<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><DIV>Hi -</DIV>
<DIV> </DIV>
<DIV>Can someone assist with this error? I am trying to create a site to site between a D-Link DIR-130 VPN router and Openswan.</DIV>
<DIV> </DIV>
<DIV>My setup:</DIV>
<DIV>Left Side = Openswan</DIV>
<DIV>Right Side = DIR-130 Router</DIV>
<DIV> </DIV>
<DIV>Left Side LAN (192.168.23.0/24) --- Left Side Router's LAN IP (192.168.23.1) --- WAN IP (66.27.a.b) --- Next Left Hop (24.25.c.d) .....INTERNET...... Next Right Hop (66.27.e.1) --- WAN IP (66.27.f.g) --- DIR-130's LAN IP (192.168.99.1) --- Right Side LAN (192.168.99.0/24)</DIV>
<DIV> </DIV>
<DIV>The DIR-130 is set to use PSK, 3DES, MD5, modp1024</DIV>
<DIV> </DIV>
<DIV>You can see from the log that the Openswan server does indeed receive initialization from the router. But then....nothing.</DIV>
<DIV> </DIV>
<DIV>Here's an excerpt from auth.log:</DIV>
<DIV> </DIV>
<DIV> packet from 66.27.113.46:500: received Vendor ID payload [RFC 3947] method set to=109 <BR>Apr 6 17:43:50 localhost pluto[20252]: packet from 66.27.113.46:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109<BR>Apr 6 17:43:50 localhost pluto[20252]: packet from 66.27.113.46:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109<BR>Apr 6 17:43:51 localhost pluto[20252]: packet from 66.27.113.46:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]<BR>Apr 6 17:43:51 localhost pluto[20252]: packet from 66.27.113.46:500: received Vendor ID payload [Dead Peer Detection]<BR>Apr 6 17:43:51 localhost pluto[20252]: | nat-t detected, sending nat-t VID<BR>Apr 6 17:43:51 localhost pluto[20252]: | find_host_connection called from main_inI1_outR1<BR>Apr 6 17:43:51 localhost pluto[20252]: | find_host_pair_conn
(find_host_connection2): 192.168.23.23:500 66.27.113.46:500 -> hp:none <BR>Apr 6 17:43:51 localhost pluto[20252]: | find_host_connection called from main_inI1_outR1<BR>Apr 6 17:43:51 localhost pluto[20252]: | find_host_pair_conn (find_host_connection2): 192.168.23.23:500 %any:500 -> hp:none <BR>Apr 6 17:43:51 localhost pluto[20252]: packet from 66.27.113.46:500: <STRONG>initial Main Mode message received on 192.168.23.23:500 but no connection has been authorized</STRONG></DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Here are the results from "ipsec auto --status":</DIV>
<DIV> </DIV>
<DIV>000 debug raw+crypt+parsing+emitting+control+lifecycle+klips+dns+oppo+controlmore+pfkey+nattraversal+x509<BR>000 <BR>000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64<BR>000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192<BR>000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448<BR>000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0<BR>000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256<BR>000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256<BR>000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256<BR>000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128<BR>000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160,
keysizemax=160<BR>000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256<BR>000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0, keysizemax=0<BR>000 <BR>000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192<BR>000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128<BR>000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<BR>000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<BR>000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024<BR>000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536<BR>000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048<BR>000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072<BR>000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096<BR>000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144,
bits=6144<BR>000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192<BR>000 <BR>000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0} <BR>000 <BR>000 "DIR130-JON": 192.168.23.0/24===66.27.a.b---24.25.c.d...66.27.e.1---66.27.f.g===192.168.99.0/24; unrouted; eroute owner: #0<BR>000 "DIR130-JON": srcip=unset; dstip=unset; srcup=ipsec _updown; dstup=ipsec _updown;<BR>000 "DIR130-JON": ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0<BR>000 "DIR130-JON": policy: PSK+ENCRYPT+TUNNEL+PFS; prio: 24,24; interface: ; <BR>000 "DIR130-JON": newest ISAKMP SA: #0; newest IPsec SA: #0; <BR>000 <BR>000</DIV>
<DIV> </DIV>
<DIV>Here's my ipsec.conf:</DIV>
<DIV> </DIV>
<DIV># basic configuration<BR>config setup<BR> # plutodebug / klipsdebug = "all", "none" or a combation from below:<BR> # "raw crypt parsing emitting control klips pfkey natt x509 private"<BR> # eg:<BR> # plutodebug="control parsing"<BR> #<BR> # Only enable klipsdebug=all if you are a developer<BR> #<BR> # NAT-TRAVERSAL support, see README.NAT-Traversal<BR> nat_traversal=yes<BR> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%4:172.16.0.0/12,%v4:!192.168.23.0/24<BR>
interfaces=%defaultroute<BR> klipsdebug=none<BR> plutodebug=all</DIV>
<DIV># Add connections here<BR>conn DIR130-JON<BR> # Left security gateway, subnet behind it, nexthop toward right.<BR> left=66.27.a.b<BR> leftsubnet=192.168.23.0/24<BR> leftnexthop=24.25.c.d</DIV>
<DIV> # Right security gateway, subnet behind it, nexthop toward left.<BR> right=66.27.f.g<BR> rightsubnet=192.168.99.0/24<BR> rightnexthop=66.27.e.1<BR> keyexchange=ike<BR> ikelifetime=480m<BR> keylife=3600s<BR> pfs=yes<BR> compress=no<BR> authby=secret<BR> keyingtries=0<BR> auto=start</DIV>
<DIV>#Disable Opportunistic Encryption<BR>include /etc/ipsec.d/examples/no_oe.conf</DIV>
<DIV> </DIV>
<DIV>If you need any additional info, please let me know.</DIV>
<DIV>Any help would be greatly appreciated.</DIV>
<DIV> </DIV>
<DIV>Thanks</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV> </DIV></div><br>
<hr size=1>You rock. That's why Blockbuster's offering you <a href="http://us.rd.yahoo.com/evt=47523/*http://tc.deals.yahoo.com/tc/blockbuster/text5.com">one month of Blockbuster Total Access</a>, No Cost.</body></html>