my topology like this:<br><a href="http://192.168.30.12">192.168.30.12</a> ========192.168.30.112---192.168.37.112========192.168.37.113<br> server1 server2(nat) client1<br>
<br>client1 want to make vpn connection to server1 through nat devices(server2)<br><br>below is the ipsec.conf configuration file and log messages<br>server1 :<br>conn nat-t<br> left=<a href="http://192.168.30.12">192.168.30.12</a><br>
right=<a href="http://192.168.30.112">192.168.30.112</a><br> leftid=@<a href="http://12.test.com">12.test.com</a><br> rightid=@<a href="http://dhcp.test.com">dhcp.test.com</a><br>
authby=rsasig<br> auto=ignore<br> leftrsasigkey= ...<br> rightrsasigkey=...<br><br>client1: <br>conn nat-t<br> left=<a href="http://192.168.37.113">192.168.37.113</a><br>
right=<a href="http://192.168.30.12">192.168.30.12</a><br> leftid=@<a href="http://dhcp.test.com">dhcp.test.com</a><br> rightid=@<a href="http://12.test.com">12.test.com</a><br>
authby=rsasig<br> auto=ignore<br> leftrsasigkey=....<br> rightrsasigkey=....<br><br><br>error information about the quick mode from /var/log/messages:<br><br> ***parse ISAKMP Hash Payload:<br>
Jan 20 08:20:57 server12 pluto[7433]: | next payload type: ISAKMP_NEXT_SA<br>Jan 20 08:20:57 server12 pluto[7433]: | length: 20<br>Jan 20 08:20:57 server12 pluto[7433]: | ***parse ISAKMP Security Association Payload:<br>
Jan 20 08:20:57 server12 pluto[7433]: | next payload type: ISAKMP_NEXT_NONCE<br>Jan 20 08:20:57 server12 pluto[7433]: | length: 136<br>Jan 20 08:20:57 server12 pluto[7433]: | DOI: ISAKMP_DOI_IPSEC<br>Jan 20 08:20:57 server12 pluto[7433]: | ***parse ISAKMP Nonce Payload:<br>
Jan 20 08:20:57 server12 pluto[7433]: | next payload type: ISAKMP_NEXT_KE<br>Jan 20 08:20:57 server12 pluto[7433]: | length: 20<br>Jan 20 08:20:57 server12 pluto[7433]: | ***parse ISAKMP Key Exchange Payload:<br>Jan 20 08:20:57 server12 pluto[7433]: | next payload type: ISAKMP_NEXT_ID<br>
Jan 20 08:20:57 server12 pluto[7433]: | length: 196<br>Jan 20 08:20:57 server12 pluto[7433]: | ***parse ISAKMP Identification Payload (IPsec DOI):<br>Jan 20 08:20:57 server12 pluto[7433]: | next payload type: ISAKMP_NEXT_ID<br>
Jan 20 08:20:57 server12 pluto[7433]: | length: 12<br>Jan 20 08:20:57 server12 pluto[7433]: | ID type: ID_IPV4_ADDR<br>Jan 20 08:20:57 server12 pluto[7433]: | Protocol ID: 0<br>Jan 20 08:20:57 server12 pluto[7433]: | port: 0<br>
Jan 20 08:20:57 server12 pluto[7433]: | ***parse ISAKMP Identification Payload (IPsec DOI):<br>Jan 20 08:20:57 server12 pluto[7433]: | next payload type: ISAKMP_NEXT_NONE<br>Jan 20 08:20:57 server12 pluto[7433]: | length: 12<br>
Jan 20 08:20:57 server12 pluto[7433]: | ID type: ID_IPV4_ADDR<br>Jan 20 08:20:57 server12 pluto[7433]: | Protocol ID: 0<br>Jan 20 08:20:57 server12 pluto[7433]: | port: 0<br>Jan 20 08:20:57 server12 pluto[7433]: | removing 4 bytes of padding<br>
Jan 20 08:20:57 server12 pluto[7433]: | HASH(1) computed:<br>Jan 20 08:20:57 server12 pluto[7433]: | f3 51 5b e7 90 9b b7 c4 13 82 78 4c 62 20 0e 38<br>Jan 20 08:20:57 server12 pluto[7433]: | peer client is <a href="http://192.168.37.113">192.168.37.113</a><br>
Jan 20 08:20:57 server12 pluto[7433]: | peer client protocol/port is 0/0<br>Jan 20 08:20:57 server12 pluto[7433]: | our client is <a href="http://192.168.30.12">192.168.30.12</a><br>Jan 20 08:20:57 server12 pluto[7433]: | our client protocol/port is 0/0<br>
Jan 20 08:20:57 server12 pluto[7433]: | find_client_connection starting with nat-t<br>Jan 20 08:20:57 server12 pluto[7433]: | looking for <a href="http://192.168.30.12/32:0/0">192.168.30.12/32:0/0</a> -> <a href="http://192.168.37.113/32:0/0">192.168.37.113/32:0/0</a><br>
Jan 20 08:20:57 server12 pluto[7433]: | concrete checking against sr#0 <a href="http://192.168.30.12/32">192.168.30.12/32</a> -> <a href="http://192.168.30.112/32">192.168.30.112/32</a><br>Jan 20 08:20:57 server12 pluto[7433]: | match_id a=@<a href="http://dhcp.test.com">dhcp.test.com</a><br>
Jan 20 08:20:57 server12 pluto[7433]: | b=@<a href="http://dhcp.test.com">dhcp.test.com</a><br>Jan 20 08:20:57 server12 pluto[7433]: | results matched<br>Jan 20 08:20:57 server12 pluto[7433]: | trusted_ca called with a=(empty) b=(empty)<br>
Jan 20 08:20:57 server12 pluto[7433]: | fc_try trying nat-t:<a href="http://192.168.30.12/32:0/0">192.168.30.12/32:0/0</a> -> <a href="http://192.168.37.113/32:0/0">192.168.37.113/32:0/0</a> vs nat-t:<a href="http://192.168.30.12/32:0/0">192.168.30.12/32:0/0</a> -> <a href="http://192.168.30.112/32:0/0">192.168.30.112/32:0/0</a><br>
Jan 20 08:20:57 server12 pluto[7433]: | fc_try concluding with none [0]<br>Jan 20 08:20:57 server12 pluto[7433]: | fc_try nat-t gives none<br>Jan 20 08:20:57 server12 pluto[7433]: | find_host_pair: comparing to <a href="http://192.168.30.12:500">192.168.30.12:500</a> <a href="http://192.168.30.112:500">192.168.30.112:500</a><br>
Jan 20 08:20:57 server12 pluto[7433]: | checking hostpair <a href="http://192.168.30.12/32">192.168.30.12/32</a> -> <a href="http://192.168.30.112/32">192.168.30.112/32</a> is not found<br>Jan 20 08:20:57 server12 pluto[7433]: | concluding with d = none<br>
Jan 20 08:20:57 server12 pluto[7433]: "nat-t" #1: cannot respond to IPsec SA request because no connection is known for 192.168.30.12[@<a href="http://12.test.com">12.test.com</a>]...192.168.30.112[@dhcp.t<br><a href="http://est.com">est.com</a>]===<a href="http://192.168.37.113/32">192.168.37.113/32</a><br>
Jan 20 08:20:57 server12 pluto[7433]: | complete state transition with (null)<br>Jan 20 08:20:57 server12 pluto[7433]: "nat-t" #1: sending encrypted notification INVALID_ID_INFORMATION to <a href="http://192.168.30.112:4500">192.168.30.112:4500</a><br>
<br><br><br>i initiate vpn form client1 to server1. when i input "ipsec auto --up nat-t" in the shell of client1,below is the output in screen.<br><br>vpnclient:~ # ipsec auto --add nat-t<br>vpnclient:~ # ipsec auto --up nat-t<br>
104 "nat-t" #1: STATE_MAIN_I1: initiate<br>003 "nat-t" #1: received Vendor ID payload [Openswan (this version) 2.4.4 X.509-1.5.4 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR]<br>003 "nat-t" #1: received Vendor ID payload [Dead Peer Detection]<br>
003 "nat-t" #1: received Vendor ID payload [RFC 3947] method set to=109<br>106 "nat-t" #1: STATE_MAIN_I2: sent MI2, expecting MR2<br>003 "nat-t" #1: NAT-Traversal: Result using 3: i am NATed<br>
108 "nat-t" #1: STATE_MAIN_I3: sent MI3, expecting MR3<br>004 "nat-t" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1536}<br>117 "nat-t" #2: STATE_QUICK_I1: initiate<br>
010 "nat-t" #2: STATE_QUICK_I1: retransmission; will wait 20s for response<br>010 "nat-t" #2: STATE_QUICK_I1: retransmission; will wait 40s for response<br>031 "nat-t" #2: max number of retransmissions (2) reached STATE_QUICK_I1. No acceptable response to our first Quick Mode message: perhaps peer likes no proposal<br>
000 "nat-t" #2: starting keying attempt 2 of an unlimited number, but releasing whack<br><br>