<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.12.1">
</HEAD>
<BODY>
Hello,<BR>
<BR>
I have a Linux Desktop PC that I need to connect to a SonicWALL VPN. The linux PC has an ip number of 192.168.1.13 and is connected to the Internet via gateway 192.168.1.1. The VPN server where I need to connect to has an IP number of 66.nnn.nnn.nnn (for obvious security reasons I am using nnn here) and this connects to subnet 192.168.128.0/24. So in fact, I am just trying to create a VPN client to server connection.<BR>
<BR>
The details that I got from the system admin who maintains the VPN is that it is using the following:<BR>
<BR>
- SonicWALL VPN<BR>
- ESP 3DES HMAC MD5 (IKE) <BR>
- XAUTH authentication is not required.<BR>
<BR>
<BR>
My configuration is as follows:<BR>
<BR>
/etc/ipsec.d/sonicwall.conf<BR>
<BR>
conn sonicwall<BR>
type=tunnel<BR>
auto=add<BR>
auth=esp<BR>
pfs=yes<BR>
authby=secret<BR>
keyingtries=1<BR>
left=192.168.1.13<BR>
leftsubnet=192.168.1.13/32<BR>
right=66.nnn.nnn.nnn<BR>
rightsubnet=192.168.128.0/24<BR>
rightid=66.nnn.nnn.nnn<BR>
esp=3des-md5<BR>
keyexchange=ike<BR>
ike=3des-md5<BR>
<BR>
/etc/ipsec.d/sonicwall.secrets<BR>
<BR>
192.168.1.13 66.nnn.nnn.nnn : PSK "somesecretkeyphrase"<BR>
<BR>
When starting the ipsec service (/etc/rc.d/init.d/ipsec start), the output to screen as follows:<BR>
<BR>
[root@ams ipsec.d]# /sbin/service ipsec restart<BR>
Shutting down IPsec: Stopping Openswan IPsec...<BR>
[ OK ]<BR>
Starting IPsec: Starting Openswan IPsec 2.4.5...<BR>
insmod /lib/modules/2.6.18-1.2849.fc6/kernel/net/key/af_key.ko <BR>
insmod /lib/modules/2.6.18-1.2849.fc6/kernel/net/ipv4/xfrm4_tunnel.ko <BR>
[ OK ]<BR>
[root@ams ipsec.d]# <BR>
<BR>
<BR>
The output in /var/log/messages:<BR>
<BR>
Nov 23 14:05:43 ams kernel: NET: Registered protocol family 15<BR>
Nov 23 14:05:43 ams ipsec_setup: KLIPS ipsec0 on eth0 192.168.1.13/255.255.255.0 broadcast 192.168.1.255 <BR>
Nov 23 14:05:44 ams ipsec_setup: ...Openswan IPsec started<BR>
<BR>
<BR>
The output in /var/log/secure:<BR>
<BR>
Nov 23 14:06:36 ams ipsec__plutorun: Starting Pluto subsystem...<BR>
Nov 23 14:06:36 ams pluto[16213]: Starting Pluto (Openswan Version 2.4.5 X.509-1.5.4 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR; Vendor ID <A HREF="mailto:OEnMCu\177xOp@c">OEnMCu\177xOp@c</A>)<BR>
Nov 23 14:06:36 ams pluto[16213]: Setting NAT-Traversal port-4500 floating to on<BR>
Nov 23 14:06:36 ams pluto[16213]: port floating activation criteria nat_t=1/port_fload=1<BR>
Nov 23 14:06:36 ams pluto[16213]: including NAT-Traversal patch (Version 0.6c)<BR>
Nov 23 14:06:36 ams pluto[16213]: | opening /dev/urandom<BR>
Nov 23 14:06:36 ams pluto[16213]: | inserting event EVENT_REINIT_SECRET, timeout in 3600 seconds<BR>
Nov 23 14:06:36 ams pluto[16213]: | inserting event EVENT_PENDING_PHASE2, timeout in 120 seconds<BR>
Nov 23 14:06:36 ams pluto[16213]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)<BR>
Nov 23 14:06:36 ams pluto[16213]: starting up 1 cryptographic helpers<BR>
Nov 23 14:06:36 ams pluto[16214]: | opening /dev/urandom<BR>
Nov 23 14:06:36 ams pluto[16213]: started helper pid=16214 (fd:6)<BR>
Nov 23 14:06:36 ams pluto[16213]: Using Linux 2.6 IPsec interface code on 2.6.18-1.2849.fc6<BR>
Nov 23 14:06:36 ams pluto[16213]: Could not change to directory '/etc/ipsec.d/cacerts'<BR>
Nov 23 14:06:36 ams pluto[16213]: Could not change to directory '/etc/ipsec.d/aacerts'<BR>
Nov 23 14:06:36 ams pluto[16213]: Could not change to directory '/etc/ipsec.d/ocspcerts'<BR>
Nov 23 14:06:36 ams pluto[16213]: Could not change to directory '/etc/ipsec.d/crls'<BR>
Nov 23 14:06:36 ams pluto[16213]: | inserting event EVENT_LOG_DAILY, timeout in 35604 seconds<BR>
Nov 23 14:06:36 ams pluto[16213]: | next event EVENT_PENDING_PHASE2 in 120 seconds<BR>
Nov 23 14:06:36 ams pluto[16214]: ! helper 0 waiting on fd: 7<BR>
Nov 23 14:06:36 ams pluto[16213]: | <BR>
Nov 23 14:06:36 ams pluto[16213]: | *received whack message<BR>
Nov 23 14:06:36 ams pluto[16213]: | Added new connection sonicwall with policy PSK+ENCRYPT+TUNNEL+PFS<BR>
Nov 23 14:06:36 ams pluto[16213]: | from whack: got --esp=3des-md5<BR>
Nov 23 14:06:36 ams pluto[16213]: | esp string values: 3_000-1, flags=strict<BR>
Nov 23 14:06:36 ams pluto[16213]: | from whack: got --ike=3des-md5<BR>
Nov 23 14:06:36 ams pluto[16213]: | ike string values: 5_000-1-5, 5_000-1-2, flags=strict<BR>
Nov 23 14:06:36 ams pluto[16213]: | counting wild cards for (none) is 15<BR>
Nov 23 14:06:36 ams pluto[16213]: | counting wild cards for 66.nnn.nnn.nnn is 0<BR>
Nov 23 14:06:36 ams pluto[16213]: | alg_info_addref() alg_info->ref_cnt=1<BR>
Nov 23 14:06:36 ams pluto[16213]: | alg_info_addref() alg_info->ref_cnt=1<BR>
Nov 23 14:06:36 ams pluto[16213]: | alg_info_addref() alg_info->ref_cnt=2<BR>
Nov 23 14:06:36 ams pluto[16213]: | alg_info_addref() alg_info->ref_cnt=2<BR>
Nov 23 14:06:36 ams pluto[16213]: added connection description "sonicwall"<BR>
Nov 23 14:06:36 ams pluto[16213]: | 192.168.1.13/32===192.168.1.13...66.nnn.nnn.nnn===192.168.128.0/24<BR>
Nov 23 14:06:36 ams pluto[16213]: | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 1; policy: PSK+ENCRYPT+TUNNEL+PFS<BR>
Nov 23 14:06:36 ams pluto[16213]: | next event EVENT_PENDING_PHASE2 in 120 seconds<BR>
Nov 23 14:06:36 ams pluto[16213]: | <BR>
Nov 23 14:06:36 ams pluto[16213]: | *received whack message<BR>
Nov 23 14:06:36 ams pluto[16213]: listening for IKE messages<BR>
Nov 23 14:06:36 ams pluto[16213]: | found lo with address 127.0.0.1<BR>
Nov 23 14:06:36 ams pluto[16213]: | found eth0 with address 192.168.1.13<BR>
Nov 23 14:06:36 ams pluto[16213]: adding interface eth0/eth0 192.168.1.13:500<BR>
Nov 23 14:06:36 ams pluto[16213]: adding interface eth0/eth0 192.168.1.13:4500<BR>
Nov 23 14:06:36 ams pluto[16213]: adding interface lo/lo 127.0.0.1:500<BR>
Nov 23 14:06:36 ams pluto[16213]: adding interface lo/lo 127.0.0.1:4500<BR>
Nov 23 14:06:36 ams pluto[16213]: | found lo with address 0000:0000:0000:0000:0000:0000:0000:0001<BR>
Nov 23 14:06:36 ams pluto[16213]: adding interface lo/lo ::1:500<BR>
Nov 23 14:06:36 ams pluto[16213]: loading secrets from "/etc/ipsec.secrets"<BR>
Nov 23 14:06:36 ams pluto[16213]: loading secrets from "/etc/ipsec.d/hostkey.secrets"<BR>
Nov 23 14:06:36 ams pluto[16213]: | loaded private key for keyid: PPK_RSA:AQOQ1MmLS<BR>
Nov 23 14:06:36 ams pluto[16213]: loading secrets from "/etc/ipsec.d/sonicwall.secrets"<BR>
Nov 23 14:06:36 ams pluto[16213]: | next event EVENT_PENDING_PHASE2 in 120 seconds<BR>
<BR>
When trying to create the connection, I type:<BR>
<BR>
/usr/sbin/ipsec whack --name sonicwall --initiate<BR>
<BR>
The output to screen is:<BR>
<BR>
[root@ams ipsec.d]# /usr/sbin/ipsec whack --name sonicwall --initiate<BR>
002 "sonicwall" #1: initiating Main Mode<BR>
104 "sonicwall" #1: STATE_MAIN_I1: initiate<BR>
010 "sonicwall" #1: STATE_MAIN_I1: retransmission; will wait 20s for response<BR>
<BR>
(the re-transmission errors are repeating)<BR>
<BR>
The output in /var/log/secret:<BR>
<BR>
Nov 23 14:09:54 ams pluto[16661]: | <BR>
Nov 23 14:09:54 ams pluto[16661]: | *received whack message<BR>
Nov 23 14:09:54 ams pluto[16661]: | processing connection sonicwall<BR>
Nov 23 14:09:54 ams pluto[16661]: | kernel_alg_db_new() will return p_new->protoid=3, p_new->trans_cnt=1<BR>
Nov 23 14:09:54 ams pluto[16661]: | kernel_alg_db_new() trans[0]: transid=3, attr_cnt=1, attrs[0].type=5, attrs[0].val=1<BR>
Nov 23 14:09:54 ams pluto[16661]: | returning new proposal from esp_info<BR>
Nov 23 14:09:54 ams pluto[16661]: | creating state object #1 at 0x55555581f330<BR>
Nov 23 14:09:54 ams pluto[16661]: | processing connection sonicwall<BR>
Nov 23 14:09:54 ams pluto[16661]: | ICOOKIE: b3 fb 6d de b8 44 10 98<BR>
Nov 23 14:09:54 ams pluto[16661]: | RCOOKIE: 00 00 00 00 00 00 00 00<BR>
Nov 23 14:09:54 ams pluto[16661]: | peer: 42 b4 67 52<BR>
Nov 23 14:09:54 ams pluto[16661]: | state hash entry 0<BR>
Nov 23 14:09:54 ams pluto[16661]: | inserting event EVENT_SO_DISCARD, timeout in 0 seconds for #1<BR>
Nov 23 14:09:54 ams pluto[16661]: | Queuing pending Quick Mode with 66.nnn.nnn.nnn "sonicwall"<BR>
Nov 23 14:09:54 ams pluto[16661]: "sonicwall" #1: initiating Main Mode<BR>
Nov 23 14:09:54 ams pluto[16661]: | sending 248 bytes for main_outI1 through eth0:500 to 66.nnn.nnn.nnn:500:<BR>
Nov 23 14:09:54 ams pluto[16661]: | inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #1<BR>
Nov 23 14:09:54 ams pluto[16661]: | next event EVENT_RETRANSMIT in 10 seconds for #1<BR>
Nov 23 14:09:54 ams pluto[16661]: | <BR>
Nov 23 14:09:54 ams pluto[16661]: | *received 92 bytes from 66.nnn.nnn.nnn:500 on eth0 (port=500)<BR>
Nov 23 14:09:54 ams pluto[16661]: | **parse ISAKMP Message:<BR>
Nov 23 14:09:54 ams pluto[16661]: | initiator cookie:<BR>
Nov 23 14:09:54 ams pluto[16661]: | b3 fb 6d de b8 44 10 98<BR>
Nov 23 14:09:54 ams pluto[16661]: | responder cookie:<BR>
Nov 23 14:09:54 ams pluto[16661]: | 4b c1 9a fa 48 f0 0d 6d<BR>
Nov 23 14:09:54 ams pluto[16661]: | next payload type: ISAKMP_NEXT_N<BR>
Nov 23 14:09:54 ams pluto[16661]: | ISAKMP version: ISAKMP Version 1.0<BR>
Nov 23 14:09:54 ams pluto[16661]: | exchange type: ISAKMP_XCHG_INFO<BR>
Nov 23 14:09:54 ams pluto[16661]: | flags: none<BR>
Nov 23 14:09:54 ams pluto[16661]: | message ID: 00 00 00 00<BR>
Nov 23 14:09:54 ams pluto[16661]: | length: 92<BR>
Nov 23 14:09:54 ams pluto[16661]: | processing packet with exchange type=ISAKMP_XCHG_INFO (5)<BR>
Nov 23 14:09:54 ams pluto[16661]: | ICOOKIE: b3 fb 6d de b8 44 10 98<BR>
Nov 23 14:09:54 ams pluto[16661]: | RCOOKIE: 4b c1 9a fa 48 f0 0d 6d<BR>
Nov 23 14:09:54 ams pluto[16661]: | peer: 42 b4 67 52<BR>
Nov 23 14:09:54 ams pluto[16661]: | state hash entry 14<BR>
Nov 23 14:09:54 ams pluto[16661]: | p15 state object not found<BR>
Nov 23 14:09:54 ams pluto[16661]: | ***parse ISAKMP Notification Payload:<BR>
Nov 23 14:09:54 ams pluto[16661]: | next payload type: ISAKMP_NEXT_NONE<BR>
Nov 23 14:09:54 ams pluto[16661]: | length: 64<BR>
Nov 23 14:09:54 ams pluto[16661]: | DOI: ISAKMP_DOI_ISAKMP<BR>
Nov 23 14:09:54 ams pluto[16661]: | protocol ID: 1<BR>
Nov 23 14:09:54 ams pluto[16661]: | SPI size: 16<BR>
Nov 23 14:09:54 ams pluto[16661]: | Notify Message Type: NO_PROPOSAL_CHOSEN<BR>
Nov 23 14:09:54 ams pluto[16661]: packet from 66.nnn.nnn.nnn:500: ignoring informational payload, type NO_PROPOSAL_CHOSEN<BR>
Nov 23 14:09:54 ams pluto[16661]: | info: b3 fb 6d de b8 44 10 98 4b c1 9a fa 48 f0 0d 6d<BR>
Nov 23 14:09:54 ams pluto[16661]: | 00 06 00 04 00 00 00 00 00 04 00 18 00 00 00 4e<BR>
Nov 23 14:09:54 ams pluto[16661]: | 6f 20 70 72 6f 70 6f 73 61 6c 20 69 73 20 63 68<BR>
Nov 23 14:09:54 ams pluto[16661]: | 6f 73 65 6e<BR>
Nov 23 14:09:54 ams pluto[16661]: | processing informational NO_PROPOSAL_CHOSEN (14)<BR>
Nov 23 14:09:54 ams pluto[16661]: packet from 66.nnn.nnn.nnn:500: received and ignored informational message<BR>
Nov 23 14:09:54 ams pluto[16661]: | complete state transition with STF_IGNORE<BR>
Nov 23 14:09:54 ams pluto[16661]: | next event EVENT_RETRANSMIT in 10 seconds for #1<BR>
^[[5~Nov 23 14:10:04 ams pluto[16661]: | <BR>
Nov 23 14:10:04 ams pluto[16661]: | *time to handle event<BR>
Nov 23 14:10:04 ams pluto[16661]: | handling event EVENT_RETRANSMIT<BR>
Nov 23 14:10:04 ams pluto[16661]: | event after this is EVENT_PENDING_PHASE2 in 103 seconds<BR>
Nov 23 14:10:04 ams pluto[16661]: | processing connection sonicwall<BR>
Nov 23 14:10:04 ams pluto[16661]: | handling event EVENT_RETRANSMIT for 66.nnn.nnn.nnn "sonicwall" #1<BR>
Nov 23 14:10:04 ams pluto[16661]: | sending 248 bytes for EVENT_RETRANSMIT through eth0:500 to 66.nnn.nnn.nnn:500:<BR>
Nov 23 14:10:04 ams pluto[16661]: | inserting event EVENT_RETRANSMIT, timeout in 20 seconds for #1<BR>
Nov 23 14:10:04 ams pluto[16661]: | next event EVENT_RETRANSMIT in 20 seconds for #1<BR>
Nov 23 14:10:05 ams pluto[16661]: | <BR>
Nov 23 14:10:05 ams pluto[16661]: | *received 92 bytes from 66.nnn.nnn.nnn:500 on eth0 (port=500)<BR>
Nov 23 14:10:05 ams pluto[16661]: | **parse ISAKMP Message:<BR>
Nov 23 14:10:05 ams pluto[16661]: | initiator cookie:<BR>
Nov 23 14:10:05 ams pluto[16661]: | b3 fb 6d de b8 44 10 98<BR>
Nov 23 14:10:05 ams pluto[16661]: | responder cookie:<BR>
Nov 23 14:10:05 ams pluto[16661]: | 47 fd ab 64 42 c5 bd b5<BR>
Nov 23 14:10:05 ams pluto[16661]: | next payload type: ISAKMP_NEXT_N<BR>
Nov 23 14:10:05 ams pluto[16661]: | ISAKMP version: ISAKMP Version 1.0<BR>
Nov 23 14:10:05 ams pluto[16661]: | exchange type: ISAKMP_XCHG_INFO<BR>
Nov 23 14:10:05 ams pluto[16661]: | flags: none<BR>
Nov 23 14:10:05 ams pluto[16661]: | message ID: 00 00 00 00<BR>
Nov 23 14:10:05 ams pluto[16661]: | length: 92<BR>
Nov 23 14:10:05 ams pluto[16661]: | processing packet with exchange type=ISAKMP_XCHG_INFO (5)<BR>
Nov 23 14:10:05 ams pluto[16661]: | ICOOKIE: b3 fb 6d de b8 44 10 98<BR>
Nov 23 14:10:05 ams pluto[16661]: | RCOOKIE: 47 fd ab 64 42 c5 bd b5<BR>
Nov 23 14:10:05 ams pluto[16661]: | peer: 42 b4 67 52<BR>
Nov 23 14:10:05 ams pluto[16661]: | state hash entry 18<BR>
Nov 23 14:10:05 ams pluto[16661]: | p15 state object not found<BR>
Nov 23 14:10:05 ams pluto[16661]: | ***parse ISAKMP Notification Payload:<BR>
Nov 23 14:10:05 ams pluto[16661]: | next payload type: ISAKMP_NEXT_NONE<BR>
Nov 23 14:10:05 ams pluto[16661]: | length: 64<BR>
Nov 23 14:10:05 ams pluto[16661]: | DOI: ISAKMP_DOI_ISAKMP<BR>
Nov 23 14:10:05 ams pluto[16661]: | protocol ID: 1<BR>
Nov 23 14:10:05 ams pluto[16661]: | SPI size: 16<BR>
Nov 23 14:10:05 ams pluto[16661]: | Notify Message Type: NO_PROPOSAL_CHOSEN<BR>
Nov 23 14:10:05 ams pluto[16661]: packet from 66.nnn.nnn.nnn:500: ignoring informational payload, type NO_PROPOSAL_CHOSEN<BR>
Nov 23 14:10:05 ams pluto[16661]: | info: b3 fb 6d de b8 44 10 98 47 fd ab 64 42 c5 bd b5<BR>
Nov 23 14:10:05 ams pluto[16661]: | 00 06 00 04 00 00 00 00 00 04 00 18 00 00 00 4e<BR>
Nov 23 14:10:05 ams pluto[16661]: | 6f 20 70 72 6f 70 6f 73 61 6c 20 69 73 20 63 68<BR>
Nov 23 14:10:05 ams pluto[16661]: | 6f 73 65 6e<BR>
Nov 23 14:10:05 ams pluto[16661]: | processing informational NO_PROPOSAL_CHOSEN (14)<BR>
Nov 23 14:10:05 ams pluto[16661]: packet from 66.nnn.nnn.nnn:500: received and ignored informational message<BR>
Nov 23 14:10:05 ams pluto[16661]: | complete state transition with STF_IGNORE<BR>
Nov 23 14:10:05 ams pluto[16661]: | next event EVENT_RETRANSMIT in 19 seconds for #1<BR>
<BR>
The output of status:<BR>
<BR>
/usr/sbin/ipsec whack --status<BR>
<BR>
[root@ams ipsec.d]# /usr/sbin/ipsec whack --status<BR>
000 interface lo/lo ::1<BR>
000 interface lo/lo 127.0.0.1<BR>
000 interface lo/lo 127.0.0.1<BR>
000 interface eth0/eth0 192.168.1.13<BR>
000 interface eth0/eth0 192.168.1.13<BR>
000 %myid = (none)<BR>
000 debug parsing+control<BR>
000 <BR>
000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64<BR>
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192<BR>
000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448<BR>
000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0<BR>
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256<BR>
000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256<BR>
000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256<BR>
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128<BR>
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160<BR>
000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256<BR>
000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0, keysizemax=0<BR>
000 <BR>
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192<BR>
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128<BR>
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<BR>
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<BR>
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024<BR>
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536<BR>
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048<BR>
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072<BR>
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096<BR>
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144<BR>
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192<BR>
000 <BR>
000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,1,64} trans={0,1,672} attrs={0,1,224} <BR>
000 <BR>
000 "sonicwall": 192.168.1.13/32===192.168.1.13...66.nnn.nnn.nnn===192.168.128.0/24; unrouted; eroute owner: #0<BR>
000 "sonicwall": srcip=unset; dstip=unset; srcup=ipsec _updown; dstup=ipsec _updown;<BR>
000 "sonicwall": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 1<BR>
000 "sonicwall": policy: PSK+ENCRYPT+TUNNEL+PFS+UP; prio: 32,24; interface: eth0; <BR>
000 "sonicwall": newest ISAKMP SA: #0; newest IPsec SA: #0; <BR>
000 "sonicwall": IKE algorithms wanted: 5_000-1-5, 5_000-1-2, flags=strict<BR>
000 "sonicwall": IKE algorithms found: 5_192-1_128-5, 5_192-1_128-2, <BR>
000 "sonicwall": ESP algorithms wanted: 3_000-1, flags=strict<BR>
000 "sonicwall": ESP algorithms loaded: 3_000-1, flags=strict<BR>
000 <BR>
000 <BR>
[root@ams ipsec.d]# <BR>
<BR>
<BR>
Would appreciate if anybody can give me any pointers on how to proceed/further debug. Yes, I have posted a similar situation before to this list, but at that time the VPN server was configured for the old DES rather than 3DES and most of the responses were to change this to 3DES and try again. Well, I did and still no success :(<BR>
<BR>
Thanks in advance for your response.<BR>
<BR>
Bas.<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
</BODY>
</HTML>