Paul, here's a copy of the last lines of the logfile<br><br>Jun 29 21:55:09 routertech pluto[3461]: packet from <a href="http://200.41.49.4:500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "200.41.49.4:500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 200.41.49.4:500</a>: ignoring unknown Vendor ID payload [4048b7d56ebce88525e7de7f00d
<br>6c2d3c0000000]<br>Jun 29 21:55:09 routertech pluto[3461]: "tunnelipsec" #18: responding to Main Mode<br>Jun 29 21:55:09 routertech pluto[3461]: "tunnelipsec" #18: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
<br>Jun 29 21:55:09 routertech pluto[3461]: "tunnelipsec" #18: STATE_MAIN_R1: sent MR1, expecting MI2<br>Jun 29 21:55:09 routertech pluto[3461]: "tunnelipsec" #18: received Vendor ID payload [Cisco-Unity]
<br>Jun 29 21:55:09 routertech pluto[3461]: "tunnelipsec" #18: received Vendor ID payload [XAUTH]<br>Jun 29 21:55:09 routertech pluto[3461]: "tunnelipsec" #18: ignoring unknown Vendor ID payload [3d92011605225165afa0a5d009cc099b]
<br>Jun 29 21:55:09 routertech pluto[3461]: "tunnelipsec" #18: ignoring Vendor ID payload [Cisco VPN 3000 Series]<br>Jun 29 21:55:09 routertech pluto[3461]: "tunnelipsec" #18: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
<br>Jun 29 21:55:09 routertech pluto[3461]: "tunnelipsec" #18: STATE_MAIN_R2: sent MR2, expecting MI3<br>Jun 29 21:55:09 routertech pluto[3461]: "tunnelipsec" #18: received Vendor ID payload [Dead Peer Detection]
<br>Jun 29 21:55:09 routertech pluto[3461]: "tunnelipsec" #18: Main mode peer ID is ID_IPV4_ADDR: '<a href="http://200.41.49.4"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "200.41.49.4" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 200.41.49.4</a>'<br>Jun 29 21:55:09 routertech pluto[3461]: "tunnelipsec" #18: I did not send a certificate because I do not have one.
<br>Jun 29 21:55:09 routertech pluto[3461]: "tunnelipsec" #18: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<br>Jun 29 21:55:09 routertech pluto[3461]: "tunnelipsec" #18: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY
<br> cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1024}<br>Jun 29 21:55:39 routertech pluto[3461]: "tunnelipsec" #17: received Delete SA payload: deleting ISAKMP State #17<br>Jun 29 21:55:39 routertech pluto[3461]: packet from
<a href="http://200.41.49.4:500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "200.41.49.4:500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 200.41.49.4:500</a>: received and ignored informational message<br>Jun 29 22:39:06 routertech sshd[6802]: Did not receive identification string from <a href="http://75.22.239.26"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "75.22.239.26" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 75.22.239.26
</a><br>Jun 29 22:39:38 routertech pluto[3461]: packet from <a href="http://200.41.49.4:500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "200.41.49.4:500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 200.41.49.4:500</a>: ignoring unknown Vendor ID payload [4048b7d56ebce88525e7de7f00d<br>6c2d3c0000000]<br>Jun 29 22:39:38 routertech pluto[3461]: "tunnelipsec" #19: responding to Main Mode
<br>Jun 29 22:39:38 routertech pluto[3461]: "tunnelipsec" #19: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<br>Jun 29 22:39:38 routertech pluto[3461]: "tunnelipsec" #19: STATE_MAIN_R1: sent MR1, expecting MI2
<br>Jun 29 22:39:38 routertech pluto[3461]: "tunnelipsec" #19: received Vendor ID payload [Cisco-Unity]<br>Jun 29 22:39:38 routertech pluto[3461]: "tunnelipsec" #19: received Vendor ID payload [XAUTH]<br>
Jun 29 22:39:38 routertech pluto[3461]: "tunnelipsec" #19: ignoring unknown Vendor ID payload [12915a0e2017a802aaca7d181b5cb097]<br>Jun 29 22:39:38 routertech pluto[3461]: "tunnelipsec" #19: ignoring Vendor ID payload [Cisco VPN 3000 Series]
<br>Jun 29 22:39:38 routertech pluto[3461]: "tunnelipsec" #19: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<br>Jun 29 22:39:38 routertech pluto[3461]: "tunnelipsec" #19: STATE_MAIN_R2: sent MR2, expecting MI3
<br>Jun 29 22:39:46 routertech pluto[3461]: "tunnelipsec" #19: received Vendor ID payload [Dead Peer Detection]<br>Jun 29 22:39:46 routertech pluto[3461]: "tunnelipsec" #19: Main mode peer ID is ID_IPV4_ADDR: '
<a href="http://200.41.49.4"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "200.41.49.4" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 200.41.49.4</a>'<br>Jun 29 22:39:46 routertech pluto[3461]: "tunnelipsec" #19: I did not send a certificate because I do not have one.<br>Jun 29 22:39:46 routertech pluto[3461]: "tunnelipsec" #19: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
<br>Jun 29 22:39:46 routertech pluto[3461]: "tunnelipsec" #19: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY<br> cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1024}<br>Jun 29 22:40:09 routertech pluto[3461]: "tunnelipsec" #18: received Delete SA payload: deleting ISAKMP State #18
<br>Jun 29 22:40:09 routertech pluto[3461]: packet from <a href="http://200.41.49.4:500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "200.41.49.4:500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 200.41.49.4:500</a>: received and ignored informational message<br><br>Thanks a lot, Pablo<br><br><div><span class="gmail_quote">On 6/29/06,
<b class="gmail_sendername">Paul Wouters</b> <<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On Thu, 29 Jun 2006, Pablo García wrote:<br><br>> Paul, you're right, the tunnel is stablished but the traffic isn't being<br>> encripted, any idea of why ?<br><br>I don't think the tunnel is establasished at all. Do you have a log entry
<br>saying "IPsec SA Established"?<br><br>Paul<br><br></blockquote></div><br>