I searched around a bit more and got OpenS/WAN to get a little further,
but I'm having new issues now. I'm running openswan 2.4.0 on
AMD64 Ubuntu Breezy. The linux box is being a Zyxell Firewall
which has IPSec VPN passthrough enabled. So, when I say "my
public ip", I mean the one assigned to the firewall, not the linux box
itself. The linux box has a private ip 192.168.1.xxx address.<br>
<br>
<br>
Here is the info I get from starting the ipsec service and running "ipsec auto --up myconn":<br>
<br>
104 "myconn" #1: STATE_MAIN_I1: initiate<br>
003 "myconn" #1: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] method set to=108<br>
106 "myconn" #1: STATE_MAIN_I2: sent MI2, expecting MR2<br>
003 "myconn" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: both are NATed<br>
108 "myconn" #1: STATE_MAIN_I3: sent MI3, expecting MR3<br>
004 "myconn" #1: STATE_MAIN_I4: ISAKMP SA established
{auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5
group=modp1024}<br>
117 "myconn" #2: STATE_QUICK_I1: initiate<br>
010 "myconn" #2: STATE_QUICK_I1: retransmission; will wait 20s for response<br>
010 "myconn" #2: STATE_QUICK_I1: retransmission; will wait 40s for response<br>
031 ""myconn"" #2: max number of retransmissions (2) reached
STATE_QUICK_I1. No acceptable response to our first Quick Mode
message: perhaps peer likes no proposal<br>
000 "myconn" #2: starting keying attempt 2 of at most 3, but releasing whack<br>
<br>
<br>
<br>
Here's my ipsec.conf file:<br>
<br>
# /etc/ipsec.conf - Openswan IPsec configuration file<br>
# Manual: ipsec.conf.5<br>
version 2.0 # conforms to second version of ipsec.conf specification<br>
<br>
# basic configuration<br>
config setup<br>
nat_traversal=yes<br>
<br>
# Add connections here<br>
conn myconn<br>
type=tunnel<br>
compress=no<br>
keyingtries=3<br>
authby=secret<br>
auth=esp<br>
left=%defaultroute<br>
leftid=xxx.xxx.xxx.xxx (my public IP)<br>
right=xxx.xxx.xxx.xxx (company's public IP -
Watchguard Firebox II, version 7.x)<br>
rightsubnet=<a href="http://192.168.0.0/255.255.255.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.0.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.0.0/255.255.255.0</a>
(company's internal IP range)<br>
rightid=xxx.xxx.xxx.xxx (company's public IP again)<br>
aggrmode=no<br>
auto=add<br>
esp=3des-md5<br>
ike=3des-md5<br>
pfs=yes<br>
<br>
#Disable Opportunistic Encryption<br>
include /etc/ipsec.d/examples/no_oe.conf<br>
<br>
<br>
<br>
Here's the log on the Watchguard Monitor:<br>
<br>
01/27/06 14:58 iked[169]: FROM <my public IP> IF-HDR* -C0B3901E ISA_HASH
<br>
01/27/06 14:58 iked[169]: Received a packet for an unknown SA
<br>
01/27/06 14:58 iked[169]: Received a packet for an unknown SA
<br>
01/27/06 14:58 iked[169]: FROM <my public IP>
MM-HDR ISA_SA ISA_VENDORID ISA_VENDORID ISA_VENDORID
ISA_VENDORID ISA_VENDORID ISA_VENDORID
<br>
01/27/06 14:58 iked[169]: TO <my public IP> MM-HDR ISA_SA ISA_VENDORID
<br>
01/27/06 14:58 iked[169]: FROM <my public IP> MM-HDR ISA_KE ISA_NONCE NAT-D NAT-D
<br>
01/27/06 14:58 iked[169]: TO <my public IP> MM-HDR ISA_KE ISA_NONCE NAT-D NAT-D
<br>
01/27/06 14:58 iked[169]: CRYPTO ACTIVE after delay
<br>
01/27/06 14:58 iked[169]: FROM <my public IP> MM-HDR*# ISA_ID ISA_HASH
<br>
01/27/06 14:58 iked[169]: TO <my public IP> MM-HDR*# ISA_ID ISA_HASH
<br>
01/27/06 14:58 iked[169]: FROM <my public IP>
QM-HDR*#-12573EF3 ISA_HASH ISA_SA ISA_NONCE ISA_KE ISA_ID ISA_ID
<br>
01/27/06 14:58 iked[169]: WARNING - No Matching IPSec Policy found for <my public IP><br>
01/27/06 14:58 iked[169]: ACTION - Verify VPN IPSec Policies for <my public IP><br>
01/27/06 14:58 iked[169]: get_ipsec_pref: Unable to find channel info for remote(<my public IP>)
<br>
01/27/06 14:58 iked[169]: Sending INVALID_ID_INFO message
<br>
01/27/06 14:58 iked[169]: TO <my public IP> IF-HDR*#-8E61875F ISA_HASH ISA_NOTIFY
<br>
01/27/06 14:58 iked[169]: Quick Mode processing failed<br>
<br>
<br>
<br>
Hmm.. maybe it's on the Watchguard box, after reviewing these
logs.. Although everything looks correct on that side.
Anyway, if anyone has any suggestions, I'm about at my wits end on this
issue. Thanks in advance!<br>