: <4F2DC14C.3050202@gmail.com>

The No DTLS option seems to have fixed it. I guess I'm stuck using that.

On 1/26/2012 9:47 PM, Matthew Kitchin (Public/Usenet) wrote:
> Sorry for replying to my own email. I resolved the group issue. I 
> needed to use  --authgroup= instead of --usergroup=
>
> This problem remains. I get this after the connection takes about 30 
> seconds to start
>
> Established DTLS connection
> DTLS Dead Peer Detection detected dead peer!
> DTLS handshake failed: 1
> 22407:error:14102410:lib(20):func(258):reason(1040):NA:0:SSL alert 
> number 40
>
> The last line is repeated every few seconds.
>
> On 1/26/2012 3:02 PM, Matthew Kitchin (public/usenet) wrote:
>> I've been connecting to a Cisco ASA for some time with no issues. I'm 
>> now moving over to a different one at a new company. I get this error 
>> below.
>> 20454:error:14102410:lib(20):func(258):reason(1040):NA:0:SSL alert 
>> number 40
>> every few minutes.
>> The hits I can find on this are similar to this:
>> http://www.mail-archive.com/openssl-users at openssl.org/msg51636.html
>> Is this anything I should worry about?
>>
>> The initial connection also fails for about 30 seconds, and then 
>> comes up as soon as this text is displayed:
>> Established DTLS connection
>> DTLS Dead Peer Detection detected dead peer!
>> DTLS handshake failed: 1
>> 20800:error:14102410:lib(20):func(258):reason(1040):NA:0:SSL alert 
>> number 40
>> I find this error on this topic:
>> http://lists.infradead.org/pipermail/openconnect-devel/2011-May/000302.html 
>>
>>
>> I'm using OpenConnect version v2.25-unknown on OpenWRT backfire. I 
>> realize it is not the newest, but the package for OpenWRT doesn;t 
>> seem to get updated, I i completely failed when I attempted to do it 
>> myself.
>>
>> The only other issue I'm having is related to the group. My previous 
>> connection did not prompt for a group. This one does. I'm trying to 
>> keep this as an automated process, but I"m not having any luck with 
>> the --usergroup=GROUP switch. I doubt this is related to my issue, 
>> and so far I assume it is user error on my part.
>>
>> I'm not sure if my 2 problems above are related. If so, which one 
>> should I tackle first?
>



From mkitchin.public at gmail.com  Sat Feb  4 23:56:07 2012
From: mkitchin.public at gmail.com (Matthew Kitchin (Public/Usenet))
Date: Sat, 04 Feb 2012 22:56:07 -0600
Subject: Compile new package for OpenWRT?
Message-ID: <4F2E0BE7.404@gmail.com>

Is there anyone out there that wants to build the latest version for 
OpenWRT Backfire? I have tried several times, and I run into a brick 
wall. I know I must be doing something wrong, but I don;t have a clue 
what it is.


From tom.warnke at uni-rostock.de  Wed Feb 29 06:40:04 2012
From: tom.warnke at uni-rostock.de (Tom Warnke)
Date: Wed, 29 Feb 2012 12:40:04 +0100
Subject: OpenConnect & ICS
Message-ID: <4F4E0E94.4000502@uni-rostock.de>

Cisco's Anyconnect doesn't support Internet Connection Sharing ( 
http://www.cisco.com/en/US/products/ps8411/products_qanda_item09186a00809aec31.shtml). 
What about OpenConnect?


From dwmw2 at infradead.org  Wed Feb 29 10:08:22 2012
From: dwmw2 at infradead.org (David Woodhouse)
Date: Wed, 29 Feb 2012 16:08:22 +0100
Subject: OpenConnect & ICS
In-Reply-To: <4F4E0E94.4000502@uni-rostock.de>
References: <4F4E0E94.4000502@uni-rostock.de>
Message-ID: <1330528102.19496.8.camel@shinybook.infradead.org>

On Wed, 2012-02-29 at 12:40 +0100, Tom Warnke wrote:
> Cisco's Anyconnect doesn't support Internet Connection Sharing ( 
> http://www.cisco.com/en/US/products/ps8411/products_qanda_item09186a00809aec31.shtml). 
> What about OpenConnect? 

Yes, "connection sharing" ? i.e. doing NAT onto the VPN just as you
would onto a real Internet connection ? works fine. When I run virtual
machines on my laptop, I often do exactly that. But it could route from
a real physical Ethernet (or wireless) too.

-- 
dwmw2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5818 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20120229/74354303/attachment.bin>

