<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Hi Jacco -</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Here's an update. I opened up both port 500 and 4500 on the DIR-130 and on the other end's router. Now it looks like I get established but can't ping.</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Here's "ipsec auto --status":</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">000 "DIR130-JON": 192.168.23.0/24===192.168.23.23---66.27.a.b...66.27.f.g===192.168.99.0/24; prospective erouted; eroute owner: #0<BR>000 "DIR130-JON": srcip=unset; dstip=unset; srcup=ipsec _updown; dstup=ipsec _updown;<BR>000 "DIR130-JON": ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0<BR>000 "DIR130-JON": policy: PSK+ENCRYPT+TUNNEL+PFS+UP; prio: 24,24; interface: eth0; <BR>000 "DIR130-JON": newest ISAKMP SA: #10; newest IPsec SA: #0; <BR>000 "DIR130-JON": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024<BR>000 <BR>000 #7: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28266s; lastdpd=-1s(seq in:0 out:0)<BR>000 #4: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28055s;
lastdpd=-1s(seq in:0 out:0)<BR>000 #8: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28336s; lastdpd=-1s(seq in:0 out:0)<BR><STRONG>000 #3: "DIR130-JON":500 STATE_MAIN_I1 (sent MI1, expecting MR1); EVENT_RETRANSMIT in 35s; nodpd<BR>000 #3: pending Phase 2 for "DIR130-JON" replacing #0<BR></STRONG>000 #9: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28407s; lastdpd=-1s(seq in:0 out:0)<BR>000 #10: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28477s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0)<BR>000 #2: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 27985s; lastdpd=-1s(seq in:0 out:0)<BR>000 #6: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28196s; lastdpd=-1s(seq in:0 out:0)<BR>000 #5: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established);
EVENT_SA_REPLACE in 28125s; lastdpd=-1s(seq in:0 out:0)<BR>000<BR></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Not sure about line with #3. It looks like it still tries on port 500.</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Here's an excerpt in auth.log:</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Apr 7 17:55:31 localhost pluto[17646]: packet from 66.27.f.g:500: received Vendor ID payload [RFC 3947] method set to=109 <BR>Apr 7 17:55:31 localhost pluto[17646]: packet from 66.27.f.g:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109<BR>Apr 7 17:55:31 localhost pluto[17646]: packet from 66.27.f.g:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109<BR>Apr 7 17:55:31 localhost pluto[17646]: packet from 66.27.f.g:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]<BR>Apr 7 17:55:31 localhost pluto[17646]: packet from 66.f.g.46:500: received Vendor ID payload [Dead Peer Detection]<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: responding to Main Mode<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON"
#2: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: STATE_MAIN_R1: sent MR1, expecting MI2<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: STATE_MAIN_I2: sent MI2, expecting MR2<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: NAT-Traversal: Result using 3: i am NATed<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: STATE_MAIN_R2: sent MR2, expecting MI3<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: I did not send a certificate because I do not have one.<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: NAT-Traversal: Result using 3: i am
NATed<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: STATE_MAIN_I3: sent MI3, expecting MR3<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: Main mode peer ID is ID_IPV4_ADDR: '66.27.113.46'<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: I did not send a certificate because I do not have one.<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<BR>Apr 7 17:55:31 localhost pluto[17646]: | <STRONG>NAT-T: new mapping 66.27.f.g:500/4500)</STRONG><BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1:
ignoring informational payload, type INVALID_ID_INFORMATION<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: received and ignored informational message<BR>Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: Informational Exchange message must be encrypted<BR>Apr 7 17:55:41 localhost pluto[17646]: "DIR130-JON" #2: retransmitting in response to duplicate packet; already STATE_MAIN_R3<BR>Apr 7 17:55:41 localhost pluto[17646]: "DIR130-JON" #1: discarding duplicate packet; already STATE_MAIN_I3<BR>Apr 7 17:55:41 localhost pluto[17646]: "DIR130-JON" #2: Informational Exchange message must be encrypted<BR>Apr 7 17:55:41 localhost pluto[17646]: "DIR130-JON" #1: ignoring informational payload, type INVALID_ID_INFORMATION<BR>Apr 7 17:55:41 localhost pluto[17646]: "DIR130-JON" #1: received and ignored informational message<BR>Apr 7 17:56:01 localhost pluto[17646]: "DIR130-JON" #1: discarding duplicate
packet; already STATE_MAIN_I3<BR>Apr 7 17:56:01 localhost pluto[17646]: "DIR130-JON" #2: retransmitting in response to duplicate packet; already STATE_MAIN_R3<BR>Apr 7 17:56:01 localhost pluto[17646]: "DIR130-JON" #1: ignoring informational payload, type INVALID_ID_INFORMATION<BR>Apr 7 17:56:01 localhost pluto[17646]: "DIR130-JON" #1: received and ignored informational message<BR>Apr 7 17:56:01 localhost pluto[17646]: "DIR130-JON" #2: Informational Exchange message must be encrypted<BR>Apr 7 17:56:41 localhost pluto[17646]: "DIR130-JON" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message<BR>Apr 7 17:56:41 localhost pluto[17646]: "DIR130-JON" #1: starting keying attempt 2 of an unlimited number<BR>Apr 7 17:56:41 localhost pluto[17646]: "DIR130-JON" #3: initiating Main Mode to replace #1<BR></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">and this repeats.</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Let me know if you have an idea of where I might look next for to get this working. I really appreciate all the help you have provided.</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">----- Original Message ----<BR>From: Jacco de Leeuw <jacco2@dds.nl><BR>To: users@openswan.org<BR>Sent: Monday, April 7, 2008 3:32:38 PM<BR>Subject: Re: [Openswan Users] Error: "initial Main Mode message received on 192.168.23.23:500 but no connection has been authorized"<BR><BR><BR>BUI18 wrote:<BR><BR>> conn DIR130-JON<BR>> left=192.168.23.23<BR>> leftsubnet=192.168.23.0/24<BR>> leftnexthop=66.27.a.b<BR><BR>How about this:<BR>leftnexthop=192.168.23.1<BR><BR>> Apr 7 14:23:02 localhost pluto[19788]: "DIR130-JON": route-client<BR>> output: /usr/lib/ipsec/_updown: doroute `ip route add 192.168.99.0/24<BR>> via 66.27.a.b dev eth0 ' failed (RTNETLINK answers: Network is unreachable)<BR><BR>Jacco<BR>-- <BR>Jacco de Leeuw
mailto:<A href="mailto:jacco2@dds.nl" ymailto="mailto:jacco2@dds.nl">jacco2@dds.nl</A><BR>Zaandam, The Netherlands <A href="http://www.jacco2.dds.nl/" target=_blank>http://www.jacco2.dds.nl</A><BR>_______________________________________________<BR><A href="mailto:Users@openswan.org" ymailto="mailto:Users@openswan.org">Users@openswan.org</A><BR><A href="http://lists.openswan.org/mailman/listinfo/users" target=_blank>http://lists.openswan.org/mailman/listinfo/users</A><BR>Building and Integrating Virtual Private Networks with Openswan: <BR><A href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target=_blank>http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</A><BR></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><BR></DIV></div><br>
<hr size=1>You rock. That's why Blockbuster's offering you <a href="http://us.rd.yahoo.com/evt=47523/*http://tc.deals.yahoo.com/tc/blockbuster/text5.com">one month of Blockbuster Total Access</a>, No Cost.</body></html>