<div>Newbie looking for any sort of help- it seems as though I can't even get the plane off the ground at the moment. The issue might be with the phase2 in the .conf, but ipsec verify is showing everything is clear. All of the necessary files and logs are below, with the exception of the full barf. Anything stick out like a sore thumb?</div>
<div><br></div><div>-James</div><div><br></div><div>ipsec.conf:</div><div><br></div><div><div>config setup</div><div> nat_traversal=yes</div><div> # exclude networks used on server side by adding %v4:!a.b.c.0/24</div>
<div> virtual_private=%v4:<CLIENT ED>/24,%v4:<a href="http://10.5.5.5/32">10.5.5.5/32</a></div><div> # OE is now off by default. Uncomment and change to on, to enable.</div><div> oe=off</div><div>
# which IPsec stack to use. netkey,klips,mast,auto or none</div><div> protostack=netkey</div><div><br></div><div>conn ec2-to-checkpoint</div><div> connaddrfamily=ipv4</div><div> type=tunnel</div>
<div> authby=secret</div><div> ike=3des-md5;modp1024</div><div> Ikelifetime=86400s</div><div> phase2=esp</div><div> Phase2alg=3des-md5-modp1024</div><div> lifetime=28800s</div><div>
forceencaps=yes</div><div> pfs=no</div><div> left=<EC2 PRIVATE IP></div><div> leftid=<EC2 ELASTIC IP></div><div> leftnexthop=%defaultroute</div><div> leftsubnet=<a href="http://10.5.5.5/32">10.5.5.5/32</a></div>
<div> leftsourceip=10.5.5.5</div><div> right=<CLIENT GATEWAY></div><div> rightsubnet=<CLIENT ED></div><div> auto=add</div></div><div><br></div><div>ipsec.secrets:</div><div><div><EC2 ELASTIC IP> <CLIENT GATEWAY>: PSK "HeyLookImAKey"</div>
</div><div><br></div><div>var/log/messages:</div><div><div>Sep 7 20:18:05 kernel: NET: Unregistered protocol family 15</div><div>Sep 7 20:18:05 kernel: NET: Registered protocol family 15</div><div>Sep 7 20:18:06 kernel: Initializing XFRM netlink socket</div>
<div>Sep 7 20:18:06 kernel: padlock: VIA PadLock not detected.</div><div>Sep 7 20:18:06 kernel: padlock: VIA PadLock Hash Engine not detected.</div><div>Sep 7 20:18:06 kernel: Intel AES-NI instructions are not detected.</div>
<div>Sep 7 20:18:06 kernel: padlock: VIA PadLock not detected.</div><div>Sep 7 20:18:06 pluto: adjusting ipsec.d to /etc/ipsec.d</div></div><div><br></div><div>var/log/syslog:</div><div><div>Sep 7 20:18:05 kernel: NET: Unregistered protocol family 15</div>
<div>Sep 7 20:18:05 kernel: NET: Registered protocol family 15</div><div>Sep 7 20:18:05 ipsec_setup: Starting Openswan IPsec U2.6.23/K2.6.32-317-ec2...</div><div>Sep 7 20:18:05 ipsec_setup: Using NETKEY(XFRM) stack</div>
<div>Sep 7 20:18:06 kernel: Initializing XFRM netlink socket</div><div>Sep 7 20:18:06 kernel: padlock: VIA PadLock not detected.</div><div>Sep 7 20:18:06 kernel: padlock: VIA PadLock Hash Engine not detected.</div><div>
Sep 7 20:18:06 kernel: Intel AES-NI instructions are not detected.</div><div>Sep 7 20:18:06 kernel: padlock: VIA PadLock not detected.</div><div>Sep 7 20:18:06 ipsec_setup: multiple ip addresses, using <EC2 PRIVATE> on eth0</div>
<div>Sep 7 20:18:06 ipsec_setup: ...Openswan IPsec started</div><div>Sep 7 20:18:06 ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d</div><div>Sep 7 20:18:06 pluto: adjusting ipsec.d to /etc/ipsec.d</div><div>Sep 7 20:18:06 ipsec__plutorun: 034 esp string error: Non alphanum or valid separator found in auth string, \</div>
<div>just after "3des-md5" (old_state=ST_AA)</div><div>Sep 7 20:18:06 ipsec__plutorun: 003 NAT-Traversal: Trying new style NAT-T</div><div>Sep 7 20:18:06 ipsec__plutorun: 003 NAT-Traversal: ESPINUDP(1) setup failed for new style NAT-T family IPv4 \</div>
<div>(errno=19)</div><div>Sep 7 20:18:06 ipsec__plutorun: 003 NAT-Traversal: Trying old style NAT-T</div></div><div><br></div><div><br></div><div>var/log/auth.log:</div><div>...</div><div>pluto[19246]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_\names</div>
<div>pluto[19246]: ike_alg_register_enc(): Activating <NULL>: Ok (ret=0)</div><div>pluto[19246]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_\names</div><div>pluto[19246]: ike_alg_add(): ERROR: Algorithm already exists</div>
<div>pluto[19246]: ike_alg_register_enc(): Activating <NULL>: FAILED (ret=-17)</div><div>pluto[19246]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_\names</div><div>pluto[19246]: ike_alg_add(): ERROR: Algorithm already exists</div>
<div>pluto[19246]: ike_alg_register_enc(): Activating <NULL>: FAILED (ret=-17)</div><div>pluto[19246]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_\names</div><div>pluto[19246]: ike_alg_add(): ERROR: Algorithm already exists</div>
<div>pluto[19246]: ike_alg_register_enc(): Activating <NULL>: FAILED (ret=-17)</div><div>pluto[19246]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_\names</div><div>pluto[19246]: ike_alg_add(): ERROR: Algorithm already exists</div>
<div>pluto[19246]: ike_alg_register_enc(): Activating <NULL>: FAILED (ret=-17)</div><div>pluto[19246]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_\names</div><div>pluto[19246]: ike_alg_add(): ERROR: Algorithm already exists</div>
<div>pluto[19246]: ike_alg_register_enc(): Activating <NULL>: FAILED (ret=-17)</div><div>pluto[19246]: Changed path to directory '/etc/ipsec.d/cacerts'</div><div>pluto[19246]: Changed path to directory '/etc/ipsec.d/aacerts'</div>
<div>pluto[19246]: Changed path to directory '/etc/ipsec.d/ocspcerts'</div><div>pluto[19246]: Changing to directory '/etc/ipsec.d/crls'</div><div><div>pluto[19246]: Warning: empty directory</div><div>pluto[19246]: added connection description "ec2-to-checkpoint"</div>
<div>pluto[19246]: listening for IKE messages</div><div>pluto[19246]: NAT-Traversal: Trying new style NAT-T</div><div>pluto[19246]: NAT-Traversal: ESPINUDP(1) setup failed for new style NAT-T family IPv4 (errno=\19)</div>
<div>pluto[19246]: NAT-Traversal: Trying old style NAT-T</div><div>pluto[19246]: adding interface eth0:1/eth0:1 <a href="http://10.5.5.5:500">10.5.5.5:500</a></div><div>pluto[19246]: adding interface eth0:1/eth0:1 <a href="http://10.5.5.5:4500">10.5.5.5:4500</a></div>
<div>pluto[19246]: adding interface eth0/eth0 XXX.XXX.XXX.XXX:500</div><div>pluto[19246]: adding interface eth0/eth0 XXX.XXX.XXX.XXX:4500</div><div>pluto[19246]: adding interface lo/lo XXX.XXX.XXX.XXX:500</div><div>pluto[19246]: adding interface lo/lo XXX.XXX.XXX.XXX:4500</div>
<div>pluto[19246]: adding interface lo/lo ::1:500</div><div>pluto[19246]: loading secrets from "/etc/ipsec.secrets"</div><div>pluto[19246]: loaded private key file '/etc/ipsec.d/private/ip-XX-XX-XXX-XXXKey.pem' (1675 \</div>
<div>bytes)</div><div>pluto[19246]: loaded private key for keyid: PPK_RSA:<XXXXXXXX></div></div>