<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7653.38">
<TITLE>RE : [Openswan Users] help with ipsec + zywall</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Ok, I have the problem right now.<BR>
<BR>
The tunnel seems to be down on the vpn box side :<BR>
000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,1409,36} trans={0,1409,540} attrs={0,1409,360}<BR>
000 <BR>
000 "techvar": 192.168.2.0/24===xxxx...xxxx===192.168.1.0/24; erouted HOLD; eroute owner: #0<BR>
000 "techvar": srcip=unset; dstip=unset; srcup=ipsec _updown; dstup=ipsec _updown;<BR>
000 "techvar": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 1<BR>
000 "techvar": policy: PSK+ENCRYPT+COMPRESS+TUNNEL+PFS; prio: 24,24; interface: eth1; encap: esp;<BR>
000 "techvar": newest ISAKMP SA: #0; newest IPsec SA: #0;<BR>
000 "techvar": ESP algorithms wanted: 3DES(3)_000-MD5(1); flags=strict<BR>
000 "techvar": ESP algorithms loaded: 3DES(3)_000-MD5(1); flags=strict<BR>
000 <BR>
000 #2822: "techvar":500 STATE_QUICK_I1 (sent QI1, expecting QR1); EVENT_RETRANSMIT in 5s; lastdpd=-1s(seq in:0 out:0)<BR>
000 #2824: "techvar":500 STATE_QUICK_I1 (sent QI1, expecting QR1); EVENT_RETRANSMIT in 35s; lastdpd=-1s(seq in:0 out:0)<BR>
<BR>
<BR>
un 10 08:08:47 zola pluto[3014]: initiate on demand from 192.168.2.1:0 to 192.168.1.1:0 proto=0 state: fos_start because: acquire<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: initiating Main Mode<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: received Vendor ID payload [Dead Peer Detection]<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: ignoring unknown Vendor ID payload [625027749d5ab97f5616c1602765cf480a3b7d0b]<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: STATE_MAIN_I2: sent MI2, expecting MR2<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: I did not send a certificate because I do not have one.<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: STATE_MAIN_I3: sent MI3, expecting MR3<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: Main mode peer ID is ID_IPV4_ADDR: 'xxxxxxxxx'<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2824: initiating Quick Mode PSK+ENCRYPT+COMPRESS+TUNNEL+PFS {using isakmp#2823}<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: ignoring informational payload, type NO_PROPOSAL_CHOSEN<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: received and ignored informational message<BR>
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: received Delete SA payload: deleting ISAKMP State #2823<BR>
Jun 10 08:08:47 zola pluto[3014]: packet from xxxxxxxxx:500: received and ignored informational message<BR>
Jun 10 08:08:57 zola pluto[3014]: "techvar" #2820: max number of retransmissions (2) reached STATE_QUICK_I1. No acceptable response to our first Quick Mode message: perhaps peer likes no proposal<BR>
<BR>
On the router side the logs tell that "[SA] No proposal chosen", but in the vpn state, I can see that the vpn is connected.<BR>
I have to disconnect using the hangup button to re-build the tunnel :<BR>
<BR>
000 #2826: "techvar":500 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 28526s; newest IPSEC; eroute owner<BR>
000 #2826: "techvar" esp.540ef5ea@xxxxx esp.23f623e6@xxxx tun.0@217.128.239.227 tun.0@xxxxxx<BR>
000 #2825: "techvar":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 3325s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0)<BR>
<BR>
root@xxx /etc > ping 192.168.1.1<BR>
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.<BR>
64 bytes from 192.168.1.1: icmp_seq=1 ttl=254 time=38.4 ms<BR>
<BR>
In the router config, I have :<BR>
---------- IKE Setup ----------<BR>
<BR>
Authentication Method: Pre-Shared Key<BR>
<BR>
Phase 1 - Negotiation Mode= Main<BR>
Authentication= preShareKey<BR>
Key= xxxxxxxxxx<BR>
Encryption Algorithm= 3DES Authentication Algorithm= MD5<BR>
SA Life Time (Seconds)= 86400 Key Group= DH2<BR>
<BR>
<BR>
ras> ipsec ipsecDisplay 1<BR>
---------- IPSec Setup ----------<BR>
Index #= 1 Active= Yes Multi Pro = No Protocol= 0 Global SW= 0xA<BR>
Bound IKE 1 NailUp = Yes Netbios = No Name= vpn<BR>
<BR>
ControlPing = No LogControlPing = No Control ping address = 0.0.0.0<BR>
Local: Addr Type= SUBNET Port Start= 0 End= N/A<BR>
IP Addr Start= 192.168.1.0 Mask= 255.255.255.0<BR>
<BR>
Remote: Addr Type= SUBNET Port Start= 0 End= N/A<BR>
IP Addr Start= 192.168.2.0 Mask= 255.255.255.0<BR>
<BR>
Enable Replay Detection= Yes Key Management= IKE<BR>
Phase 2 - Active Protocol= ESP<BR>
Encryption Algorithm= 3DES Authentication Algorithm= MD5<BR>
SA Life Time (Seconds)= 86400<BR>
Encapsulation= Tunnel Perfect Forward Secrecy (PFS)= DH2<BR>
<BR>
Any idea ?<BR>
<BR>
---<BR>
Reza ISSANY<BR>
Ingénieur Système<BR>
ZA Les Playes - Jean Monnet Sud<BR>
Avenue de Lisbonne<BR>
83500 La Seyne sur Mer<BR>
<BR>
<BR>
<BR>
-------- Message d'origine--------<BR>
De: Paul Wouters [<A HREF="mailto:paul@xelerance.com">mailto:paul@xelerance.com</A>]<BR>
Date: mer. 6/10/2009 02:45<BR>
À: reza<BR>
Cc: users@openswan.org<BR>
Objet : Re: [Openswan Users] help with ipsec + zywall<BR>
<BR>
On Tue, 9 Jun 2009, reza wrote:<BR>
<BR>
> I can get workinf the tunnel, but periodically (randomly), the tunnel<BR>
> crashes.<BR>
><BR>
> When I verify the status of this vpn connection, I can see that the<BR>
> tunnel is established,<BR>
<BR>
Is the tunnel still established on both ends?<BR>
<BR>
> but there is no traffic. I have to down my connection, hangup the zywall<BR>
> side (bouton hangup in admin panel),<BR>
<BR>
You can try enabling dpd.<BR>
<BR>
Without logs from the end that hangs up, there is nothing much we can tell<BR>
you.<BR>
<BR>
Paul<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>