<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.0.10">
</HEAD>
<BODY>
Hello, <BR>
<BR>
More data about the case :<BR>
<BR>
Here I paste you tcpdump of IKE session (when Nortel is Initiator and Openswan Responder). Any clues for you there ?<BR>
I used the Ipsec setting suggested in "ICSAlabs VPN troubleshooting guide" (PSK, no PFS, SHA1, 3DES, same timers, only ESP, Diffie-Hellman group 2)<BR>
looks good to me but some dubts (bold):<BR>
-what are vid's ? why are different lenght ? and could this be important ?<BR>
-can't see nothing about NAT-T there. normal ?<BR>
-Should this scenario work, or I'm in a worst case that some days ago ? my idea is eliminate initiator-side NAT (every night I say NAT is evil before going to sleep 10 times Michael ;-) )<BR>
-May be old RFC's supported on Nortel Contivity ? upgrade suggested if possible ?<BR>
<BR>
Notes:<BR>
N.N.N.N = Nortel device IP address<BR>
O.O.O.O = Openswan (visible and real IP address seen from outside)<BR>
192.168.5.2 = LAN Openswan gateway to the ADSL router<BR>
All packets captured in LAN segment between Openswan and DSL (Natting router) because no other inspection point is possible.<BR>
-Openswan 2.2.0 [plus NAT-T rekey patch] (Linux 2.6)<BR>
-Nortel contivity 251 (RAS F/W Version: VA251_2.0.0.0.013 | 12/3/2003 DSL FW Version: Alcatel, Version 3.9.122)<BR>
<BR>
Thanks in advance<BR>
Albert Agustí<BR>
<BR>
<BR>
<FONT SIZE="2">****** Nortel -> Openswan (1) <BR>
18:06:04.607406 IP (tos 0x0, ttl 247, id 28657, offset 0, flags [none], proto 17, length: 156) N.N.N.N.isakmp > 192.168.5.2.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 1 I ident:<BR>
(sa: doi=ipsec situation=identity<BR>
(p: #1 protoid=isakmp transform=1<BR>
(t: #1 id=ike (type=enc value=3des)(type=hash value=sha1)(type=auth value=preshared)(type=group desc value=modp1024)(type=lifetype value=sec)(type=lifeduration len=4 value=000004b0))))<BR>
<B>(vid: len=16 4485152d18b6bbcd0be8a8469579ddcc)<BR>
(vid: len=20 625027749d5ab97f5616c1602765cf480a3b7d0b)</B><BR>
<BR>
****** Openswan -> Nortel (2)<BR>
18:06:04.608214 IP (tos 0x0, ttl 64, id 366, offset 0, flags [DF], proto 17, length: 132) 192.168.5.2.isakmp > N.N.N.N.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 1 R ident:<BR>
(sa: doi=ipsec situation=identity<BR>
(p: #1 protoid=isakmp transform=1<BR>
(t: #1 id=ike (type=enc value=3des)(type=hash value=sha1)(type=auth value=preshared)(type=group desc value=modp1024)(type=lifetype value=sec)(type=lifeduration len=4 value=000004b0))))<BR>
<B>(vid: len=16 4485152d18b6bbcd0be8a8469579ddcc)</B><BR>
<BR>
****** Nortel -> Openswan (3)<BR>
18:06:05.922748 IP (tos 0x0, ttl 247, id 28658, offset 0, flags [none], proto 17, length: 260) N.N.N.N.isakmp > 192.168.5.2.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 1 I ident:<BR>
(ke: key len=128 472879192d2248ef6e4494ec6985ddf5df917b12915ecb0b4ca8b22ff6525ef86748825a9a68a8a27a53a3fe453904b5b28df24f571a728ebb95b6104057de168228b11122140c7adf2c87d6c4280845c69a3c521630de9add9dd7c1add7bc70483970ccd886660588b54d1a76265e149b8b020ecb93d71e74d5eace42d3e069)<BR>
(nonce: n len=20 54664dd3143a57eeedd914e704c69037870ab458)<BR>
(#130)<BR>
(#130)<BR>
<BR>
***** Openswan -> Nortel (4)<BR>
18:06:05.928925 IP (tos 0x0, ttl 64, id 367, offset 0, flags [DF], proto 17, length: 256) 192.168.5.2.isakmp > N.N.N.N.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 1 R ident:<BR>
(ke: key len=128 998f13ed8d4f20ddd362f8a0017e62583f0a85ad7e86f0b394d03c8c2e129c3a76effeabe793bb98468ebd10c65c8e34ba904c1999318a115d4680bfd6b97e299b9517a1eedf79ef55f215e452010d214f80e09bb24c0ebd8e65e556cbb0e933d8f4783aa250f53eab8783d8d512b95a06d5eee61fefe135031bad2a7f844e6f)<BR>
(nonce: n len=16 44d60557d92e63d6e130c0f463480c69)<BR>
(#130)<BR>
(#130)<BR>
<BR>
***** Nortel -> Openswan (5)<BR>
18:06:07.522104 IP (tos 0x0, ttl 247, id 28659, offset 0, flags [none], proto 17, length: 120) N.N.N.N.isakmp > 192.168.5.2.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 1 I ident[E]: [encrypted id]<BR>
<BR>
***** Openswan -> Nortel (6)<BR>
18:06:07.522764 IP (tos 0x0, ttl 64, id 368, offset 0, flags [DF], proto 17, length: 96) 192.168.5.2.isakmp > N.N.N.N.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 1 R ident[E]: [encrypted id]<BR>
<BR>
------------------------------------------------------------<BR>
<BR>
<BR>
18:06:08.857723 IP (tos 0x0, ttl 247, id 28660, offset 0, flags [none], proto 17, length: 336) N.N.N.N.isakmp > 192.168.5.2.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 2/others I oakley-quick[E]: [encrypted hash]<BR>
<BR>
18:06:08.863717 IP (tos 0x0, ttl 64, id 369, offset 0, flags [DF], proto 17, length: 320) 192.168.5.2.isakmp > N.N.N.N.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 2/others R oakley-quick[E]: [encrypted hash]<BR>
<BR>
18:06:10.473243 IP (tos 0x0, ttl 247, id 28661, offset 0, flags [none], proto 17, length: 80) N.N.N.N.isakmp > 192.168.5.2.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 2/others I oakley-quick[E]: [encrypted hash]</FONT><BR>
<BR>
<BR>
Is all really fine ? looks like success tunnel stablishment for you ? Seems ok for me and the problem arises when traffic should go out from Openswan to Nortel showing the messages I send to you in first e-mail that I can understand:<BR>
<BR>
<FONT SIZE="2">21:11:16.563563 IP (tos 0x0, ttl 64, id 1258, offset 0, flags [DF], proto 17, length: 154) 192.168.5.2.isakmp > vallfogona.isakmp: [no cksum] isakmp 4.4 msgid cookie ->: phase 2/others ? #241[C]: [|#139] (len mismatch: isakmp 1992383718/ip 126)<BR>
21:11:17.563396 IP (tos 0x0, ttl 64, id 1258, offset 0, flags [DF], proto 17, length: 154) 192.168.5.2.isakmp > vallfogona.isakmp: [no cksum] isakmp 12.14 msgid cookie ->: phase 2/others ? #135[]: [|#201] (len mismatch: isakmp 3582546107/ip 126)<BR>
21:11:18.563258 IP (tos 0x0, ttl 64, id 1258, offset 0, flags [DF], proto 17, length: 154) 192.168.5.2.isakmp > vallfogona.isakmp: [no cksum] isakmp 11.3 msgid cookie ->: phase 2/others ? #45[C]: [|sig] (len mismatch: isakmp 176508591/ip 126)</FONT><BR>
<BR>
<BR>
*********************************************<BR>
<BR>
All the same but, Nortel responder and Openswan Initiator. Looks not so good but I'm not sure why it breaks. Peers don't get agree as in first case and nothing is changed (relating to configuration)<BR>
<BR>
Nortel shows:<BR>
<FONT SIZE="2">9 01/03/2000 00:45:04 Send:[SA][VID][VID] N.N.N.N O.O.O.O IKE<BR>
10 01/03/2000 00:45:06 Send:[HASH][DEL] N.N.N.N O.O.O.O IKE<BR>
<B>11 01/03/2000 00:45:06 Send:[HASH][NOTFY:NO_PROP_CHOSEN] N.N.N.N O.O.O.O IKE<BR>
12 01/03/2000 00:45:06 !! No proposal chosen O.O.O.O N.N.N.N IKE</B><BR>
13 01/03/2000 00:45:06 Rule [1] Phase 2 encryption algorithm mismatch O.O.O.O N.N.N.N IKE<BR>
14 01/03/2000 00:45:06 Start Phase 2: Quick Mode O.O.O.O N.N.N.N IKE<BR>
15 01/03/2000 00:45:06 Recv:[HASH][SA][NONCE][ID][ID] O.O.O.O N.N.N.N IKE<BR>
16 01/03/2000 00:45:06 Send:[ID][HASH][NOTFY:INIT_CONTACT] N.N.N.N O.O.O.O IKE<BR>
17 01/03/2000 00:45:06 Recv:[ID][HASH] O.O.O.O N.N.N.N IKE<BR>
18 01/03/2000 00:45:06 Send:[KE][NONCE] N.N.N.N O.O.O.O IKE</FONT><BR>
<BR>
The desired escenario is the first, but the different behaviour could make sense for you or suggest any idea. I thought in reduce the Openswan proposals to the one I know is good (#3) but I don't know how. <BR>
<BR>
<FONT SIZE="2">tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 1514 bytes<BR>
19:33:08.167007 IP (tos 0x0, ttl 64, id 702, offset 0, flags [DF], proto 17, length: 264) 192.168.5.2.isakmp > vallfogona.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 1 I ident:<BR>
(sa: doi=ipsec situation=identity<BR>
(p: #0 protoid=isakmp transform=4<BR>
(t: #0 id=ike (type=lifetype value=sec)(type=lifeduration value=0e10)(type=enc value=3des)(type=hash value=md5)(type=auth value=preshared)(type=group desc value=0005))<BR>
(t: #1 id=ike (type=lifetype value=sec)(type=lifeduration value=0e10)(type=enc value=3des)(type=hash value=md5)(type=auth value=preshared)(type=group desc value=modp1024))<BR>
(t: #2 id=ike (type=lifetype value=sec)(type=lifeduration value=0e10)(type=enc value=3des)(type=hash value=sha1)(type=auth value=preshared)(type=group desc value=0005))<BR>
(t: #3 id=ike (type=lifetype value=sec)(type=lifeduration value=0e10)(type=enc value=3des)(type=hash value=sha1)(type=auth value=preshared)(type=group desc value=modp1024))))<BR>
(vid: len=16 7d9419a65310ca6f2c179d9215529d56)<BR>
(vid: len=16 cd60464335df21f87cfdb2fc68b6a448)<BR>
(vid: len=16 4485152d18b6bbcd0be8a8469579ddcc)<BR>
19:33:09.480576 IP (tos 0x0, ttl 247, id 32047, offset 0, flags [none], proto 17, length: 156) vallfogona.isakmp > 192.168.5.2.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 1 R ident:<BR>
(sa: doi=ipsec situation=identity<BR>
(p: #1 protoid=isakmp transform=1<BR>
(t: #1 id=ike (type=enc value=3des)(type=hash value=sha1)(type=auth value=preshared)(type=group desc value=modp1024)(type=lifetype value=sec)(type=lifeduration len=4 value=00000e10))))<BR>
(vid: len=16 4485152d18b6bbcd0be8a8469579ddcc)<BR>
(vid: len=20 625027749d5ab97f5616c1602765cf480a3b7d0b)<BR>
19:33:09.484055 IP (tos 0x0, ttl 64, id 703, offset 0, flags [DF], proto 17, length: 256) 192.168.5.2.isakmp > vallfogona.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 1 I ident:<BR>
(ke: key len=128 ab43d89d741157e0be227dd0c789793f100041315cee19d3648fcc37672ab4982ade6ea534d2ee4c4bf45d36a75a404cee1172ed4f8f378e24cd2d6120d4e9433a71ba2dd76401462c37e696d53edf0a2eece7f754f86e2be373c89b91e06fd228549b78b67922d32891bb145463858b0eef52cd811314928adbbcf196c4c99d)<BR>
(nonce: n len=16 b953df268c83b71d0032dfa5ebf4a37e)<BR>
(#130)<BR>
(#130)<BR>
19:33:11.063889 IP (tos 0x0, ttl 247, id 32048, offset 0, flags [none], proto 17, length: 260) vallfogona.isakmp > 192.168.5.2.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 1 R ident:<BR>
(ke: key len=128 58507f4e442d7b7f9e066ab0889c0752bc3c7782221e8d3fb8e93561b6f61e778aa1ff5a096bd7f14913ae49191fa2bed7f07c5dfa115118f2cd2ae48341fca98b708467828464a1fea82dcc5c1ce0fb4b006cc5b70950821f96e49b1920b3a206775fda080f7fc3d9cbe15a8fe527a9f7a6255c98f60efa6f5a84d8da68a023)<BR>
(nonce: n len=20 fdf809aef72fd743d3ff95c8c05a02b0117b2d66)<BR>
(#130)<BR>
(#130)<BR>
19:33:11.066983 IP (tos 0x0, ttl 64, id 704, offset 0, flags [DF], proto 17, length: 96) 192.168.5.2.isakmp > vallfogona.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 1 I ident[E]: [encrypted id]<BR>
19:33:11.182885 IP (tos 0x0, ttl 247, id 32049, offset 0, flags [none], proto 17, length: 120) vallfogona.isakmp > 192.168.5.2.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 1 R ident[E]: [encrypted id]<BR>
19:33:11.183960 IP (tos 0x0, ttl 64, id 705, offset 0, flags [DF], proto 17, length: 208) 192.168.5.2.isakmp > vallfogona.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 2/others I oakley-quick[E]: [encrypted hash]<BR>
19:33:11.308663 IP (tos 0x0, ttl 247, id 32050, offset 0, flags [none], proto 17, length: 96) vallfogona.isakmp > 192.168.5.2.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 2/others R inf[E]: [encrypted hash]<BR>
19:33:11.318585 IP (tos 0x0, ttl 247, id 32051, offset 0, flags [none], proto 17, length: 112) vallfogona.isakmp > 192.168.5.2.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 2/others R inf[E]: [encrypted hash]<BR>
19:33:16.317470 IP (tos 0x0, ttl 64, id 706, offset 0, flags [DF], proto 17, length: 29) 192.168.5.2.isakmp > vallfogona.isakmp: [udp sum ok] [|isakmp]<BR>
19:33:21.316747 IP (tos 0x0, ttl 64, id 707, offset 0, flags [DF], proto 17, length: 208) 192.168.5.2.isakmp > vallfogona.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 2/others I oakley-quick[E]: [encrypted hash]<BR>
19:33:36.314441 IP (tos 0x0, ttl 64, id 708, offset 0, flags [DF], proto 17, length: 29) 192.168.5.2.isakmp > vallfogona.isakmp: [udp sum ok] [|isakmp]<BR>
19:33:41.178778 IP (tos 0x0, ttl 64, id 709, offset 0, flags [DF], proto 17, length: 208) 192.168.5.2.isakmp > vallfogona.isakmp: [udp sum ok] isakmp 1.0 msgid cookie ->: phase 2/others I oakley-quick[E]: [encrypted hash]<BR>
19:33:56.176423 IP (tos 0x0, ttl 64, id 710, offset 0, flags [DF], proto 17, length: 29) 192.168.5.2.isakmp > vallfogona.isakmp: [udp sum ok] [|isakmp]<BR>
19:34:16.254374 IP (tos 0x0, ttl 64, id 711, offset 0, flags [DF], proto 17, length: 29) 192.168.5.2.isakmp > vallfogona.isakmp: [udp sum ok] [|isakmp]<BR>
19:34:21.254290 IP (tos 0x0, ttl 64, id 712, offset 0, flags [DF], proto 17, length: 208)</FONT><BR>
<BR>
</BODY>
</HTML>