<p>pc1----gw1----nat---sw---gw2----pc2</p>
<p>gw1: WAN <a href="http://10.10.2.1"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.2.1" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.10.2.1</a><br> LAN <a href="http://192.168.1.1/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.1" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.1/24</a><br> <br>nat: WAN <a href="http://192.168.100.254"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.100.254" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.100.254</a><br> LAN: <a href="http://10.10.2.2"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.2.2" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
10.10.2.2</a></p>
<p>gw2: WAN <a href="http://132.132.100.190"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "132.132.100.190" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 132.132.100.190</a><br> LAN <a href="http://192.168.16.1/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.16.1" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.16.1/24</a><br> <br>both gw1 &gw2 are openswan2.4.0 +kernel <a href="http://2.6.13.2"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "2.6.13.2" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 2.6.13.2
</a><br> <br>gw1 ipsec.conf</p>
<p>version 2.0<br>config setup<br> interfaces="%defaultroute"<br> forwardcontrol=no<br> <a href="mailto:myid=@XXXXXXX">myid=@XXXXXXX</a><br> pluto=yes<br> plutowait=no<br> nat_traversal=yes<br>
virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.1.0/24,%v4:!10.10.2.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.0.0.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.1.0/24,%v4:!10.10.2.0/24</a><br> uniqueids=yes
<br>#connection config for sh_bj<br>conn sh_bj<br> type=tunnel<br> auto=add<br> left=%defaultroute<br> keyexchange=ike<br> keylife=12h<br> auth=esp<br> esp=aes128-sha1<br> pfs=no<br> compress=no
<br> disablearrivalcheck=no<br> failureshunt=drop<br> rekeyfuzz=80%<br> rekeymargin=9m<br> leftsubnet=<a href="http://192.168.1.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.0/24</a><br> rightsubnet=<a href="http://192.168.16.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.16.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.16.0/24</a><br> aggrmode=yes<br> leftid=xxxxxxxxxxx<br> right=<a href="http://132.132.100.190"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "132.132.100.190" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 132.132.100.190</a><br> rightid=xxxxxxxxx<br> ike=aes-sha1-modp1024<br> ikelifetime=1h<br> authby=secret
<br> rekey=yes<br> keyingtries=%forever<br>#end of config</p>
<p><br>ipsec auto --status output:</p>
<p>$ ipsec auto --status<br>000 interface ipsec0/eth1 <a href="http://10.10.2.1"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.2.1" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.10.2.1</a><br>000 interface ipsec0/eth1 <a href="http://10.10.2.1"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.2.1" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.10.2.1</a><br>000 %myid = xxxxxxxxx<br>000 debug none<br>000 <br>
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64, keysizemin=192, keysizemax=192<br>000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=128, keysizemin=128, keysizemax=256<br>000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
<br>000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160<br>000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128<br>000 <br>000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192
<br>000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128<br>000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<br>000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<br>000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
<br>000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536<br>000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048<br>000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
<br>000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096<br>000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144<br>000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
<br>000 <br>000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,1,36} trans={0,1,108} attrs={0,1,72} <br>000 <br>000 "sh_bj": <a href="http://192.168.1.0/24===10.10.2.1[xxxxxxxx]---10.10.2.2...132.132.100.190[xxxxxxxx]===192.168.16.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.0/24===10.10.2.1[xxxxxxxx]---10.10.2.2...132.132.100.190[xxxxxxxx]===192.168.16.0/24</a>; prospective erouted; eroute owner: #0<br>000 "sh_bj": srcip=unset; dstip=unset; srcup=ipsec _updown; dstup=ipsec _updown;
<br>000 "sh_bj": ike_life: 3600s; ipsec_life: 43200s; rekey_margin: 540s; rekey_fuzz: 80%; keyingtries: 0<br>000 "sh_bj": policy: PSK+ENCRYPT+TUNNEL+UP+AGGRESSIVE+failureDROP; prio: 24,24; interface: eth1;
<br>000 "sh_bj": dpd: action:hold; delay:30; timeout:120; <br>000 "sh_bj": newest ISAKMP SA: #0; newest IPsec SA: #0; <br>000 "sh_bj": IKE algorithms wanted: 7_000-2-2, flags=-strict<br>
000 "sh_bj": IKE algorithms found: 7_128-2_160-2, <br>000 "sh_bj": ESP algorithms wanted: 12_128-2, flags=-strict<br>000 "sh_bj": ESP algorithms loaded: 12_128-2, flags=-strict<br>000
<br>000 #10: "sh_bj":500 STATE_AGGR_I1 (sent AI1, expecting AR1); EVENT_RETRANSMIT in 5s; nodpd<br>000 </p>
<p><br>seg of auto.log <br>26 11:03:05 firewall pluto[21786]: "sh_bj" #1: initiating Aggressive Mode #1, connection "sh_bj"<br>Oct 26 11:03:05 firewall pluto[21786]: "sh_bj" #1: message ignored because it contains an unknown or unexpected payload type (ISAKMP_NEXT_NAT-D) at the outermost level
<br>Oct 26 11:03:05 firewall pluto[21786]: "sh_bj" #1: sending notification INVALID_PAYLOAD_TYPE to <a href="http://132.132.100.190:500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "132.132.100.190:500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 132.132.100.190:500</a><br>Oct 26 11:03:15 firewall pluto[21786]: "sh_bj" #1: message ignored because it contains an unknown or unexpected payload type (ISAKMP_NEXT_NAT-D) at the outermost level
<br>Oct 26 11:03:15 firewall pluto[21786]: "sh_bj" #1: sending notification INVALID_PAYLOAD_TYPE to <a href="http://132.132.100.190:500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "132.132.100.190:500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 132.132.100.190:500</a><br></p>