<DIV>Paul, I have logged the Oakley logs... but cant understand them can u figure out... I dont get any errors in my VPN server logs..</DIV>
<DIV> </DIV>
<DIV>Logs are below</DIV>
<DIV> </DIV>
<DIV> 5-10: 09:11:24:762:554 Initialization OK<BR> 5-10: 09:11:45:632:554 isadb_schedule_kill_oldPolicy_sas: 40db2282-11b8-4e85-b940c4f6beee4822 4<BR> 5-10: 09:11:45:632:554 isadb_schedule_kill_oldPolicy_sas: 6a0aebec-6b2c-4bd3-bcab9c22da4c46d2 4<BR> 5-10: 09:11:45:632:554 isadb_schedule_kill_oldPolicy_sas: ae561592-1846-4185-98c467319ae5b719 3<BR> 5-10: 09:11:45:632:554 isadb_schedule_kill_oldPolicy_sas: 4855472b-c57f-40a8-aff10c3db39e6773 3<BR> 5-10: 09:11:45:632:554 isadb_schedule_kill_oldPolicy_sas: a6f53fb9-a60b-422d-9c099d1e73e355d8 1<BR> 5-10: 09:11:45:632:554 isadb_schedule_kill_oldPolicy_sas: 6c29f547-c022-4764-820245d8971bb05b 2<BR> 5-10: 09:11:45:632:554 isadb_schedule_kill_oldPolicy_sas: b204636c-949a-473a-9bb36197ce0225ca 2<BR> 5-10: 09:11:45:632:b08 entered kill_old_policy_sas 4<BR> 5-10: 09:11:45:632:b08 entered kill_old_policy_sas 4<BR> 5-10: 09:11:45:632:b08 entered kill_old_policy_sas 3<BR> 5-10:
09:11:45:632:b08 entered kill_old_policy_sas 3<BR> 5-10: 09:11:45:632:b08 entered kill_old_policy_sas 1<BR> 5-10: 09:11:45:632:b08 entered kill_old_policy_sas 2<BR> 5-10: 09:11:45:632:b08 entered kill_old_policy_sas 2<BR> 5-10: 09:12:03:37:894 Acquire from driver: op=00000008 src=192.168.1.2.0 dst=192.168.2.234.0 proto = 0, SrcMask=255.255.255.255, DstMask=255.255.255.0, Tunnel 1, TunnelEndpt=202.149.x.x Inbound TunnelEndpt=192.168.1.2<BR> 5-10: 09:12:03:37:b08 Filter to match: Src 202.149.x.x Dst 192.168.1.2<BR> 5-10: 09:12:03:37:b08 MM PolicyName: 2<BR> 5-10: 09:12:03:37:b08 MMPolicy dwFlags 2 SoftSAExpireTime 28800<BR> 5-10: 09:12:03:37:b08 MMOffer[0] LifetimeSec 28800 QMLimit 1 DHGroup 2<BR> 5-10: 09:12:03:37:b08 MMOffer[0] Encrypt: Triple DES CBC Hash: SHA<BR> 5-10: 09:12:03:37:b08 MMOffer[1] LifetimeSec 28800 QMLimit 1 DHGroup 2<BR> 5-10: 09:12:03:37:b08 MMOffer[1] Encrypt: Triple DES CBC Hash: MD5<BR> 5-10:
09:12:03:37:b08 MMOffer[2] LifetimeSec 28800 QMLimit 1 DHGroup 1<BR> 5-10: 09:12:03:37:b08 MMOffer[2] Encrypt: DES CBC Hash: SHA<BR> 5-10: 09:12:03:37:b08 MMOffer[3] LifetimeSec 28800 QMLimit 1 DHGroup 1<BR> 5-10: 09:12:03:37:b08 MMOffer[3] Encrypt: DES CBC Hash: MD5<BR> 5-10: 09:12:03:37:b08 Auth[0]:RSA Sig C=IN, S=Maharashtra, L=Mumbai, O=Net, OU=IT, CN=Deepak, <A href="mailto:E=deepak@company.com">E=deepak@company.com</A> AuthFlags 0<BR> 5-10: 09:12:03:47:b08 QM PolicyName: Host-roadwarrior filter action dwFlags 1<BR> 5-10: 09:12:03:47:b08 QMOffer[0] LifetimeKBytes 50000 LifetimeSec 3600<BR> 5-10: 09:12:03:47:b08 QMOffer[0] dwFlags 0 dwPFSGroup -2147483648<BR> 5-10: 09:12:03:47:b08 Algo[0] Operation: ESP Algo: Triple DES CBC HMAC: MD5<BR> 5-10: 09:12:03:47:b08 Starting Negotiation: src = 192.168.1.2.0500, dst = 202.149.x.x.0500, proto = 00, context = 00000008, ProxySrc = 192.168.1.2.0000, ProxyDst = 192.168.2.0.0000 SrcMa
sk =
255.255.255.255 DstMask = 255.255.255.0<BR> 5-10: 09:12:03:47:b08 constructing ISAKMP Header<BR> 5-10: 09:12:03:47:b08 constructing SA (ISAKMP)<BR> 5-10: 09:12:03:47:b08 Constructing Vendor MS NT5 ISAKMPOAKLEY<BR> 5-10: 09:12:03:47:b08 Constructing Vendor FRAGMENTATION<BR> 5-10: 09:12:03:47:b08 Constructing Vendor draft-ietf-ipsec-nat-t-ike-02<BR> 5-10: 09:12:03:47:b08 Constructing Vendor Vid-Initial-Contact<BR> 5-10: 09:12:03:47:b08 <BR> 5-10: 09:12:03:47:b08 Sending: SA = 0x000F0668 to 202.149.x.x:Type 2.500<BR> 5-10: 09:12:03:47:b08 ISAKMP Header: (V1.0), len = 276<BR> 5-10: 09:12:03:47:b08 I-COOKIE 5415e04dba12c029<BR> 5-10: 09:12:03:47:b08 R-COOKIE 0000000000000000<BR> 5-10: 09:12:03:47:b08 exchange: Oakley Main Mode<BR> 5-10: 09:12:03:47:b08 flags: 0<BR> 5-10: 09:12:03:47:b08 next payload: SA<BR> 5-10: 09:12:03:47:b08 messag
e ID:
00000000<BR> 5-10: 09:12:03:47:b08 Ports S:f401 D:f401<BR> 5-10: 09:12:03:107:b08 <BR> 5-10: 09:12:03:107:b08 Receive: (get) SA = 0x000f0668 from 202.149.x.x.500<BR> 5-10: 09:12:03:107:b08 ISAKMP Header: (V1.0), len = 140<BR> 5-10: 09:12:03:107:b08 I-COOKIE 5415e04dba12c029<BR> 5-10: 09:12:03:107:b08 R-COOKIE 23ebe6fb7bc0825f<BR> 5-10: 09:12:03:107:b08 exchange: Oakley Main Mode<BR> 5-10: 09:12:03:107:b08 flags: 0<BR> 5-10: 09:12:03:107:b08 next payload: SA<BR> 5-10: 09:12:03:107:b08 message ID: 00000000<BR> 5-10: 09:12:03:107:b08 processing payload SA<BR> 5-10: 09:12:03:107:b08 Received Phase 1 Transform 1<BR> 5-10: 09:12:03:107:b08 Encryption Alg Triple DES CBC(5)<BR> 5-10: 09:12:03:107:b08 Hash Alg SHA(2)<BR> 5-10: 09:12:03:107:b08 Oakley
Group
2<BR> 5-10: 09:12:03:107:b08 Auth Method RSA Signature with Certificates(3)<BR> 5-10: 09:12:03:107:b08 Life type in Seconds<BR> 5-10: 09:12:03:107:b08 Life duration of 28800<BR> 5-10: 09:12:03:107:b08 Phase 1 SA accepted: transform=1<BR> 5-10: 09:12:03:107:b08 SA - Oakley proposal accepted<BR> 5-10: 09:12:03:107:b08 processing payload VENDOR ID<BR> 5-10: 09:12:03:107:b08 processing payload VENDOR ID<BR> 5-10: 09:12:03:107:b08 processing payload VENDOR ID<BR> 5-10: 09:12:03:107:b08 Received VendorId draft-ietf-ipsec-nat-t-ike-02<BR> 5-10: 09:12:03:107:b08 ClearFragList<BR> 5-10: 09:12:03:107:b08 constructing ISAKMP Header<BR> 5-10: 09:12:03:167:b08 constructing KE<BR> 5-10: 09:12:03:167:b08 constructing NONCE (ISAKMP)<BR> 5-10: 09:12:03:167:b08 Constructing NatDisc<BR> 5-10: 09:12:03:167:b08 <BR> 5-10:
09:12:03:167:b08 Sending: SA = 0x000F0668 to 202.149.x.x:Type 2.500<BR> 5-10: 09:12:03:167:b08 ISAKMP Header: (V1.0), len = 232<BR> 5-10: 09:12:03:167:b08 I-COOKIE 5415e04dba12c029<BR> 5-10: 09:12:03:167:b08 R-COOKIE 23ebe6fb7bc0825f<BR> 5-10: 09:12:03:167:b08 exchange: Oakley Main Mode<BR> 5-10: 09:12:03:167:b08 flags: 0<BR> 5-10: 09:12:03:167:b08 next payload: KE<BR> 5-10: 09:12:03:167:b08 message ID: 00000000<BR> 5-10: 09:12:03:167:b08 Ports S:f401 D:f401<BR> 5-10: 09:12:03:248:b08 <BR> 5-10: 09:12:03:248:b08 Receive: (get) SA = 0x000f0668 from 202.149.x.x.500<BR> 5-10: 09:12:03:248:b08 ISAKMP Header: (V1.0), len = 228<BR> 5-10: 09:12:03:248:b08 I-COOKIE 5415e04dba12c029<BR> 5-10: 09:12:03:248:b08 R-COOKIE 23ebe6fb7bc0825f<BR> 5-10: 09:12:03:248:b08 exchange: Oakley Main Mode<BR> 5-10:
09:12:03:248:b08 flags: 0<BR> 5-10: 09:12:03:248:b08 next payload: KE<BR> 5-10: 09:12:03:248:b08 message ID: 00000000<BR> 5-10: 09:12:03:248:b08 processing payload KE<BR> 5-10: 09:12:03:268:b08 processing payload NONCE<BR> 5-10: 09:12:03:268:b08 processing payload NATDISC<BR> 5-10: 09:12:03:268:b08 Processing NatHash<BR> 5-10: 09:12:03:268:b08 Nat hash 923d1b992e53e76e6620d9ab298cfae6<BR> 5-10: 09:12:03:268:b08 9c6f18d7<BR> 5-10: 09:12:03:268:b08 SA StateMask2 1f<BR> 5-10: 09:12:03:268:b08 processing payload NATDISC<BR> 5-10: 09:12:03:268:b08 Processing NatHash<BR> 5-10: 09:12:03:268:b08 Nat hash d8e12d6b3b0f4e3765e5d3c53303204b<BR> 5-10: 09:12:03:268:b08 5780daf8<BR> 5-10: 09:12:03:268:b08 SA StateMask2 5f<BR> 5-10: 09:12:03:268:b08 ClearFragList<BR> 5-10: 09:12:03:268:b08 Peer behind NAT<BR> 5-10: 09:12:03:268:b08 Floated Ports Orig Me:f401
Peer:f401<BR> 5-10: 09:12:03:268:b08 Floated Ports Me:9411 Peer:9411<BR> 5-10: 09:12:03:268:b08 constructing ISAKMP Header<BR> 5-10: 09:12:03:268:b08 constructing ID<BR> 5-10: 09:12:03:268:b08 Received no valid CRPs. Using all configured<BR> 5-10: 09:12:03:268:b08 Looking for IPSec only cert<BR> 5-10: 09:12:03:268:b08 failed to get chain 80092004<BR> 5-10: 09:12:03:268:b08 Looking for any cert<BR> 5-10: 09:12:03:268:b08 failed to get chain 80092004<BR> 5-10: 09:12:03:268:b08 ProcessFailure: sa:000F0668 centry:00000000 status:35ee<BR> 5-10: 09:12:03:268:b08 isadb_set_status sa:000F0668 centry:00000000 status 35ee<BR> 5-10: 09:12:03:268:b08 Key Exchange Mode (Main Mode)<BR> 5-10: 09:12:03:268:b08 Source IP Address 192.168.1.2 Source IP Address Mask 255.255.255.255 Destination IP Address 202.149.x.x Destination IP Address Mask 255.255.255.255 Protocol 0 Source Port 0 Destinatio
n Port
0 IKE Local Addr 192.168.1.2 IKE Peer Addr 202.149.x.x<BR> 5-10: 09:12:03:268:b08 Certificate based Identity. Peer IP Address: 202.149.x.x<BR> 5-10: 09:12:03:268:b08 Me<BR> 5-10: 09:12:03:268:b08 IKE failed to find valid machine certificate<BR> 5-10: 09:12:03:268:b08 0x80092004 0x0<BR> 5-10: 09:12:03:268:b08 ProcessFailure: sa:000F0668 centry:00000000 status:35ee<BR> 5-10: 09:12:03:268:b08 constructing ISAKMP Header<BR> 5-10: 09:12:03:268:b08 constructing HASH (null)<BR> 5-10: 09:12:03:268:b08 constructing NOTIFY 28<BR> 5-10: 09:12:03:268:b08 constructing HASH (Notify/Delete)<BR> 5-10: 09:12:03:268:b08 <BR> 5-10: 09:12:03:268:b08 Sending: SA = 0x000F0668 to 202.149.x.x:Type 1.4500<BR> 5-10: 09:12:03:268:b08 ISAKMP Header: (V1.0), len = 84<BR> 5-10: 09:12:03:268:b08 I-COOKIE 5415e04dba12c029<BR> 5-10: 09:12:03:268:b08 R-COOKIE 23ebe6fb7bc0825f<BR> 5
-10:
09:12:03:268:b08 exchange: ISAKMP Informational Exchange<BR> 5-10: 09:12:03:268:b08 flags: 1 ( encrypted )<BR> 5-10: 09:12:03:268:b08 next payload: HASH<BR> 5-10: 09:12:03:268:b08 message ID: 04eea425<BR> 5-10: 09:12:03:268:b08 Ports S:9411 D:9411<BR> 5-10: 09:12:13:322:b08 <BR> 5-10: 09:12:13:332:b08 Receive: (get) SA = 0x000f0668 from 202.149.x.x.500<BR> 5-10: 09:12:13:332:b08 ISAKMP Header: (V1.0), len = 228<BR> 5-10: 09:12:13:332:b08 I-COOKIE 5415e04dba12c029<BR> 5-10: 09:12:13:332:b08 R-COOKIE 23ebe6fb7bc0825f<BR> 5-10: 09:12:13:332:b08 exchange: Oakley Main Mode<BR> 5-10: 09:12:13:332:b08 flags: 0<BR> 5-10: 09:12:13:332:b08 next payload: KE<BR> 5-10: 09:12:13:332:b08 message ID: 00000000<BR> 5-10: 09:12:13:332:b08 received an unencrypted packet when crypto active<BR> 5-10:
09:12:13:332:b08 GetPacket failed 35ec<BR> 5-10: 09:12:33:321:b08 <BR> 5-10: 09:12:33:321:b08 Receive: (get) SA = 0x000f0668 from 202.149.x.x.500<BR> 5-10: 09:12:33:321:b08 ISAKMP Header: (V1.0), len = 228<BR> 5-10: 09:12:33:321:b08 I-COOKIE 5415e04dba12c029<BR> 5-10: 09:12:33:321:b08 R-COOKIE 23ebe6fb7bc0825f<BR> 5-10: 09:12:33:321:b08 exchange: Oakley Main Mode<BR> 5-10: 09:12:33:321:b08 flags: 0<BR> 5-10: 09:12:33:321:b08 next payload: KE<BR> 5-10: 09:12:33:321:b08 message ID: 00000000<BR> 5-10: 09:12:33:321:b08 received an unencrypted packet when crypto active<BR> 5-10: 09:12:33:321:b08 GetPacket failed 35ec<BR></DIV>
<DIV> </DIV>
<DIV>The logs are below<BR><BR><B><I>Paul Wouters <paul@xelerance.com></I></B> wrote:</DIV>
<BLOCKQUOTE class=replbq style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #1010ff 2px solid">On Mon, 9 May 2005, Deepak Naidu wrote:<BR><BR>> C:\ipsec>ping 192.168.2.234<BR>> Pinging 192.168.2.234 with 32 bytes of data:<BR>> Negotiating IP Security.<BR>> Request timed out.<BR>> Request timed out.<BR>> Request timed out.<BR>> Ping statistics for 192.168.2.234:<BR>> Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),<BR><BR>Check the oakley.log to see what Windows thinks is happening. And<BR>check the openswan logs to see what it is saying. Though likely,<BR>if this is a windows misconfiguration, openswan will just log<BR>"no response to....." entries.<BR><BR>See the wiki on how to enable oakley.log on windows.<BR><BR>Paul<BR><BR>><BR>> Deepak Naidu <DEEPAK_NAI@YAHOO.COM>wrote:<BR>> Hi,<BR>><BR>> I am using Openswan 2.3.1 VPN server on FC3<BR>> 2.6.9smp kernel. It is behind a NAT and I have natted<BR>> ports 4500, and 5
00. The
issue is when using<BR>> l2tpd+x509cert from Winxp with VPN dialer is working<BR>> fine. But when using Mullers' ipsec.exe tool, with<BR>> the below configs in the ipsec.conf of Winxp pc.... I<BR>> am unable to ping my network.. It doesnt even give<BR>> negotiating message, but host unreacheable....<BR>><BR>> Should I have to write some more firewall rules to<BR>> open the ports in my NAT.<BR>><BR>> I have SP2 with support tools and ipseccmd.exe file..<BR>><BR>> Winxp is a roadwarrior on dialup...<BR>><BR>> Please advise me...<BR>><BR>> Ipsec.conf on Winxp...<BR>><BR>> conn roadwarrior<BR>> pfs=yes<BR>> left=%any<BR>> right=202.x.x.x<BR>> rightsubnet=192.168.2.0/24<BR>> rightca="C=IN, S=state, L=location, O=company,<BR>> OU=IT, CN=name, E=name@company.com"<BR>> network=auto<BR>> auto=start<BR>><BR>><BR>> Regards,<BR>> Deepak.<BR>><BR>><BR>><BR>>
___________________________________________________________<BR>> How much free photo storage do you get? Store your holiday<BR>> snaps for FREE with Yahoo! Photos http://uk.photos.yahoo.com<BR>> _______________________________________________<BR>> Users mailing list<BR>> Users@openswan.org<BR>> http://lists.openswan.org/mailman/listinfo/users<BR>><BR>><BR>> ---------------------------------<BR>> How much free photo storage do you get? Store your holiday snaps for FREE with Yahoo! Photos. Get Yahoo! Photos<BR></BLOCKQUOTE><p>
<hr size=1> <font size="2" face="Verdana, Arial, Helvetica, sans-serif"><a href="http://uk.messenger.yahoo.com"><strong><font face="Arial, Helvetica, sans-serif">Yahoo! Messenger</font></strong></a><font face="Arial, Helvetica, sans-serif"><strong>
- want a free & easy way to contact your friends online?</strong></font><strong><font color="#FF9900">
</font></strong></font>