<DIV>hi~ all</DIV>
<DIV>I have do a host-to-host tunnel between two linux box .<BR>the confiure file is like this:</DIV>
<DIV><BR># basic configuration<BR>config setup<BR> interfaces=%defaultroute<BR> klipsdebug=none<BR> plutodebug=none<BR>conn tunnelipsec<BR> type=tunnel<BR> authby=secret<BR> left=192.168.1.2<BR> #leftsubnet=10.69.1.0/24<BR> right=192.168.1.172<BR> #rightsubnet=10.7.3.0/24<BR> #esp=3des-md5<BR> #keyexchange=ike<BR> #pfs=no<BR> auto=start</DIV>
<DIV>after IPsec start,the log show this:<BR>Mar 12 02:32:18 pluto[884]: Starting Pluto (Openswan Version 2.6.22; Vendor ID <A href="mailto:OElj@]rTMBuM">OElj@]rTMBuM</A>) pid:884<BR>Mar 12 02:32:18 pluto[884]: Setting NAT-Traversal port-4500 floating to off<BR>Mar 12 02:32:18 pluto[884]: port floating activation criteria nat_t=0/port_float=1<BR>Mar 12 02:32:18 pluto[884]: including NAT-Traversal patch (Version 0.6c) [disabled]<BR>Mar 12 02:32:18 pluto[884]: using /dev/urandom as source of random entropy<BR>Mar 12 02:32:18 pluto[884]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC_SSH: Ok (ret=0)<BR>Mar 12 02:32:18 pluto[884]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0)<BR>Mar 12 02:32:18 pluto[884]: ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0)<BR>Mar 12 02:32:18 pluto[884]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)<BR>Mar 12 02:32:18 pluto[884]: ike_alg_register_enc(): Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0)<BR>Mar 12 02:32:18 pluto[884]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)<BR>Mar 12 02:32:18 pluto[884]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)<BR>Mar 12 02:32:18 pluto[884]: starting up 1 cryptographic helpers<BR>Mar 12 02:32:18 pluto[894]: using /dev/urandom as source of random entropy<BR>Mar 12 02:32:18 pluto[884]: started helper pid=894 (fd:6)<BR>Mar 12 02:32:18 pluto[884]: Using Linux 2.6 IPsec interface code on 2.6.20.lzrt.v1.1 (experimental code)<BR>Mar 12 02:32:19 pluto[884]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names <BR>Mar 12 02:32:19 pluto[884]: ike_alg_register_enc(): Activating <NULL>: Ok (ret=0)<BR>Mar 12 02:32:19 pluto[884]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names <BR>Mar 12 02:32:19 pluto[884]: ike_alg_add(): ERROR: Algorithm already exists<BR>Mar 12 02:32:19 pluto[884]: ike_alg_register_enc(): Activating <NULL>: FAILED (ret=-17)<BR>Mar 12 02:32:19 pluto[884]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names <BR>Mar 12 02:32:19 pluto[884]: ike_alg_add(): ERROR: Algorithm already exists<BR>Mar 12 02:32:19 pluto[884]: ike_alg_register_enc(): Activating <NULL>: FAILED (ret=-17)<BR>Mar 12 02:32:19 pluto[884]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names <BR>Mar 12 02:32:19 pluto[884]: ike_alg_add(): ERROR: Algorithm already exists<BR>Mar 12 02:32:19 pluto[884]: ike_alg_register_enc(): Activating <NULL>: FAILED (ret=-17)<BR>Mar 12 02:32:19 pluto[884]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names <BR>Mar 12 02:32:19 pluto[884]: ike_alg_add(): ERROR: Algorithm already exists<BR>Mar 12 02:32:19 pluto[884]: ike_alg_register_enc(): Activating <NULL>: FAILED (ret=-17)<BR>Mar 12 02:32:19 pluto[884]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names <BR>Mar 12 02:32:19 pluto[884]: ike_alg_add(): ERROR: Algorithm already exists<BR>Mar 12 02:32:19 pluto[884]: ike_alg_register_enc(): Activating <NULL>: FAILED (ret=-17)<BR>Mar 12 02:32:19 pluto[884]: myid malformed: empty string ""<BR>Mar 12 02:32:19 pluto[884]: Changed path to directory '/etc/ipsec.d/cacerts'<BR>Mar 12 02:32:19 pluto[884]: Changed path to directory '/etc/ipsec.d/aacerts'<BR>Mar 12 02:32:19 pluto[884]: Changed path to directory '/etc/ipsec.d/ocspcerts'<BR>Mar 12 02:32:19 pluto[884]: Changing to directory '/etc/ipsec.d/crls'<BR>Mar 12 02:32:19 pluto[884]: Warning: empty directory<BR>Mar 12 02:32:19 pluto[884]: added connection description "tunnelipsec"<BR>Mar 12 02:32:19 pluto[884]: listening for IKE messages<BR>Mar 12 02:32:19 pluto[884]: adding interface eth0/eth0 192.168.1.2:500<BR>Mar 12 02:32:19 pluto[884]: adding interface lo/lo 127.0.0.1:500<BR>Mar 12 02:32:19 pluto[884]: loading secrets from "/etc/ipsec.secrets"<BR>Mar 12 02:32:20 pluto[884]: "tunnelipsec" #1: initiating Main Mode<BR>Mar 12 02:32:20 pluto[884]: "tunnelipsec" #1: ignoring unknown Vendor ID payload [4f456a7d637357765a5c7b63]<BR>Mar 12 02:32:20 pluto[884]: "tunnelipsec" #1: received Vendor ID payload [Dead Peer Detection]<BR>Mar 12 02:32:21 pluto[884]: "tunnelipsec" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2<BR>Mar 12 02:32:21 pluto[884]: "tunnelipsec" #1: STATE_MAIN_I2: sent MI2, expecting MR2<BR>Mar 12 02:32:21 pluto[884]: "tunnelipsec" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3<BR>Mar 12 02:32:21 pluto[884]: "tunnelipsec" #1: STATE_MAIN_I3: sent MI3, expecting MR3<BR>Mar 12 02:32:21 pluto[884]: "tunnelipsec" #1: received Vendor ID payload [CAN-IKEv2]<BR>Mar 12 02:32:21 pluto[884]: "tunnelipsec" #1: Main mode peer ID is ID_IPV4_ADDR: '192.168.1.172'<BR>Mar 12 02:32:21 pluto[884]: "tunnelipsec" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4<BR>Mar 12 02:32:21 pluto[884]: "tunnelipsec" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp2048}<BR>Mar 12 02:32:21 pluto[884]: "tunnelipsec" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW {using isakmp#1 msgid:b4d41079 proposal=defaults pfsgroup=OAKLEY_GROUP_MODP2048}<BR>Mar 12 02:32:21 pluto[884]: "tunnelipsec" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2<BR>Mar 12 02:32:21 pluto[884]: "tunnelipsec" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xa8856576 <0xe9010903 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}</DIV>
<DIV>=======here,the IPsec SA established</DIV>
<DIV>=======but the tunnel drop immediately</DIV>
<DIV>/ $ Mar 12 02:32:31 pluto[884]: packet from 192.168.1.172:500: ignoring unknown Vendor ID payload [4f456a7d637357765a5c7b63]<BR>Mar 12 02:32:31 pluto[884]: packet from 192.168.1.172:500: received Vendor ID payload [Dead Peer Detection]<BR>Mar 12 02:32:31 pluto[884]: "tunnelipsec" #3: responding to Main Mode<BR>Mar 12 02:32:31 pluto[884]: "tunnelipsec" #3: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<BR>Mar 12 02:32:31 pluto[884]: "tunnelipsec" #3: STATE_MAIN_R1: sent MR1, expecting MI2<BR>piMar 12 02:32:32 pluto[884]: "tunnelipsec" #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<BR>Mar 12 02:32:32 pluto[884]: "tunnelipsec" #3: STATE_MAIN_R2: sent MR2, expecting MI3<BR>nMar 12 02:32:32 pluto[884]: "tunnelipsec" #3: Main mode peer ID is ID_IPV4_ADDR: '192.168.1.172'<BR>Mar 12 02:32:32 pluto[884]: "tunnelipsec" #3: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<BR>Mar 12 02:32:32 pluto[884]: "tunnelipsec" #3: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp2048}<BR> <BR>/ $ Mar 12 02:32:40 pluto[884]: "tunnelipsec" #3: retransmitting in response to duplicate packet; already STATE_MAIN_R3<BR>Mar 12 02:32:57 pluto[884]: "tunnelipsec" #3: retransmitting in response to duplicate packet; already STATE_MAIN_R3<BR>Mar 12 02:33:31 pluto[884]: packet from 192.168.1.172:500: ignoring unknown Vendor ID payload [4f456a7d637357765a5c7b63]<BR>Mar 12 02:33:31 pluto[884]: packet from 192.168.1.172:500: received Vendor ID payload [Dead Peer Detection]<BR>Mar 12 02:33:31 pluto[884]: "tunnelipsec" #4: responding to Main Mode<BR>Mar 12 02:33:31 pluto[884]: "tunnelipsec" #4: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<BR>Mar 12 02:33:31 pluto[884]: "tunnelipsec" #4: STATE_MAIN_R1: sent MR1, expecting MI2<BR>Mar 12 02:33:31 pluto[884]: "tunnelipsec" #4: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<BR>Mar 12 02:33:31 pluto[884]: "tunnelipsec" #4: STATE_MAIN_R2: sent MR2, expecting MI3<BR>Mar 12 02:33:31 pluto[884]: "tunnelipsec" #4: Main mode peer ID is ID_IPV4_ADDR: '192.168.1.172'<BR>Mar 12 02:33:31 pluto[884]: "tunnelipsec" #4: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<BR>Mar 12 02:33:31 pluto[884]: "tunnelipsec" #4: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp2048}<BR>Mar 12 02:33:40 pluto[884]: "tunnelipsec" #4: retransmitting in response to duplicate packet; already STATE_MAIN_R3<BR>Mar 12 02:33:57 pluto[884]: "tunnelipsec" #4: retransmitting in response to duplicate packet; already STATE_MAIN_R3<BR>Mar 12 02:34:30 pluto[884]: packet from 192.168.1.172:500: ignoring unknown Vendor ID payload [4f456a7d637357765a5c7b63]<BR>Mar 12 02:34:30 pluto[884]: packet from 192.168.1.172:500: received Vendor ID payload [Dead Peer Detection]<BR>Mar 12 02:34:30 pluto[884]: "tunnelipsec" #5: responding to Main Mode<BR>Mar 12 02:34:30 pluto[884]: "tunnelipsec" #5: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<BR>Mar 12 02:34:30 pluto[884]: "tunnelipsec" #5: STATE_MAIN_R1: sent MR1, expecting MI2<BR>Mar 12 02:34:31 pluto[884]: "tunnelipsec" #5: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<BR>Mar 12 02:34:31 pluto[884]: "tunnelipsec" #5: STATE_MAIN_R2: sent MR2, expecting MI3<BR>Mar 12 02:34:31 pluto[884]: "tunnelipsec" #5: Main mode peer ID is ID_IPV4_ADDR: '192.168.1.172'<BR>Mar 12 02:34:31 pluto[884]: "tunnelipsec" #5: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<BR>Mar 12 02:34:31 pluto[884]: "tunnelipsec" #5: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp2048}<BR>Mar 12 02:34:39 pluto[884]: "tunnelipsec" #5: retransmitting in response to duplicate packet; already STATE_MAIN_R3<BR>Mar 12 02:34:56 pluto[884]: "tunnelipsec" #5: retransmitting in response to duplicate packet; already STATE_MAIN_R3</DIV>
<DIV>what happen to this?</DIV><br><br><span title="neteasefooter"/><hr/>
<a href="http://www.yeah.net/?from=footer">没有广告的终身免费邮箱,www.yeah.net</a>
</span>