Openswan 2.4.4 sets up a VPN tunnel to a Cisco router OK:<br><br>004 "NYC" #58: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x91af5acc <0xdd787655 xfrm=3DES_0-HMAC_SHA1 NATD=none DPD=none}<br><br>Packets sent from the Cisco side work fine.
<br><br>But when sending a packet from Openswan through the tunnel, a slightly different SPI is used (tcpdump):<br><br>16:34:12.535324 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto: ESP (50), length: 136) <a href="http://66.99.99.99"><font color="red"><b>MailScanner warning: numerical links are often malicious:</b></font>
66.99.99.99</a> > <a href="http://38.111.111.111"><font color="red"><b>MailScanner warning: numerical links are often malicious:</b></font> 38.111.111.111</a>: ESP(spi=0x91af4878,seq=0x1254001a), length 116<br>16:34:12.563423 IP (tos 0x20, ttl 240, id 22448, offset 0, flags [none], proto: UDP (17), length: 104)
38.111.111.111.500 > 66.99.99.99.500: isakmp 1.0 msgid : phase 2/others ? inf[E]: [encrypted hash]<br><br>In the first message, note the spi=0x91af4878 instead of 0x91af5acc -- the last four digits (some of the lower 16 bits) are changed. Sometimes the discrepancy is in the high 16 bits.
<br><br>The second message is the "Delete SA" message that the Cisco sends back. Openswan doesn't know about that SPI either:<br><br>Nov 28 16:34:04 [pluto] "NYC" #57: ignoring Delete SA payload: PROTO_IPSEC_ESP SA(0x91af4978) not found (maybe expired)
<br><br>What could be causing this?<br><br>(Yes, this is still the same problem, but SNAT is out of the way.)<br>Thanks,<br>/Christian<br>