<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Jacco -</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">I went back to check the PSK on the router as you suggested. Strangely, the key was gone and some other settings were changed. I did not not change it. It just reverted on it's own. I reset everything and now the PSK is OK.</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Anyhow, here's and update to the auth.log after I restarted everything (I've bolded the errors I see in the log file):</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Apr 8 11:48:59 localhost pluto[31426]: "DIR130-JON" #14: Informational Exchange message must be encrypted<BR><STRONG>Apr 8 11:49:05 localhost pluto[31426]: "DIR130-JON" #13: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message</STRONG><BR>Apr 8 11:49:05 localhost pluto[31426]: "DIR130-JON" #13: starting keying attempt 7 of an unlimited number<BR>Apr 8 11:49:05 localhost pluto[31426]: "DIR130-JON" #16: initiating Main Mode to replace #13<BR>Apr 8 11:49:05 localhost pluto[31426]: "DIR130-JON" #16: received Vendor ID payload [Dead Peer Detection]<BR>Apr 8 11:49:05 localhost pluto[31426]: "DIR130-JON" #14: retransmitting in response to duplicate packet; already STATE_MAIN_R3<BR>Apr 8 11:49:05 localhost pluto[31426]: "DIR130-JON" #16:
transition from state STATE_MAIN_I1 to state STATE_MAIN_I2<BR>Apr 8 11:49:05 localhost pluto[31426]: "DIR130-JON" #16: STATE_MAIN_I2: sent MI2, expecting MR2<BR>Apr 8 11:49:05 localhost pluto[31426]: "DIR130-JON" #14: Informational Exchange message must be encrypted<BR>Apr 8 11:49:05 localhost pluto[31426]: "DIR130-JON" #16: I did not send a certificate because I do not have one.<BR>Apr 8 11:49:06 localhost pluto[31426]: "DIR130-JON" #16: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3<BR>Apr 8 11:49:06 localhost pluto[31426]: "DIR130-JON" #16: STATE_MAIN_I3: sent MI3, expecting MR3<BR>Apr 8 11:49:06 localhost pluto[31426]: "DIR130-JON" #16: ignoring informational payload, type INVALID_ID_INFORMATION<BR>Apr 8 11:49:06 localhost pluto[31426]: "DIR130-JON" #16: received and ignored informational message<BR>Apr 8 11:49:09 localhost pluto[31426]: "DIR130-JON" #14: Informational Exchange message must
be encrypted<BR>Apr 8 11:49:16 localhost pluto[31426]: "DIR130-JON" #16: discarding duplicate packet; already STATE_MAIN_I3<BR><STRONG>Apr 8 11:49:16 localhost pluto[31426]: "DIR130-JON" #16: ignoring informational payload, type INVALID_ID_INFORMATION</STRONG><BR>Apr 8 11:49:16 localhost pluto[31426]: "DIR130-JON" #16: received and ignored informational message<BR>Apr 8 11:49:26 localhost pluto[31426]: "DIR130-JON" #14: retransmitting in response to duplicate packet; already STATE_MAIN_R3<BR>Apr 8 11:49:26 localhost pluto[31426]: "DIR130-JON" #14: Informational Exchange message must be encrypted<BR>Apr 8 11:49:29 localhost pluto[31426]: "DIR130-JON" #14: Informational Exchange message must be encrypted<BR>Apr 8 11:49:36 localhost pluto[31426]: "DIR130-JON" #16: discarding duplicate packet; already STATE_MAIN_I3<BR>Apr 8 11:49:36 localhost pluto[31426]: "DIR130-JON" #16: ignoring informational payload, type
INVALID_ID_INFORMATION<BR><STRONG>Apr 8 11:49:36 localhost pluto[31426]: "DIR130-JON" #16: received and ignored informational message</STRONG><BR>Apr 8 11:50:06 localhost pluto[31426]: packet from 66.27.113.46:500: received Vendor ID payload [Dead Peer Detection]<BR>Apr 8 11:50:06 localhost pluto[31426]: "DIR130-JON" #17: responding to Main Mode<BR>Apr 8 11:50:06 localhost pluto[31426]: "DIR130-JON" #17: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<BR>Apr 8 11:50:06 localhost pluto[31426]: "DIR130-JON" #17: STATE_MAIN_R1: sent MR1, expecting MI2<BR>Apr 8 11:50:06 localhost pluto[31426]: "DIR130-JON" #17: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<BR>Apr 8 11:50:06 localhost pluto[31426]: "DIR130-JON" #17: STATE_MAIN_R2: sent MR2, expecting MI3<BR>Apr 8 11:50:06 localhost pluto[31426]: "DIR130-JON" #17: Main mode peer ID is ID_IPV4_ADDR: '66.27.f.g'<BR>Apr 8 11:50:06
localhost pluto[31426]: "DIR130-JON" #17: I did not send a certificate because I do not have one.<BR>Apr 8 11:50:06 localhost pluto[31426]: "DIR130-JON" #17: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<BR>Apr 8 11:50:06 localhost pluto[31426]: "DIR130-JON" #17: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}<BR>Apr 8 11:50:06 localhost pluto[31426]: "DIR130-JON" #17: Informational Exchange message must be encrypted<BR><STRONG>Apr 8 11:50:09 localhost pluto[31426]: "DIR130-JON" #15: max number of retransmissions (2) reached STATE_QUICK_I1. No acceptable response to our first Quick Mode message: perhaps peer likes no proposal</STRONG><BR>Apr 8 11:50:09 localhost pluto[31426]: "DIR130-JON" #15: starting keying attempt 3 of an unlimited number<BR>Apr 8 11:50:09 localhost pluto[31426]: "DIR130-JON" #18: initiating Quick
Mode PSK+ENCRYPT+TUNNEL+PFS+UP to replace #15 {using isakmp#17}<BR>Apr 8 11:50:09 localhost pluto[31426]: "DIR130-JON" #17: Informational Exchange message must be encrypted<BR>Apr 8 11:50:15 localhost pluto[31426]: "DIR130-JON" #17: retransmitting in response to duplicate packet; already STATE_MAIN_R3<BR>Apr 8 11:50:15 localhost pluto[31426]: "DIR130-JON" #17: Informational Exchange message must be encrypted<BR><STRONG>Apr 8 11:50:16 localhost pluto[31426]: "DIR130-JON" #16: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message</STRONG><BR>Apr 8 11:50:16 localhost pluto[31426]: "DIR130-JON" #16: starting keying attempt 8 of an unlimited number<BR></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Interestingly this is from the DIR-130's log at the remote site:</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><TR><TD width="120"><STRONG>Apr 8 11:52:25</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #19: ignoring Vendor ID payload [4f457a7d4646466667725f65]</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"></TD></TR><TR><TD width="120"><STRONG>Apr 8 11:52:26</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #19: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"></TD></TR><TR><TD width="120"><STRONG>Apr 8 11:52:26</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #19: Main mode peer ID is ID_IPV4_ADDR: '192.168.23.23'</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"></TD></TR><TR><TD width="120"><STRONG>Apr 8 11:52:29</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #19: Quick Mode message is unacceptable because it is for an incomplete ISAKMP SA</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"></TD></TR><TR><TD width="120"><STRONG>Apr 8 11:52:36</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #18: max number of retransmissions (2) reached STATE_MAIN_R2</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"></TD></TR><TR><TD width="120"><STRONG>Apr 8 11:52:36</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #19: Main mode peer ID is ID_IPV4_ADDR: '192.168.23.23'</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"></TD></TR><TR><TD width="120"><STRONG>Apr 8 11:52:37</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #20: WARNING: compute_dh_shared(): for OAKLEY_GROUP_MODP1536 took 215026 usec</STRONG></TD></TR></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><TR><TD width="120"><STRONG>Apr 8 11:52:37</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #20: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"></TD></TR><TR><TD width="120"><STRONG>Apr 8 11:52:37</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #20: Main mode peer ID is ID_IPV4_ADDR: '192.168.23.23'</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"></TD></TR><TR><TD width="120"><STRONG>Apr 8 11:52:37</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #20: no suitable connection for peer '192.168.23.23'</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"></TD></TR><TR><TD width="120"><STRONG>Apr 8 11:52:37</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #20: sending notification INVALID_ID_INFORMATION to 66.27.a.b:500</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"></TD></TR><TR><TD width="120"><STRONG>Apr 8 11:52:38</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #19: Quick Mode message is unacceptable because it is for an incomplete ISAKMP SA</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><STRONG></STRONG> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">And a bit later I see this in the DIR-130s log:</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><TR><TD width="120"><STRONG>Apr 8 12:08:56</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #47: Main mode peer ID is ID_IPV4_ADDR: '192.168.23.23'</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"></TD></TR><TR><TD width="120"><STRONG>Apr 8 12:08:56</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #47: we require peer to have ID '66.27.a.b', but peer declares '192.168.23.23'</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"></TD></TR><TR><TD width="120"><STRONG>Apr 8 12:08:56</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #47: sending notification INVALID_ID_INFORMATION to 66.27.a.b:500</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"></TD></TR><TR><TD width="120"><STRONG>Apr 8 12:08:58</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #47: Quick Mode message is unacceptable because it is for an incomplete ISAKMP SA</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"></TD></TR><TR><TD width="120"><STRONG>Apr 8 12:08:58</TD><TD width="80">Debug Information</TD><TD>IPSec "conn_IPSec_Tunnel" #47: sending notification PAYLOAD_MALFORMED to 66.27.a.b:500</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><STRONG></STRONG> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">This seems to point to my ipsec.conf not being correct for left, etc.</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">On the router, there is a field to specify address of Site-to-Site, which must be a routable address so it cannot be 192.168.23.23</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">I will try to change the left parameter to 66.27.a.b and see what happens.</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">If you have some ideas, let me know. thx</TD></TR></TD></TR></DIV>
<P><STRONG></STRONG> </P>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">----- Original Message ----<BR>From: BUI18 <lbui18@yahoo.com><BR>To: users@openswan.org<BR>Sent: Tuesday, April 8, 2008 11:00:44 AM<BR>Subject: Re: [Openswan Users] Error: "initial Main Mode message received on 192.168.23.23:500 but no connection has been authorized"<BR><BR>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Hi Jacco -</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Since there's NATing involved here. Could it be that I don't have the right NAT-T patch? We installed Openswan using apt-get from Ubuntu. And we see the following when we start Openswan:</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Apr 8 10:22:30 localhost pluto[29484]: Setting NAT-Traversal port-4500 floating to on<BR>Apr 8 10:22:30 localhost pluto[29484]: port floating activation criteria nat_t=1/port_fload=1<BR><STRONG>Apr 8 10:22:30 localhost pluto[29484]: including NAT-Traversal patch (Version 0.6c)</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">I am assuming here that it is installed.</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Anyway...it looks like it gets to phase 1 but no further:</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">000 "DIR130-JON": 192.168.23.0/24===192.168.23.23---192.168.23.1...66.27.f.g===192.168.99.0/24; prospective erouted; eroute owner: #0<BR>000 "DIR130-JON": srcip=unset; dstip=unset; srcup=ipsec _updown; dstup=ipsec _updown;<BR>000 "DIR130-JON": ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0<BR>000 "DIR130-JON": policy: PSK+ENCRYPT+TUNNEL+PFS+UP; prio: 24,24; interface: eth0; <BR>000 "DIR130-JON": newest ISAKMP SA: #3; newest IPsec SA: #0; <BR>000 "DIR130-JON": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024<BR>000 <BR>000 #1: "DIR130-JON":500 STATE_MAIN_I1 (sent MI1, expecting MR1); EVENT_RETRANSMIT in 11s; nodpd<BR><STRONG>000 #1: pending Phase 2 for "DIR130-JON" replacing #0</STRONG><BR><STRONG>000 #3: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP
SA established); EVENT_SA_REPLACE in 28481s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0)<BR>000 #2: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28410s; lastdpd=-1s(seq in:0 out:0)</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Also....from auth.log I can see that it does try to get to phase 2...eventually...but never completes.</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">It starts like this for a while and repeats:</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Apr 8 10:27:31 localhost pluto[29484]: "DIR130-JON" #6: responding to Main Mode<BR>Apr 8 10:27:31 localhost pluto[29484]: "DIR130-JON" #6: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<BR>Apr 8 10:27:31 localhost pluto[29484]: "DIR130-JON" #6: STATE_MAIN_R1: sent MR1, expecting MI2<BR>Apr 8 10:27:31 localhost pluto[29484]: "DIR130-JON" #6: NAT-Traversal: Result using 3: i am NATed<BR>Apr 8 10:27:31 localhost pluto[29484]: "DIR130-JON" #6: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<BR>Apr 8 10:27:31 localhost pluto[29484]: "DIR130-JON" #6: STATE_MAIN_R2: sent MR2, expecting MI3<BR>Apr 8 10:27:31 localhost pluto[29484]: "DIR130-JON" #6: Main mode peer ID is ID_IPV4_ADDR: '66.27.113.46'<BR>Apr 8 10:27:31 localhost pluto[29484]: "DIR130-JON" #6: I did not send a certificate because I do not have
one.<BR>Apr 8 10:27:31 localhost pluto[29484]: "DIR130-JON" #6: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<BR>Apr 8 10:27:31 localhost pluto[29484]: "DIR130-JON" #6: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}<BR><STRONG>Apr 8 10:27:31 localhost pluto[29484]: "DIR130-JON" #6: Informational Exchange message must be encrypted<BR>Apr 8 10:27:41 localhost pluto[29484]: "DIR130-JON" #6: retransmitting in response to duplicate packet; already STATE_MAIN_R3<BR>Apr 8 10:27:41 localhost pluto[29484]: "DIR130-JON" #6: Informational Exchange message must be encrypted<BR>Apr 8 10:28:01 localhost pluto[29484]: "DIR130-JON" #6: retransmitting in response to duplicate packet; already STATE_MAIN_R3<BR>Apr 8 10:28:01 localhost pluto[29484]: "DIR130-JON" #6: Informational Exchange message must be encrypted</STRONG><BR>Apr
8 10:28:41 localhost pluto[29484]: packet from 66.27.f.g:4500: received Vendor ID payload [RFC 3947] method set to=109 <BR>Apr 8 10:28:41 localhost pluto[29484]: packet from 66.27.f.g:4500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109<BR>Apr 8 10:28:41 localhost pluto[29484]: packet from 66.27.f.g:4500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109<BR>Apr 8 10:28:41 localhost pluto[29484]: packet from 66.27.f.g:4500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]<BR>Apr 8 10:28:41 localhost pluto[29484]: packet from 66.27.f.g:4500: received Vendor ID payload [Dead Peer Detection]</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Not sure why it getting the encryption errors regarding STATE_MAIN_R3</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Tcpdump shows the following while the above in auth.log is going on:</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">10:29:40.500815 IP 192.168.23.23.500 > 66.27.f.g.500: isakmp: phase 1 I ident<BR>10:29:49.502544 IP 192.168.23.23.4500 > 66.27.f.g.4500: isakmp-nat-keep-alive<BR>10:29:51.524623 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I ident<BR>10:29:51.525060 IP 192.168.23.23.4500 > 66.27.f.g.4500: NONESP-encap: isakmp: phase 1 R ident<BR>10:29:51.591027 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I ident<BR>10:29:51.597227 IP 192.168.23.23.4500 > 66.27.113.46.4500: NONESP-encap: isakmp: phase 1 R ident<BR>10:29:51.654476 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I ident[E]<BR>10:29:51.654783 IP 192.168.23.23.4500 > 66.27.f.g.4500: NONESP-encap: isakmp: phase 1 R ident[E]<BR>10:29:51.677106 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I
inf<BR>10:30:01.671285 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I ident[E]<BR>10:30:01.671462 IP 192.168.23.23.4500 > 66.27.f.g.4500: NONESP-encap: isakmp: phase 1 R ident[E]<BR>10:30:01.697723 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I inf<BR>10:30:09.702301 IP 192.168.23.23.4500 > 66.27.f.g.4500: isakmp-nat-keep-alive<BR>10:30:20.705970 IP 192.168.23.23.500 > 66.27.f.g.500: isakmp: phase 1 I ident<BR>10:30:21.724434 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I ident[E]<BR>10:30:21.724613 IP 192.168.23.23.4500 > 66.27.f.g.4500: NONESP-encap: isakmp: phase 1 R ident[E]<BR>10:30:21.747428 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I inf<BR>10:30:29.748732 IP 192.168.23.23.4500 > 66.27.f.g.4500: isakmp-nat-keep-alive<BR></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Not sure what this means in tcpdump.</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Meanwhile "ipsec auto status" has grown and will keep growing. What is it trying to do here..I have no idea:</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">000 #13: pending Phase 2 for "DIR130-JON" replacing #0<BR>000 #8: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28131s; lastdpd=-1s(seq in:0 out:0)<BR>000 #6: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 27991s; lastdpd=-1s(seq in:0 out:0)<BR>000 #7: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28061s; lastdpd=-1s(seq in:0 out:0)<BR>000 #4: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 27850s; lastdpd=-1s(seq in:0 out:0)<BR>000 #11: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28342s; lastdpd=-1s(seq in:0 out:0)<BR>000 #3: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 27780s; lastdpd=-1s(seq in:0 out:0)<BR>000 #5:
"DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 27920s; lastdpd=-1s(seq in:0 out:0)<BR>000 #2: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 27709s; lastdpd=-1s(seq in:0 out:0)<BR>000 #12: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28412s; lastdpd=-1s(seq in:0 out:0)<BR>000<BR></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">netstat -rn shows that Openswan does have a route to the other private network:</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><STRONG>Destination Gateway Genmask Flags MSS Window irtt Iface</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><STRONG>192.168.99.0 192.168.23.1 255.255.255.0 UG 0 0 0 eth0</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">When I ping 192.168.99.1 (the LAN side of the DIR-130) I get:</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><A href="mailto:root@myopenswanhost" target=_blank rel=nofollow ymailto="mailto:root@myopenswanhost"><STRONG>root@myopenswanhost</STRONG></A><STRONG># ping 192.168.99.1<BR>connect: Resource temporarily unavailable</STRONG></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Now auth.log starts to show new error (shown in bold)...and this series of transaction repeats.</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Apr 8 10:42:44 localhost pluto[29484]: packet from 66.27.113.46:4500: received Vendor ID payload [RFC 3947] method set to=109 <BR>Apr 8 10:42:44 localhost pluto[29484]: packet from 66.27.113.46:4500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109<BR>Apr 8 10:42:44 localhost pluto[29484]: packet from 66.27.113.46:4500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109<BR>Apr 8 10:42:44 localhost pluto[29484]: packet from 66.27.113.46:4500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]<BR>Apr 8 10:42:44 localhost pluto[29484]: packet from 66.27.113.46:4500: received Vendor ID payload [Dead Peer Detection]<BR>Apr 8 10:42:44 localhost pluto[29484]: "DIR130-JON" #21: responding to Main Mode<BR>Apr 8 10:42:44 localhost
pluto[29484]: "DIR130-JON" #21: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<BR>Apr 8 10:42:44 localhost pluto[29484]: "DIR130-JON" #21: STATE_MAIN_R1: sent MR1, expecting MI2<BR>Apr 8 10:42:44 localhost pluto[29484]: "DIR130-JON" #21: NAT-Traversal: Result using 3: i am NATed<BR>Apr 8 10:42:44 localhost pluto[29484]: "DIR130-JON" #21: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<BR>Apr 8 10:42:44 localhost pluto[29484]: "DIR130-JON" #21: STATE_MAIN_R2: sent MR2, expecting MI3<BR>Apr 8 10:42:44 localhost pluto[29484]: "DIR130-JON" #21: Main mode peer ID is ID_IPV4_ADDR: '66.27.113.46'<BR>Apr 8 10:42:44 localhost pluto[29484]: "DIR130-JON" #21: I did not send a certificate because I do not have one.<BR>Apr 8 10:42:44 localhost pluto[29484]: "DIR130-JON" #21: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<BR>Apr 8 10:42:44 localhost pluto[29484]: "DIR130-JON" #21:
STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}<BR>Apr 8 10:42:44 localhost pluto[29484]: "DIR130-JON" #21: Informational Exchange message must be encrypted<BR>Apr 8 10:42:54 localhost pluto[29484]: "DIR130-JON" #21: retransmitting in response to duplicate packet; already STATE_MAIN_R3<BR>Apr 8 10:42:54 localhost pluto[29484]: "DIR130-JON" #21: Informational Exchange message must be encrypted<BR>Apr 8 10:43:14 localhost pluto[29484]: "DIR130-JON" #21: retransmitting in response to duplicate packet; already STATE_MAIN_R3<BR>Apr 8 10:43:15 localhost pluto[29484]: "DIR130-JON" #21: Informational Exchange message must be encrypted<BR><STRONG>Apr 8 10:43:20 localhost pluto[29484]: "DIR130-JON" #20: max number of retransmissions (2) reached STATE_QUICK_I1. No acceptable response to our first Quick Mode message: perhaps peer likes no
proposal</STRONG><BR>Apr 8 10:43:20 localhost pluto[29484]: "DIR130-JON" #20: starting keying attempt 2 of an unlimited number<BR>Apr 8 10:43:20 localhost pluto[29484]: "DIR130-JON" #22: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP to replace #20 {using isakmp#21}<BR>Apr 8 10:43:20 localhost pluto[29484]: "DIR130-JON" #21: Informational Exchange message must be encrypted<BR>Apr 8 10:43:50 localhost last message repeated 2 times</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">and tcpdump now shows phase 2 related packets all initiated by Openswan:</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">10:46:09.030401 IP 192.168.23.23.4500 > 66.27.f.g.4500: isakmp-nat-keep-alive<BR><STRONG>10:46:10.033687 IP 192.168.23.23.4500 > 66.27.f.g.4500: NONESP-encap: isakmp: phase 2/others R oakley-quick[E]</STRONG><BR>10:46:10.033723 IP 192.168.23.23.500 > 66.27.f.g.500: isakmp: phase 1 I ident<BR>10:46:10.059197 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I inf<BR>10:46:14.072964 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I ident<BR>10:46:14.073608 IP 192.168.23.23.4500 > 66.27.f.g.4500: NONESP-encap: isakmp: phase 1 R ident<BR>10:46:14.152624 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I ident<BR>10:46:14.223007 IP 192.168.23.23.4500 > 66.27.f.g.4500: NONESP-encap: isakmp: phase 1 R ident<BR>10:46:14.285564 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp:
phase 1 I ident[E]<BR>10:46:14.472516 IP 192.168.23.23.4500 > 66.27.f.g.4500: NONESP-encap: isakmp: phase 1 R ident[E]<BR>10:46:14.501446 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I inf<BR>10:46:24.497065 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I ident[E]<BR>10:46:24.497267 IP 192.168.23.23.4500 > 66.27.f.g.4500: NONESP-encap: isakmp: phase 1 R ident[E]<BR>10:46:24.523523 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I inf<BR>10:46:29.524189 IP 192.168.23.23.4500 > 66.27.f.g.4500: isakmp-nat-keep-alive<BR>10:46:44.518040 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I ident[E]<BR>10:46:44.518327 IP 192.168.23.23.4500 > 66.27.f.g.4500: NONESP-encap: isakmp: phase 1 R ident[E]<BR>10:46:44.543993 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I inf<BR>10:46:49.541535 IP 192.168.23.23.4500 >
66.27.f.g.4500: isakmp-nat-keep-alive<BR>10:46:50.544470 IP 192.168.23.23.500 > 66.27.f.g.500: isakmp: phase 1 I ident<BR><STRONG>10:46:50.548206 IP 192.168.23.23.4500 > 66.27.f.g.4500: NONESP-encap: isakmp: phase 2/others R oakley-quick[E]<BR></STRONG>10:46:50.578267 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I inf<BR><STRONG>10:47:00.577804 IP 192.168.23.23.4500 > 66.27.f.g.4500: NONESP-encap: isakmp: phase 2/others R oakley-quick[E]<BR></STRONG>10:47:00.604185 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I inf<BR>10:47:09.605322 IP 192.168.23.23.4500 > 66.27.f.g.4500: isakmp-nat-keep-alive<BR><STRONG>10:47:20.553018 IP 192.168.23.23.4500 > 66.27.f.g.4500: NONESP-encap: isakmp: phase 2/others R oakley-quick[E]</STRONG><BR>10:47:20.574353 IP 66.27.f.g.4500 > 192.168.23.23.4500: NONESP-encap: isakmp: phase 1 I inf</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Not sure where to go from here. Let me know if you have any insight into all this. Hoping you have some ideas...thx</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><BR>----- Original Message ----<BR>From: Jacco de Leeuw <jacco2@dds.nl><BR>To: users@openswan.org<BR>Sent: Tuesday, April 8, 2008 1:55:38 AM<BR>Subject: Re: [Openswan Users] Error: "initial Main Mode message received on 192.168.23.23:500 but no connection has been authorized"<BR><BR>BUI18 wrote:<BR><BR>> Here's an update. I opened up both port 500 and 4500 on the DIR-130 and<BR>> on the other end's router. Now it looks like I get established but<BR>> can't ping.<BR>> Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: ignoring<BR>> informational payload, type INVALID_ID_INFORMATION<BR><BR>The DIR-130 disconnects because there is something it does not like.<BR>Check its log files. Perhaps the PSKs do not match?<BR><BR>Jacco<BR>-- <BR>Jacco de Leeuw
mailto:<A href="mailto:jacco2@dds.nl" target=_blank rel=nofollow ymailto="mailto:jacco2@dds.nl">jacco2@dds.nl</A><BR>Zaandam, The Netherlands <A href="http://www.jacco2.dds.nl/" target=_blank rel=nofollow>http://www.jacco2.dds.nl</A><BR></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><BR></DIV></DIV><BR>
<HR SIZE=1>
You rock. That's why Blockbuster's offering you <A href="http://us.rd.yahoo.com/evt=47523/*http://tc.deals.yahoo.com/tc/blockbuster/text5.com" target=_blank rel=nofollow>one month of Blockbuster Total Access</A>, No Cost.</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><BR></DIV></div><br>
<hr size=1>You rock. That's why Blockbuster's offering you <a href="http://us.rd.yahoo.com/evt=47523/*http://tc.deals.yahoo.com/tc/blockbuster/text5.com">one month of Blockbuster Total Access</a>, No Cost.</body></html>