<br><font size=2><tt>Hello,</tt></font>
<br>
<br><font size=2><tt>as far as I understand things, the Vendor ID payload
describes the peer and its capabilities, not the actual options used.</tt></font>
<br><font size=2><tt>In your case this would mean that the Cisco indicates
that it can do XAUTH, but not that XAUTH would be used for this connection.</tt></font>
<br>
<br><font size=2><tt>And concerning log line 9: yes, this is perfectly
normal and has nothing whatsoever to do with XAUTH.</tt></font>
<br>
<br><font size=2><tt>Best Regards,</tt></font>
<br><font size=2><tt> Frank Mayer</tt></font>
<br>
<br><font size=2><tt>users-bounces@openswan.org schrieb am 08.02.2008 10:04:33:<br>
<br>
> Hello,<br>
> <br>
> I am having difficulties to read the logs of pluto,<br>
> devices are : openswan <-> cisco 3080<br>
> <br>
> <br>
> 1- #249651: initiating Main Mode<br>
> 2- #249651: ignoring Vendor ID payload [FRAGMENTATION c0000000]<br>
> 3- #249651: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2<br>
> 4- #249651: STATE_MAIN_I2: sent MI2, expecting MR2 <br>
> 5- #249651: received Vendor ID payload [Cisco-Unity]<br>
> 6- #249651: received Vendor ID payload [XAUTH]<br>
> 7- #249651: ignoring unknown Vendor ID payload <br>
> [086a6374027ed9bbc051dd742ee98d16]<br>
> 8- #249651: ignoring Vendor ID payload [Cisco VPN 3000 Series]<br>
> 9- #249651: I did not send a certificate because I do not have
one.<br>
> 10- #249651: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3<br>
> 11- #249651: STATE_MAIN_I3: sent MI3, expecting MR3<br>
> 12- #249651: received Vendor ID payload [Dead Peer Detection]<br>
> 13- #249651: Main mode peer ID is ID_IPV4_ADDR: 'CISCO_PUBLIC_IP'<br>
> 14- #249651: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4<br>
> 15- #249651: STATE_MAIN_I4: ISAKMP SA established <br>
> {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha<br>
> group=modp1024}<br>
> 16- #249651: Dead Peer Detection (RFC 3706): enabled <br>
> 17- #249652: initiating Quick Mode PSK+ENCRYPT+TUNNEL {using isakmp#249651}<br>
> 18- #249652: Dead Peer Detection (RFC 3706): enabled<br>
> 19- #249652: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2<br>
> 20- #249652: STATE_QUICK_I2: sent QI2, IPsec SA established <br>
> {ESP=>0x456b9e75 <0x7779aa6e xfrm=3DES_0-HMAC_SHA1 NATD=none
DPD=enabled}<br>
> <br>
> <br>
> As you can see on line 6 it seems I am receiving a XAUTH<br>
> request. However on the CISCO 3080, I have the following options for
the<br>
> authentication mode :<br>
> <br>
> Preshared key <-----------<br>
> RSA digital certificate<br>
> DSA digital certificate<br>
> Preshared key (XAUTH)<br>
> RSA digital certificate (XAUTH)<br>
> DSA digital certificate (XAUTH)<br>
> RSA digital certificate (HYBRID)<br>
> DSA digital certificate (HYBRID)<br>
> <br>
> <br>
> The "preshared key" is the one selected on the cisco 3080
device. Is<br>
> it normal to get the line 6 ? <br>
> <br>
> line 9 : I think this is normal on my side because I didn t configure<br>
> any certificate. Is this line the result of a XAUTH request I
am not<br>
> able to answer ?<br>
> <br>
> Thanks <br>
> _______________________________________________<br>
> Users@openswan.org<br>
> http://lists.openswan.org/mailman/listinfo/users<br>
> Building and Integrating Virtual Private Networks with Openswan: <br>
> http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155<br>
</tt></font>