<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.6944.0">
<TITLE>need help with ipsec tunnel to iphone</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>i have created certificates and emailed myself, installed fine on iphone<BR>
<BR>
not sure which account name and password to set on the phone, i had to put in the password i used for the cert to install it<BR>
<BR>
/etc/ipsec.secrets<BR>
<BR>
: RSA /etc/ipsec.d/private/hostKey.pem "keytoloadcirt"<BR>
@username : XAUTH "password"<BR>
<BR>
/etc/ipsec.conf<BR>
<BR>
config setup<BR>
plutoopts="--perpeerlog"<BR>
nat_traversal=yes<BR>
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25/8<BR>
oe=off<BR>
protostack=netkey<BR>
<BR>
conn %default<BR>
authby=rsasig<BR>
leftrsasigkey=%cert<BR>
rightrsasigkey=%cert<BR>
keyingtries=1<BR>
keylife=20m<BR>
ikelifetime=240m<BR>
<BR>
conn iphone<BR>
auto=add<BR>
dpdaction=clear<BR>
dpdtimeout=15<BR>
dpddelay=10<BR>
authby=rsasig<BR>
pfs=no<BR>
leftcert=/etc/ipsec.d/certs/strongswanCert.pem<BR>
left=192.168.0.1<BR>
leftsubnet=0.0.0.0/0<BR>
leftxauthserver=yes<BR>
leftmodecfgclient=yes<BR>
right=%any<BR>
rightsourceip=192.168.0.2<BR>
rightcert=/etc/ipsec.d/certs/hostCert.pem<BR>
rightnexthop=%defaultroute<BR>
rightxauthserver=yes<BR>
rightmodecfgclient=yes<BR>
<BR>
output messages are below when i try to connect, have tried many different usernames all with password as "password"<BR>
<BR>
this is on my slackware smp box, i have installed same version of openswan on debian squeeze i386 and the same thing happens<BR>
<BR>
am i missing anything?????<BR>
<BR>
May 24 21:27:56 linuxserver ipsec_setup: Starting Openswan IPsec U2.6.33/K2.6.21.5-smp...<BR>
May 24 21:27:56 linuxserver ipsec_setup: Using NETKEY(XFRM) stack<BR>
May 24 21:28:01 linuxserver ipsec_setup: defaulting rightsubnet to 192.168.0.2<BR>
May 24 21:28:01 linuxserver ipsec_setup: ...Openswan IPsec started<BR>
May 24 21:28:01 linuxserver pluto: adjusting ipsec.d to /etc/ipsec.d<BR>
May 24 21:28:01 linuxserver ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d<BR>
May 24 21:28:01 linuxserver ipsec__plutorun: defaulting rightsubnet to 192.168.0.2<BR>
May 24 21:28:04 linuxserver ipsec__plutorun: 002 loading certificate from /etc/ipsec.d/certs/strongswanCert.pem<BR>
May 24 21:28:04 linuxserver ipsec__plutorun: 002 loaded host cert file '/etc/ipsec.d/certs/strongswanCert.pem' (1330 bytes)<BR>
May 24 21:28:04 linuxserver ipsec__plutorun: 002 loading certificate from /etc/ipsec.d/certs/hostCert.pem<BR>
May 24 21:28:04 linuxserver ipsec__plutorun: 002 loaded host cert file '/etc/ipsec.d/certs/hostCert.pem' (1086 bytes)<BR>
May 24 21:28:04 linuxserver ipsec__plutorun: 002 added connection description "iphone"<BR>
+ _________________________ plog<BR>
+ sed -n '5037731,$p' /var/log/secure<BR>
+ egrep -i pluto<BR>
+ case "$1" in<BR>
+ cat<BR>
May 24 21:28:01 linuxserver ipsec__plutorun: Starting Pluto subsystem...<BR>
May 24 21:28:01 linuxserver pluto[3517]: Starting Pluto (Openswan Version 2.6.33; Vendor ID XXXXXXXXXX) pid:3517<BR>
May 24 21:28:01 linuxserver pluto[3517]: LEAK_DETECTIVE support [disabled]<BR>
May 24 21:28:01 linuxserver pluto[3517]: OCF support for IKE [disabled]<BR>
May 24 21:28:01 linuxserver pluto[3517]: SAref support [disabled]: Protocol not available<BR>
May 24 21:28:01 linuxserver pluto[3517]: SAbind support [disabled]: Protocol not available<BR>
May 24 21:28:01 linuxserver pluto[3517]: NSS support [disabled]<BR>
May 24 21:28:01 linuxserver pluto[3517]: HAVE_STATSD notification support not compiled in<BR>
May 24 21:28:01 linuxserver pluto[3517]: Setting NAT-Traversal port-4500 floating to on<BR>
May 24 21:28:01 linuxserver pluto[3517]: port floating activation criteria nat_t=1/port_float=1<BR>
May 24 21:28:01 linuxserver pluto[3517]: NAT-Traversal support [enabled]<BR>
May 24 21:28:01 linuxserver pluto[3517]: using /dev/urandom as source of random entropy<BR>
May 24 21:28:02 linuxserver pluto[3517]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC_SSH: Ok (ret=0)<BR>
May 24 21:28:02 linuxserver pluto[3517]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0)<BR>
May 24 21:28:02 linuxserver pluto[3517]: ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0)<BR>
May 24 21:28:02 linuxserver pluto[3517]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)<BR>
May 24 21:28:02 linuxserver pluto[3517]: ike_alg_register_enc(): Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0)<BR>
May 24 21:28:02 linuxserver pluto[3517]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)<BR>
May 24 21:28:02 linuxserver pluto[3517]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)<BR>
May 24 21:28:02 linuxserver pluto[3517]: starting up 1 cryptographic helpers<BR>
May 24 21:28:02 linuxserver pluto[3524]: using /dev/urandom as source of random entropy<BR>
May 24 21:28:02 linuxserver pluto[3517]: started helper pid=3524 (fd:7)<BR>
May 24 21:28:02 linuxserver pluto[3517]: Using Linux 2.6 IPsec interface code on 2.6.21.5-smp (experimental code)<BR>
May 24 21:28:03 linuxserver pluto[3517]: ike_alg_register_enc(): Activating aes_ccm_8: Ok (ret=0)<BR>
May 24 21:28:03 linuxserver pluto[3517]: ike_alg_add(): ERROR: Algorithm already exists<BR>
May 24 21:28:03 linuxserver pluto[3517]: ike_alg_register_enc(): Activating aes_ccm_12: FAILED (ret=-17)<BR>
May 24 21:28:03 linuxserver pluto[3517]: ike_alg_add(): ERROR: Algorithm already exists<BR>
May 24 21:28:03 linuxserver pluto[3517]: ike_alg_register_enc(): Activating aes_ccm_16: FAILED (ret=-17)<BR>
May 24 21:28:03 linuxserver pluto[3517]: ike_alg_add(): ERROR: Algorithm already exists<BR>
May 24 21:28:03 linuxserver pluto[3517]: ike_alg_register_enc(): Activating aes_gcm_8: FAILED (ret=-17)<BR>
May 24 21:28:03 linuxserver pluto[3517]: ike_alg_add(): ERROR: Algorithm already exists<BR>
May 24 21:28:03 linuxserver pluto[3517]: ike_alg_register_enc(): Activating aes_gcm_12: FAILED (ret=-17)<BR>
May 24 21:28:03 linuxserver pluto[3517]: ike_alg_add(): ERROR: Algorithm already exists<BR>
May 24 21:28:03 linuxserver pluto[3517]: ike_alg_register_enc(): Activating aes_gcm_16: FAILED (ret=-17)<BR>
May 24 21:28:04 linuxserver pluto[3517]: Changed path to directory '/etc/ipsec.d/cacerts'<BR>
May 24 21:28:04 linuxserver pluto[3517]: loaded CA cert file 'strongswanCert.pem' (1330 bytes)<BR>
May 24 21:28:04 linuxserver pluto[3517]: Changed path to directory '/etc/ipsec.d/aacerts'<BR>
May 24 21:28:04 linuxserver pluto[3517]: Changed path to directory '/etc/ipsec.d/ocspcerts'<BR>
May 24 21:28:04 linuxserver pluto[3517]: Changing to directory '/etc/ipsec.d/crls'<BR>
May 24 21:28:04 linuxserver pluto[3517]: loaded crl file 'crl.pem' (434 bytes)<BR>
May 24 21:28:04 linuxserver pluto[3517]: loading certificate from /etc/ipsec.d/certs/strongswanCert.pem<BR>
May 24 21:28:04 linuxserver pluto[3517]: loaded host cert file '/etc/ipsec.d/certs/strongswanCert.pem' (1330 bytes)<BR>
May 24 21:28:04 linuxserver pluto[3517]: loading certificate from /etc/ipsec.d/certs/hostCert.pem<BR>
May 24 21:28:04 linuxserver pluto[3517]: loaded host cert file '/etc/ipsec.d/certs/hostCert.pem' (1086 bytes)<BR>
May 24 21:28:04 linuxserver pluto[3517]: added connection description "iphone"<BR>
May 24 21:28:04 linuxserver pluto[3517]: listening for IKE messages<BR>
May 24 21:28:04 linuxserver pluto[3517]: adding interface eth0/eth0 192.168.0.2:500<BR>
May 24 21:28:04 linuxserver pluto[3517]: adding interface eth0/eth0 192.168.0.2:4500<BR>
May 24 21:28:04 linuxserver pluto[3517]: adding interface lo/lo 127.0.0.1:500<BR>
May 24 21:28:04 linuxserver pluto[3517]: adding interface lo/lo 127.0.0.1:4500<BR>
May 24 21:28:04 linuxserver pluto[3517]: adding interface lo/lo ::1:500<BR>
May 24 21:28:04 linuxserver pluto[3517]: loading secrets from "/etc/ipsec.secrets"<BR>
May 24 21:28:04 linuxserver pluto[3517]: loaded private key file '/etc/ipsec.d/private/hostKey.pem' (963 bytes)<BR>
May 24 21:28:04 linuxserver pluto[3517]: loaded private key for keyid: PPK_RSA:XXXXXXXXX<BR>
May 24 21:28:48 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [RFC 3947] method set to=109<BR>
May 24 21:28:48 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike] method set to=110<BR>
May 24 21:28:48 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]<BR>
May 24 21:28:48 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]<BR>
May 24 21:28:48 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]<BR>
May 24 21:28:48 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]<BR>
May 24 21:28:48 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [9909b64eed937c6573de52ace952fa6b]<BR>
May 24 21:28:48 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 110<BR>
May 24 21:28:48 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 110<BR>
May 24 21:28:48 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 110<BR>
May 24 21:28:48 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [XAUTH]<BR>
May 24 21:28:48 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [Cisco-Unity]<BR>
May 24 21:28:48 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [Dead Peer Detection]<BR>
May 24 21:28:48 linuxserver pluto[3517]: packet from 203.20.35.28:33009: initial Main Mode message received on 192.168.0.2:500 but no connection has been authorized with policy=RSASIG<BR>
May 24 21:28:52 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [RFC 3947] method set to=109<BR>
May 24 21:28:52 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike] method set to=110<BR>
May 24 21:28:52 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]<BR>
May 24 21:28:52 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]<BR>
May 24 21:28:52 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]<BR>
May 24 21:28:52 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]<BR>
May 24 21:28:52 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [9909b64eed937c6573de52ace952fa6b]<BR>
May 24 21:28:52 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 110<BR>
May 24 21:28:52 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 110<BR>
May 24 21:28:52 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 110<BR>
May 24 21:28:52 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [XAUTH]<BR>
May 24 21:28:52 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [Cisco-Unity]<BR>
May 24 21:28:52 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [Dead Peer Detection]<BR>
May 24 21:28:52 linuxserver pluto[3517]: packet from 203.20.35.28:33009: initial Main Mode message received on 192.168.0.2:500 but no connection has been authorized with policy=RSASIG<BR>
May 24 21:28:58 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [RFC 3947] method set to=109<BR>
May 24 21:28:58 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike] method set to=110<BR>
May 24 21:28:58 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]<BR>
May 24 21:28:58 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]<BR>
May 24 21:28:58 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]<BR>
May 24 21:28:58 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]<BR>
May 24 21:28:58 linuxserver pluto[3517]: packet from 203.20.35.28:33009: ignoring unknown Vendor ID payload [9909b64eed937c6573de52ace952fa6b]<BR>
May 24 21:28:58 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 110<BR>
May 24 21:28:58 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 110<BR>
May 24 21:28:58 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 110<BR>
May 24 21:28:58 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [XAUTH]<BR>
May 24 21:28:58 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [Cisco-Unity]<BR>
May 24 21:28:58 linuxserver pluto[3517]: packet from 203.20.35.28:33009: received Vendor ID payload [Dead Peer Detection]<BR>
May 24 21:28:58 linuxserver pluto[3517]: packet from 203.20.35.28:33009: initial Main Mode message received on 192.168.0.2:500 but no connection has been authorized with policy=RSASIG<BR>
+ _________________________ date<BR>
+ date<BR>
Tue May 24 21:30:13 EST 2011<BR>
</FONT>
</P>
</BODY>
</HTML>