<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>RE: [Openswan Users] Ipsec auto --up {tunnelname} hangs</TITLE>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.3354" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff size=2>OK,
yet another experiment. </FONT></SPAN></DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff size=2>So
far, I've tried starting the tunnel from the right side and the right side whack
hangs. What about the left side? The left side is running a newer
version of Openswan than the right side - what happens when the left side tries
to bring up the tunnel? It turns out, the left side behaves as
expected. It retries a few times, gives up, and returns back to me.
It even gives me a status code I can test. </FONT></SPAN></DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff size=2>The
left side seems to behave correctly, while the right side hangs.
</FONT></SPAN></DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff
size=2>[root@Janesville-fw1 ipsec.d]# ipsec auto --add
JanesvillePNT-Everywhere<BR>[root@Janesville-fw1 ipsec.d]# ipsec auto --up
JanesvillePNT-Everywhere<BR>104 "JanesvillePNT-Everywhere" #1538: STATE_MAIN_I1:
initiate<BR>003 "JanesvillePNT-Everywhere" #1538: ignoring unknown Vendor ID
payload [4f456e4d43757f784f704063]<BR>003 "JanesvillePNT-Everywhere" #1538:
received Vendor ID payload [Dead Peer Detection]<BR>003
"JanesvillePNT-Everywhere" #1538: received Vendor ID payload [RFC 3947] method
set to=110<BR>106 "JanesvillePNT-Everywhere" #1538: STATE_MAIN_I2: sent MI2,
expecting MR2<BR>003 "JanesvillePNT-Everywhere" #1538: NAT-Traversal: Result
using RFC 3947 (NAT-Traversal): no NAT detected<BR>108
"JanesvillePNT-Everywhere" #1538: STATE_MAIN_I3: sent MI3, expecting MR3<BR>003
"JanesvillePNT-Everywhere" #1538: ignoring informational payload, type
INVALID_ID_INFORMATION<BR>003 "JanesvillePNT-Everywhere" #1538: received and
ignored informational message<BR>003 "JanesvillePNT-Everywhere" #1538:
discarding duplicate packet; already STATE_MAIN_I3<BR>010
"JanesvillePNT-Everywhere" #1538: STATE_MAIN_I3: retransmission; will wait 20s
for response<BR>003 "JanesvillePNT-Everywhere" #1538: ignoring informational
payload, type INVALID_ID_INFORMATION<BR>003 "JanesvillePNT-Everywhere" #1538:
received and ignored informational message<BR>003 "JanesvillePNT-Everywhere"
#1538: discarding duplicate packet; already STATE_MAIN_I3<BR>010
"JanesvillePNT-Everywhere" #1538: STATE_MAIN_I3: retransmission; will wait 40s
for response<BR>003 "JanesvillePNT-Everywhere" #1538: ignoring informational
payload, type INVALID_ID_INFORMATION<BR>003 "JanesvillePNT-Everywhere" #1538:
received and ignored informational message<BR>031 "JanesvillePNT-Everywhere"
#1538: max number of retransmissions (2) reached STATE_MAIN_I3. Possible
authentication failure: no acceptable response to our first encrypted
message<BR>000 "JanesvillePNT-Everywhere" #1538: starting keying attempt 2 of an
unlimited number, but releasing whack<BR>[root@Janesville-fw1
ipsec.d]#<BR>[root@Janesville-fw1 ipsec.d]# echo $?<BR>1<BR></FONT></SPAN></DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff size=2>What's
different? </FONT></SPAN></DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff size=2>The
left side is newer than the right side - the left side is running 2.4.9 and fc8,
the right side is running 2.4.5 and fc6. I have an upgrade going into the
right side, I just haven't put it in yet. The right side will have fc9 and the
Openswan version that comes with fc9 - or maybe a newer one, I saw a posting
about Openswan and fc9. </FONT></SPAN></DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff size=2>The
left side has exactly 2 tunnels with similar names. The right side has
these same two tunnels, plus some others to different sites.
</FONT></SPAN></DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff size=2>That's
pretty much it. </FONT></SPAN></DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=812483505-21062008><FONT face=Arial color=#0000ff size=2>-
Greg</DIV></FONT></SPAN></BODY></HTML>