<p>I tested openswan 2.4.2dr5 in my home network last night.</p>
<p>pc-a======gw-a=====sw=======gw-b=====pc-b</p>
<p>both gw-a & gw-b are openswan 2.4.2dr5 + klips+kernel2.6.13.2(lfs)<br>both gw-a & gw-b use static ip address .</p>
<p><br>**************************************<br>gw-a is initiator , gw-b is responder<br>**************************************</p>
<p>I did these test:<br>a. both gw-a & gw-b use main mode and with nat_traversal=no ,it's ok.<br>b. both gw-a & gw-b use main mode and with nat_traversal=yes ,it's ok.<br>c. both gw-a & gw-b use aggressive mode and with nat_traversal=no, it's ok.
<br>d. both gw-a & gw-b use aggressive mode and with nat_traversal=yes, failed.</p>
<p><br>the config is as below, config for gw-b is almost the same except the lefXXX and rightXXX. </p>
<p>ipsec.conf for gw-a</p>
<p>config setup<br> interfaces="%defaultroute"<br> forwardcontrol=no<br> pluto=yes<br> plutowait=no<br> nat_traversal=yes<br> uniqueids=yes <br>conn test<br> type=tunnel<br> auto=add<br>
left=%defaultroute<br> keyexchange=ike<br> keylife=12h<br> auth=esp<br> esp=aes128-sha1<br> pfs=no<br> compress=no<br> disablearrivalcheck=no<br> failureshunt=drop<br> rekeyfuzz=80%
<br> rekeymargin=9m<br> leftsubnet=<a href="http://10.10.12.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.12.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.10.12.0/24</a><br> rightsubnet=<a href="http://192.168.1.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.0/24</a><br> aggrmode=yes<br> leftid=xxxxxxxxxxxxx<br> right=
<a href="http://192.168.121.114"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.121.114" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.121.114</a><br> rightid=xxxxxxxxxxxxxxxx<br> ike=aes-sha1-modp1024<br> ikelifetime=1h<br> authby=secret<br> rekey=yes<br> keyingtries=%forever<br>#end of config
</p>
<p> </p>
<p>segment of auth.log</p>
<p><br>Oct 28 23:13:34 firewall pluto[4618]: added connection description "test"<br>Oct 28 23:13:53 firewall pluto[4618]: "test" #4: initiating Aggressive Mode #4, connection "test"<br>Oct 28 23:13:53 firewall pluto[4618]: "test" #4: message ignored because it contains an unknown or unexpected payload type (ISAKMP_NEXT_NAT-D) at the outermost level
<br>Oct 28 23:13:53 firewall pluto[4618]: "test" #4: sending notification INVALID_PAYLOAD_TYPE to <a href="http://192.168.121.114:500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.121.114:500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.121.114:500</a><br>Oct 28 23:14:03 firewall pluto[4618]: "test" #4: message ignored because it contains an unknown or unexpected payload type (ISAKMP_NEXT_NAT-D) at the outermost level
<br>Oct 28 23:14:03 firewall pluto[4618]: "test" #4: sending notification INVALID_PAYLOAD_TYPE to <a href="http://192.168.121.114:500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.121.114:500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.121.114:500</a><br>Oct 28 23:14:03 firewall pluto[4618]: "test" #4: message ignored because it contains an unknown or unexpected payload type (ISAKMP_NEXT_NAT-D) at the outermost level
<br>Oct 28 23:14:03 firewall pluto[4618]: "test" #4: sending notification INVALID_PAYLOAD_TYPE to <a href="http://192.168.121.114:500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.121.114:500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.121.114:500</a></p>
<p> </p>
<p><br>I then did another tests:</p>
<p>e.gw-a aggressive mode + nat_traversal=no <br> gw-b aggressive mode +nat_traversa=yes , failed.<br> <br> the logs of auth.log is like test d.</p>
<p>f.gw-a aggressive mode + nat _traversal=yes<br> gw-b aggressive mode +nat_traversal=no , it's ok.<br> <br> <br> <br>It seems that openswan-2.4.2dr5 don't like work as a responder if <br>use aggressive mode + nat_travresal=yes.
</p>
<p> <br>Of cause it faild when I add a nat box between gw-a and gw-b with <br>aggressive mode + nat_traversal=yes. the logs like test d.</p>