<span style="font-family: verdana;">Hello,</span><br style="font-family: verdana;"><br style="font-family: verdana;"><span style="font-family: verdana;">I have the following scenario:</span><br><br><br><div style="margin-left: 40px;">
<span style="font-family: courier new,monospace;">openswan linux box checkpoint vpn-1 (r55)</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">
<a href="http://192.168.41.0/24========69.a.b.c..................69.x.y.z========69.q.w.e/32"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.41.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.41.0/24========69.a.b.c..................69.x.y.z========69.q.w.e/32</a></span><br></div><br><br><br><span style="font-family: verdana;">
and another tunnel:<br><br><br></span><div style="margin-left: 40px;"><span style="font-family: courier new,monospace;"> openswan linux box checkpoint vpn-1 (r55)</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"><a href="http://192.168.41.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.41.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.41.0/24</a></span><span style="font-family: courier new,monospace;">========</span><span style="font-family: courier new,monospace;">
69.a.b.c..................69.x.y.z</span><span style="font-family: courier new,monospace;">========</span><span style="font-family: courier new,monospace;">69.p.o.i/32</span></div><br><br><br><span style="font-family: verdana;">
In thist environment <a href="http://192.168.41.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.41.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.41.0/24</a> must access 69.q.w.e/32 and 69.p.o.i/32 must access <a href="http://192.168.41.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.41.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.41.0/24</a></span><br><br><br><span style="font-family: verdana;">
With this 'ipsec.conf':</span><br><br><div style="margin-left: 40px;"><span style="font-family: courier new,monospace;">version 2.0 # conforms to second version of ipsec.conf specification</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;">config setup</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> # Debug-logging controls: "none" for (almost) none, "all" for lots.
</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> interfaces="ipsec0=eth0"</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">
klipsdebug="none"</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> plutodebug="control parsing"</span><br style="font-family: courier new,monospace;">
<br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">conn net-sercom-net-dedalus</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">
type=tunnel</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> left=69.x.y.z</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">
leftsubnet=69.q.w.e/32</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> right=69.a.b.c</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">
rightsubnet=<a href="http://192.168.41.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.41.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.41.0/24</a></span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> keyexchange=ike</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"> ikelifetime=1440m</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> auth=esp</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"> pfs=no</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> esp=3des-md5-96</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"> authby=secret</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> auto=start</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"> ike=3des-md5-modp1024</span><br style="font-family: courier new,monospace;"><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">
conn net-dedalus-net-sercom</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> type=tunnel</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">
left=69.x.y.z</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> leftsubnet=69.p.o.i/32</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">
right=69.a.b.c</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> rightsubnet=<a href="http://192.168.41.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.41.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.41.0/24</a></span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"> keyexchange=ike</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> ikelifetime=1440m</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"> auth=esp</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> pfs=no</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"> esp=3des-md5-96</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> authby=secret</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"> auto=start</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> ike=3des-md5-modp1024</span><br style="font-family: courier new,monospace;">
<br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">include /etc/ipsec.d/examples/no_oe.conf</span><br clear="all"></div><br><span style="font-family: verdana;">I got the following with 'ipsec auto --status':
</span><br><br><div style="margin-left: 40px;"><span style="font-family: courier new,monospace;">000 #30: "net-dedalus-net-company":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27203s; newest IPSEC; eroute owner
</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">000 #30: "net-dedalus-net-company" <a href="mailto:esp.8ce2537c@69.x.y.z">esp.8ce2537c@69.x.y.z</a> esp.4ce235c5
@</span><span style="font-family: courier new,monospace;">69.a.b.c</span><span style="font-family: courier new,monospace;"> <a href="mailto:tun.1004@69.x.y.z">tun.1004@69.x.y.z</a> <a href="mailto:tun.1003@69.a.b.c">tun.1003@69.a.b.c
</a></span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">000 #25: "net-company-net-dedalus":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 85086s; nodpd
</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">000 #5: "net-company-net-dedalus":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 84445s; nodpd
</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">000 #1: "net-company-net-dedalus":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 83780s; nodpd
</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">000 #29: "net-company-net-dedalus":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 26998s; newest IPSEC; eroute owner
</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">000 #29: "net-company-net-dedalus" used 622s ago; esp.ed030061@</span><span style="font-family: courier new,monospace;">
69.x.y.z</span><span style="font-family: courier new,monospace;"> esp.4ce235c4@</span><span style="font-family: courier new,monospace;"></span><span style="font-family: courier new,monospace;">69.a.b.c</span><span style="font-family: courier new,monospace;">
tun.1002@</span><span style="font-family: courier new,monospace;">69.x.y.z</span><span style="font-family: courier new,monospace;"> tun.1001@</span><span style="font-family: courier new,monospace;"></span><span style="font-family: courier new,monospace;">
69.a.b.c</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">000 #28: "net-sercom-net-dedalus":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 85171s; nodpd
</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">000 #33: "net-sercom-net-dedalus":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 85856s; newest ISAKMP; nodpd
</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">000 #32: "net-sercom-net-dedalus":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 85554s; nodpd
</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">000 #31: "net-sercom-net-dedalus":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 85215s; nodpd
</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">000 #4: "net-sercom-net-dedalus":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 84430s; nodpd
</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">000 #16: "net-sercom-net-dedalus":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 84784s; nodpd
</span><br></div><br><span style="font-family: verdana;">And ipsec barf says:</span><br style="font-family: verdana;"><br style="font-family: verdana;"><div style="margin-left: 40px;"><span style="font-family: courier new,monospace;">
Jun 28 22:29:05 ligerinho pluto[12798]: "net-company-net-dedalus" #35: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x1d5dc313 (perhaps this is a duplicated packet)</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;">Jun 28 22:29:05 ligerinho pluto[12798]: "net-company-net-dedalus" #35: sending encrypted notification INVALID_MESSAGE_ID to </span><span style="font-family: courier new,monospace;">
69.x.y.z</span><span style="font-family: courier new,monospace;">:500</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">Jun 28 22:29:05 ligerinho pluto[12798]: | sending 60 bytes for notification packet through eth0:500 to
69.x.y.z:500:</span><br></div><br><span style="font-family: verdana;">The actual status is:<br><br>I can't ping peers (</span><span style="font-family: courier new,monospace;">69.q.w.e/32</span><span style="font-family: verdana;">
) but I can see the ESP packets passing between the gateways. I don't have any firewall rule that may drop packets, so all protocols and ports are guaranteed in these tunnels. The chekpoint gateway receives packets saying the 'INVALID_MESSAGE_ID'.
<br><br>So my question is:<br><br>How can I avoid this ? What's wrong that the traffic is not flowing ?<br><br>Thanks in advance.<br><br></span>-- <br>Rivanor