<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
Hello<br><br>I'm trying to setup a tunnel between openswan 2.4.9 (i've also tried 2.4.11 aswell) and a cisco ASA, however i am getting the errors below. As can be seen <br><br>phase 1 ike succeeds, however phase 2 doesn't.<br><br><br>*****************************<br><br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: initiating Main Mode<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: ignoring Vendor ID payload [FRAGMENTATION c0000000]<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: STATE_MAIN_I2: sent MI2, expecting MR2<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: received Vendor ID payload [Cisco-Unity]<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: received Vendor ID payload [XAUTH]<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: ignoring unknown Vendor ID payload [42fc5a89d3e07f949aed6dc2a8e20893]<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: ignoring Vendor ID payload [Cisco VPN 3000 Series]<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: I did not send a certificate because I do not have one.<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: STATE_MAIN_I3: sent MI3, expecting MR3<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: received Vendor ID payload [Dead Peer Detection]<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: Main mode peer ID is ID_IPV4_ADDR: '192.168.10.2'<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 <br><br>group=modp1024}<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #6: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#5}<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: ignoring informational payload, type INVALID_ID_INFORMATION<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: received and ignored informational message<br>Apr 17 16:41:14 localhost pluto[2784]: "con1" #5: received Delete SA payload: deleting ISAKMP State #5<br>Apr 17 16:41:14 localhost pluto[2784]: packet from 192.168.10.2:500: received and ignored informational message<br><br><br>**************************<br>My ipsec.conf<br><br>conn con0<br> rightsubnet=9.0.0.1/24<br> leftsubnet=11.0.0.1/24<br> also=gw-to-gw<br>conn con1<br> rightsubnet=9.0.1.3/24<br> leftsubnet=11.0.1.3/24<br> also=gw-to-gw<br>conn gw-to-gw<br> left=192.168.10.2<br> right=192.168.10.1<br> esp=3des-md5<br> authby=secret<br> type=tunnel<br> auto=add<br> rekey=yes<br> keylife=8h<br> ike=3des-md5-modp1024<br> aggrmode=no<br> pfs=no<br> compress=no<br><br>************************************<br><br>On the cisco side of things I get error messages:<br><br>713061:Group =192.168.10.1, IP = 192.168.10.1, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 9.0.1.0/255.255.255.0/0/0 local proxy <br><br>11.0.1.0/255.255.255.0/0/0/0 on interface gw2<br><br>I've looked up this error, which is basically complaining that the tunnel address on both sides dont match. However I've checked all my addresses and they <br><br>match.<br><br>One thing wrong to notice from the error is 9.0.1.0 and 11.0.1.0, as i have 9.0.0.1 and 11.0.0.1 configured both in ipsec.conf and on the cisco asa.<br><br>I've tried googling all the error messages, but nothing I've found hasn't helped. I've plugged my Openswan side into another openswan configured with the ip <br><br>of the cisco asa side and the tunnel came up fine. Am i missing anything from my config file needed to communicate with ASA? <br><br>Regards,<br>Paul Whelan<br><br><br><br><br><br><br /><hr />Pack up or back up–use SkyDrive to transfer files or keep extra copies. <a href='http://www.windowslive.com/skydrive/overview.html?ocid=TXT_TAGLM_WL_Refresh_skydrive_packup_042008' target='_new'>Learn how.</a></body>
</html>