<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt; ">Hi,</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt; "><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt; ">I'm trying to configure a pure rsa+xauth ipec vpn with openswan and iphone, but during negociation that message appear in log:</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt; "><br></div><div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:39 hefesto pluto[14933]: "iphone"[1] 172.23.254.126 #1: responding to Main Mode from unknown peer 172.23.254.126</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13
14:55:39 hefesto pluto[14933]: "iphone"[1] 172.23.254.126 #1: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:39 hefesto pluto[14933]: "iphone"[1] 172.23.254.126 #1: STATE_MAIN_R1: sent MR1, expecting MI2</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:40 hefesto pluto[14933]: "iphone"[1] 172.23.254.126 #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): no NAT detected</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:40 hefesto pluto[14933]: "iphone"[1] 172.23.254.126 #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:40 hefesto pluto[14933]: "iphone"[1]
172.23.254.126 #1: STATE_MAIN_R2: sent MR2, expecting MI3</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:41 hefesto pluto[14933]: "iphone"[1] 172.23.254.126 #1: ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:41 hefesto pluto[14933]: "iphone"[1] 172.23.254.126 #1: Main mode peer ID is ID_DER_ASN1_DN: 'CN=host'</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:41 hefesto pluto[14933]: "iphone"[1] 172.23.254.126 #1: no crl from issuer "CN=cacert" found (strict=no)</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:41 hefesto pluto[14933]: "iphone"[1] 172.23.254.126 #1: switched from "iphone" to "iphone"</font></div><div><font
class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:41 hefesto pluto[14933]: "iphone"[2] 172.23.254.126 #1: deleting connection "iphone" instance with peer 172.23.254.126 {isakmp=#0/ipsec=#0}</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:41 hefesto pluto[14933]: "iphone"[2] 172.23.254.126 #1: I am sending my cert</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:41 hefesto pluto[14933]: "iphone"[2] 172.23.254.126 #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:41 hefesto pluto[14933]: "iphone"[2] 172.23.254.126 #1: new NAT mapping for #1, was 172.23.254.126:500, now 172.23.254.126:4500</font></div><div><font class="Apple-style-span" face="'times new roman', 'new
york', times, serif">Sep 13 14:55:41 hefesto pluto[14933]: "iphone"[2] 172.23.254.126 #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=aes_256 prf=oakley_sha group=modp1536}</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:41 hefesto pluto[14933]: "iphone"[2] 172.23.254.126 #1: XAUTH: Sending XAUTH Login/Password Request</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:41 hefesto pluto[14933]: "iphone"[2] 172.23.254.126 #1: XAUTH: Sending Username/Password request (XAUTH_R0)</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:44 hefesto pluto[14933]: "iphone"[2] 172.23.254.126 #1: discarding duplicate packet; already STATE_XAUTH_R0</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13
14:55:47 hefesto pluto[14933]: "iphone"[2] 172.23.254.126 #1: discarding duplicate packet; already STATE_XAUTH_R0</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">Sep 13 14:55:50 hefesto pluto[14933]: "iphone"[2] 172.23.254.126 #1: discarding duplicate packet; already STATE_XAUTH_R0</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif"><br></font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif"><br></font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif">My ipsec.conf file:</font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif"><br></font></div><div><font class="Apple-style-span" face="'times new roman', 'new york', times, serif"><div>version<span class="Apple-tab-span" style="white-space:pre"> </span>2.0<span
class="Apple-tab-span" style="white-space:pre"> </span># conforms to second version of ipsec.conf specification</div><div><br></div><div>config setup</div><div> plutoopts="--perpeerlog"</div><div> nat_traversal=yes</div><div> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25/8</div><div> oe=off</div><div> protostack=netkey</div><div><br></div><div>conn %default</div><div> authby=rsasig</div><div> leftrsasigkey=%cert</div><div> rightrsasigkey=%cert</div><div> keyingtries=1</div><div> keylife=20m</div><div> ikelifetime=240m</div><div><br></div><div>conn iphone</div><div> auto=add</div><div>
authby=rsasig</div><div> left=172.23.253.2</div><div> right=%any</div><div> leftxauthserver=yes</div><div> leftca=cacert</div><div> leftcert=hefesto</div><div> leftrsasigkey=%cert</div><div><br></div><div>ipsec.secrets</div><div><div>: RSA hefesto</div><div>@host : XAUTH "redhat"</div><div><br></div><div>passwd</div><div>host:lxMEQMBDRiWN6:*<br></div></div><div><br></div><div>RHEL6</div><div>openswan-2.6.32-4.el6_1.1.x86_64<br></div><div><br></div><div>Tks for your help.</div><div><br></div><div>Best regards.</div></font></div></div></div></body></html>