<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi everyone,<br>
<br>
I'm trying to setup a VPN connection between our Centos server and a
Cisco 3000 Concentrator.<br>
They gave me the following informations:<br>
<table style="border-collapse: collapse;width:618pt" border="0"
cellpadding="0" cellspacing="0" width="823">
<colgroup><col
style="mso-width-source:userset;mso-width-alt:8557;width:176pt"
width="234"> <col
style="mso-width-source:userset;mso-width-alt:21540;width:442pt"
width="589"> </colgroup><tbody>
<tr style="height:12.75pt" height="17">
<td class="xl73" style="height:12.75pt;width:176pt"
height="17" width="234">IKE (ISAKMP)</td>
<td class="xl65" style="width:442pt" width="589"><br>
</td>
</tr>
<tr style="mso-height-source:userset;height:5.1pt" height="6">
<td class="xl66" style="height:5.1pt;border-top:none"
height="6"> </td>
<td class="xl65"><br>
</td>
</tr>
<tr style="height:12.75pt" height="17">
<td class="xl70" style="height:12.75pt" height="17">Key
Negotiation Encryption Algorithm</td>
<td class="xl67" style="border-left:none">AES-256</td>
</tr>
<tr style="height:12.75pt" height="17">
<td class="xl72" style="height:12.75pt;border-top:none"
height="17">Hashing Algorithm</td>
<td class="xl68" style="border-top:none;border-left:none">SHA/HMAC-160</td>
</tr>
<tr style="height:12.75pt" height="17">
<td class="xl74" style="height:12.75pt;border-top:none"
height="17">Diffie-Hellman group</td>
<td class="xl75" style="border-top:none;border-left:none">Group
2</td>
</tr>
<tr style="height:12.75pt" height="17">
<td class="xl74" style="height:12.75pt" height="17">Negotiation
Mode</td>
<td class="xl75" style="border-left:none">Main</td>
</tr>
<tr style="height:13.5pt" height="18">
<td class="xl71" style="height:13.5pt" height="18">Lifetime
Measurement sec</td>
<td class="xl69" style="border-left:none">86400</td>
</tr>
<tr style="height:12.75pt" height="17">
<td style="height:12.75pt" height="17"><br>
</td>
<td class="xl65"><br>
</td>
</tr>
<tr style="height:13.5pt" height="18">
<td style="height:13.5pt" height="18"><br>
</td>
<td class="xl65"><br>
</td>
</tr>
<tr style="height:12.75pt" height="17">
<td class="xl73" style="height:12.75pt" height="17">IPSec</td>
<td class="xl65"><br>
</td>
</tr>
<tr style="mso-height-source:userset;height:5.1pt" height="6">
<td class="xl66" style="height:5.1pt;border-top:none"
height="6"> </td>
<td class="xl65"><br>
</td>
</tr>
<tr style="height:12.75pt" height="17">
<td class="xl70" style="height:12.75pt" height="17">Transform</td>
<td class="xl67" style="border-left:none">Encryption + Data
Integrity - ESP</td>
</tr>
<tr style="height:12.75pt" height="17">
<td class="xl72" style="height:12.75pt;border-top:none"
height="17">Encryption Algorithm</td>
<td class="xl68" style="border-top:none;border-left:none">AES-256</td>
</tr>
<tr style="height:12.75pt" height="17">
<td class="xl72" style="height:12.75pt;border-top:none"
height="17">Data integrity Hashing Algorithm</td>
<td class="xl68" style="border-top:none;border-left:none">SHA/HMAC-160</td>
</tr>
<tr style="height:12.75pt" height="17">
<td class="xl72" style="height:12.75pt;border-top:none"
height="17">Perfect Forward Secrecy</td>
<td class="xl68" style="border-top:none;border-left:none">Disabled</td>
</tr>
<tr style="height:12.75pt" height="17">
<td class="xl72" style="height:12.75pt;border-top:none"
height="17">Encapsulation Mode</td>
<td class="xl68" style="border-top:none;border-left:none">Tunnel</td>
</tr>
<tr style="height:12.75pt" height="17">
<td class="xl72" style="height:12.75pt;border-top:none"
height="17">Lifetime Measurement sec</td>
<td class="xl68" style="border-top:none;border-left:none">28800</td>
</tr>
</tbody>
</table>
<br>
So I setup my ipsec.conf in the following way:<br>
<br>
# basic configuration<br>
config setup<br>
# Debug-logging controls: "none" for (almost) none, "all"
for lots.<br>
# klipsdebug=none<br>
# plutodebug="control parsing"<br>
# For Red Hat Enterprise Linux and Fedora, leave
protostack=netkey<br>
protostack=netkey<br>
nat_traversal=no<br>
virtual_private=<br>
oe=off<br>
# Enable this if you see "failed to find any available
worker"<br>
# nhelpers=0<br>
<br>
#You may put your configuration (.conf) file in the "/etc/ipsec.d/"
and uncomment this.<br>
#include /etc/ipsec.d/*.conf<br>
<br>
conn otwovpn<br>
type=tunnel<br>
left=78.47.14.195<br>
right=160.218.24.2<br>
ike=aes256-sha1;modp1024<br>
phase2alg=aes256-sha1;modp1024<br>
ikelifetime=24h<br>
pfs=no<br>
auto=start<br>
authby=secret<br>
<br>
I added the preshared key into the /etc/insec.d/o2vpn.conf<br>
The iptables looks the following way:<br>
iptables --list<br>
Chain INPUT (policy ACCEPT)<br>
target prot opt source destination<br>
ACCEPT ah -- anywhere anywhere<br>
ACCEPT esp -- anywhere anywhere<br>
ACCEPT udp -- anywhere anywhere udp
dpt:ipsec-nat-t<br>
ACCEPT udp -- anywhere anywhere udp
dpt:isakmp<br>
<br>
Chain FORWARD (policy ACCEPT)<br>
target prot opt source destination<br>
<br>
Chain OUTPUT (policy ACCEPT)<br>
target prot opt source destination<br>
ACCEPT ah -- anywhere anywhere<br>
ACCEPT esp -- anywhere anywhere<br>
ACCEPT udp -- anywhere anywhere udp
dpt:ipsec-nat-t<br>
ACCEPT udp -- anywhere anywhere udp
dpt:isakmp<br>
<br>
But when I start up the ipsec service no tunnel it's getting made.<br>
Starting Pluto subsystem...<br>
Aug 8 16:30:54 www pluto[1072]: nss directory plutomain:
/etc/ipsec.d<br>
Aug 8 16:30:54 www pluto[1072]: NSS Initialized<br>
Aug 8 16:30:54 www pluto[1072]: Non-fips mode set in
/proc/sys/crypto/fips_enabled<br>
Aug 8 16:30:54 www pluto[1072]: Starting Pluto (Openswan Version
2.6.32; Vendor ID OEhyLdACecfa) pid:1072<br>
Aug 8 16:30:54 www pluto[1072]: Non-fips mode set in
/proc/sys/crypto/fips_enabled<br>
Aug 8 16:30:54 www pluto[1072]: LEAK_DETECTIVE support [disabled]<br>
Aug 8 16:30:54 www pluto[1072]: OCF support for IKE [disabled]<br>
Aug 8 16:30:54 www pluto[1072]: SAref support [disabled]: Protocol
not available<br>
Aug 8 16:30:54 www pluto[1072]: SAbind support [disabled]: Protocol
not available<br>
Aug 8 16:30:54 www pluto[1072]: NSS support [enabled]<br>
Aug 8 16:30:54 www pluto[1072]: HAVE_STATSD notification support
not compiled in<br>
Aug 8 16:30:54 www pluto[1072]: Setting NAT-Traversal port-4500
floating to off<br>
Aug 8 16:30:54 www pluto[1072]: port floating activation
criteria nat_t=0/port_float=1<br>
Aug 8 16:30:54 www pluto[1072]: NAT-Traversal support
[disabled]<br>
Aug 8 16:30:54 www pluto[1072]: 1 bad entries in virtual_private -
none loaded<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_register_enc(): Activating
OAKLEY_TWOFISH_CBC_SSH: Ok (ret=0)<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_register_enc(): Activating
OAKLEY_TWOFISH_CBC: Ok (ret=0)<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_register_enc(): Activating
OAKLEY_SERPENT_CBC: Ok (ret=0)<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_register_enc(): Activating
OAKLEY_AES_CBC: Ok (ret=0)<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_register_enc(): Activating
OAKLEY_BLOWFISH_CBC: Ok (ret=0)<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_register_hash(): Activating
OAKLEY_SHA2_512: Ok (ret=0)<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_register_hash(): Activating
OAKLEY_SHA2_256: Ok (ret=0)<br>
Aug 8 16:30:54 www pluto[1072]: starting up 1 cryptographic helpers<br>
Aug 8 16:30:54 www pluto[1072]: started helper (thread)
pid=139998973691648 (fd:10)<br>
Aug 8 16:30:54 www pluto[1072]: Using Linux 2.6 IPsec interface
code on 2.6.32-220.7.1.el6.x86_64 (experimental code)<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_register_enc(): Activating
aes_ccm_8: Ok (ret=0)<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_add(): ERROR: Algorithm
already exists<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_register_enc(): Activating
aes_ccm_12: FAILED (ret=-17)<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_add(): ERROR: Algorithm
already exists<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_register_enc(): Activating
aes_ccm_16: FAILED (ret=-17)<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_add(): ERROR: Algorithm
already exists<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_register_enc(): Activating
aes_gcm_8: FAILED (ret=-17)<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_add(): ERROR: Algorithm
already exists<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_register_enc(): Activating
aes_gcm_12: FAILED (ret=-17)<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_add(): ERROR: Algorithm
already exists<br>
Aug 8 16:30:54 www pluto[1072]: ike_alg_register_enc(): Activating
aes_gcm_16: FAILED (ret=-17)<br>
Aug 8 16:30:54 www pluto[1072]: Could not change to directory
'/etc/ipsec.d/cacerts': /<br>
Aug 8 16:30:54 www pluto[1072]: Could not change to directory
'/etc/ipsec.d/aacerts': /<br>
Aug 8 16:30:54 www pluto[1072]: Could not change to directory
'/etc/ipsec.d/ocspcerts': /<br>
Aug 8 16:30:54 www pluto[1072]: Could not change to directory
'/etc/ipsec.d/crls'<br>
Aug 8 16:30:54 www pluto[1072]: | selinux support is NOT enabled.<br>
Aug 8 16:30:54 www pluto[1072]: Non-fips mode set in
/proc/sys/crypto/fips_enabled<br>
Aug 8 16:30:54 www pluto[1072]: Non-fips mode set in
/proc/sys/crypto/fips_enabled<br>
Aug 8 16:30:54 www pluto[1072]: added connection description
"otwovpn"<br>
Aug 8 16:30:54 www pluto[1072]: listening for IKE messages<br>
Aug 8 16:30:54 www pluto[1072]: adding interface eth0/eth0
78.47.14.195:500<br>
Aug 8 16:30:54 www pluto[1072]: adding interface lo/lo
127.0.0.1:500<br>
Aug 8 16:30:54 www pluto[1072]: adding interface lo/lo ::1:500<br>
Aug 8 16:30:54 www pluto[1072]: loading secrets from
"/etc/ipsec.secrets"<br>
Aug 8 16:30:54 www pluto[1072]: loading secrets from
"/etc/ipsec.d/o2vpn.secrets"<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: initiating Main Mode<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: ignoring Vendor ID
payload [FRAGMENTATION c0000000]<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: transition from state
STATE_MAIN_I1 to state STATE_MAIN_I2<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: STATE_MAIN_I2: sent
MI2, expecting MR2<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: received Vendor ID
payload [Cisco-Unity]<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: received Vendor ID
payload [XAUTH]<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: ignoring unknown
Vendor ID payload [45bfb36d8ba8a9e8a222c0d844bf4fed]<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: ignoring Vendor ID
payload [Cisco VPN 3000 Series]<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: transition from state
STATE_MAIN_I2 to state STATE_MAIN_I3<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: STATE_MAIN_I3: sent
MI3, expecting MR3<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: received Vendor ID
payload [Dead Peer Detection]<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: Main mode peer ID is
ID_IPV4_ADDR: '160.218.24.2'<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: transition from state
STATE_MAIN_I3 to state STATE_MAIN_I4<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: STATE_MAIN_I4: ISAKMP
SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256
prf=oakley_sha group=modp1024}<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #2: initiating Quick Mode
PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1
msgid:35c07df7 proposal=AES(12)_256-SHA1(2)_160 pfsgroup=no-pfs}<br>
Aug 8 16:30:54 www pluto[1072]: "otwovpn" #1: received Delete SA
payload: deleting ISAKMP State #1<br>
Aug 8 16:30:54 www pluto[1072]: packet from 160.218.24.2:500:
received and ignored informational message<br>
<br>
I asked for the log file from the windows server and that look like
the following:<br>
<p class="MsoNormal"><span style="color:#1F497D">vpn01.log - Aug 6
12:42:36 vpn01 -973619477 08/06/2012 12:42:36.350 SEV=4 IKE/119
RPT=1644046 78.47.14.195 Group [78.47.14.195] PHASE 1 COMPLETED</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">vpn01.log - Aug 6
12:42:36 vpn01 -973619476 08/06/2012 12:42:36.350 SEV=6 IKE/121
RPT=1644046 78.47.14.195 Keep-alive type for this connection:
DPD</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">vpn01.log - Aug 6
12:42:36 vpn01 -973619467 08/06/2012 12:42:36.350 SEV=4 AUTH/22
RPT=1247461 User [78.47.14.195] Group [78.47.14.195] connected,
Session Type: IPSec/LAN-to-LAN</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">vpn01.log - Aug 6
12:42:36 vpn01 -973619465 08/06/2012 12:42:36.350 SEV=4 AUTH/84
RPT=1238344 LAN-to-LAN tunnel to headend device 78.47.14.195
connected</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">vpn01.log - Aug 6
12:42:36 vpn01 -973619450 08/06/2012 12:42:36.370 SEV=4
IKEDBG/97 RPT=15682315 78.47.14.195 Group [78.47.14.195] QM FSM
error (P2 struct &0x1922ab68, mess id 0x82c5db7c)!</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">vpn01.log - Aug 6
12:42:36 vpn01 -973619424 08/06/2012 12:42:36.380 SEV=4 AUTH/23
RPT=1237593 78.47.14.195 User [78.47.14.195] Group
[78.47.14.195] disconnected: duration: 0:00:00</span><o:p></o:p></p>
<span style="color:#1F497D">vpn01.log - Aug 6 12:42:36 vpn01
-973619423 08/06/2012 12:42:36.380 SEV=4 AUTH/85 RPT=1237583
LAN-to-LAN tunnel to headend device 78.47.14.195 disconnected:
duration: 0:00:00</span><br>
<br>
Any help I kindly appreciate it!<br>
Thank you!
</body>
</html>