<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-AU link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hi all,<br><br>I’m having an issue setting up a tunnel that I need some help with.<o:p></o:p></p><p class=MsoNormal>I have included the relevant files below<o:p></o:p></p><p class=MsoNormal><br>My first issue is when I start ipsec I get the following error:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Dec 6 13:51:30 firewall ipsec__plutorun: 023 address family inconsistency in this connection=2 host=2/nexthop=0<o:p></o:p></p><p class=MsoNormal>Dec 6 13:51:30 firewall ipsec__plutorun: 037 attempt to load incomplete connection<o:p></o:p></p><p class=MsoNormal>Dec 6 13:51:30 firewall ipsec__plutorun: 023 address family inconsistency in this connection=2 host=2/nexthop=0<o:p></o:p></p><p class=MsoNormal>Dec 6 13:51:30 firewall ipsec__plutorun: 037 attempt to load incomplete connection<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'>My second issue is the right side can’t connect.<o:p></o:p></p><p class=MsoNormal>packet from 119.225.115.131:500: ignoring unknown Vendor ID payload [f4ed19e0c114eb516faaac0ee37daf2807b4381f000000010000138d50c009ee...]<o:p></o:p></p><p class=MsoNormal>packet from 119.225.115.131:500: initial Main Mode message received on 103.29.172.40:500 but no connection has been authorized with policy=PSK<o:p></o:p></p><p class=MsoNormal>packet from 119.225.115.131:500: ignoring unknown Vendor ID payload [f4ed19e0c114eb516faaac0ee37daf2807b4381f000000010000138d50c009ee...]<o:p></o:p></p><p class=MsoNormal>packet from 119.225.115.131:500: initial Main Mode message received on 103.29.172.40:500 but no connection has been authorized with policy=PSK<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Can anyone help me on where to go from here?<br><br>Cheers<br>Adam<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>firewall# ipsec --version<o:p></o:p></p><p class=MsoNormal>Linux Openswan 2.6.37 (klips)<o:p></o:p></p><p class=MsoNormal><br>firewall# cat ipsec.conf<o:p></o:p></p><p class=MsoNormal># /etc/ipsec.conf - Openswan IPsec configuration file<o:p></o:p></p><p class=MsoNormal>version 2.0 # conforms to second version of ipsec.conf specification<o:p></o:p></p><p class=MsoNormal># basic configuration<o:p></o:p></p><p class=MsoNormal>config setup<o:p></o:p></p><p class=MsoNormal> #plutodebug = "all"<o:p></o:p></p><p class=MsoNormal> #klipsdebug = "all"<o:p></o:p></p><p class=MsoNormal> plutoopts="--perpeerlog"<o:p></o:p></p><p class=MsoNormal> dumpdir=/var/run/pluto/<o:p></o:p></p><p class=MsoNormal> nat_traversal=yes<o:p></o:p></p><p class=MsoNormal> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10<o:p></o:p></p><p class=MsoNormal> oe=off<o:p></o:p></p><p class=MsoNormal> protostack=klips<o:p></o:p></p><p class=MsoNormal> plutostderrlog=/var/log/pluto.log<o:p></o:p></p><p class=MsoNormal> interfaces="ipsec0=eth0"<o:p></o:p></p><p class=MsoNormal> listen=103.29.172.40<o:p></o:p></p><p class=MsoNormal># Add connections here<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>conn multi-conn1<o:p></o:p></p><p class=MsoNormal style='text-indent:36.0pt'>rightsubnets={144.55.124.122/32,144.55.123.187/32,144.55.122.67/32,144.55.123.63/32,172.27.130.1/32,172.27.130.2/32,192.168.11.51/32,144.55.124.206/32}<o:p></o:p></p><p class=MsoNormal style='text-indent:36.0pt'>leftsubnets={103.29.173.70/32,103.29.173.71/32,103.29.173.72/32,103.29.173.73/32,103.29.173.74/32,103.29.173.75/32,103.29.173.76/32,103.29.173.80/32,103.29.173.81/32,103.29.173.82/32,103.29.173.83/32,103.29.173.84/32,103.29.173.85/32,103.29.173.86/32,103.29.173.60/32,103.29.173.61/32,103.29.173.64/32,103.29.173.65/32}<o:p></o:p></p><p class=MsoNormal style='text-indent:36.0pt'>also=conn1<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>conn conn1<o:p></o:p></p><p class=MsoNormal> type = tunnel<o:p></o:p></p><p class=MsoNormal> authby = secret<o:p></o:p></p><p class=MsoNormal> left = 103.29.172.40<o:p></o:p></p><p class=MsoNormal> leftnexthop = %defaultroute<o:p></o:p></p><p class=MsoNormal> right = 119.225.115.131<o:p></o:p></p><p class=MsoNormal> rightnexthop = %defaultroute<o:p></o:p></p><p class=MsoNormal> ike = aes256-sha1-modp1536<o:p></o:p></p><p class=MsoNormal> esp = aes256-sha1<o:p></o:p></p><p class=MsoNormal> keyexchange = ike<o:p></o:p></p><p class=MsoNormal> pfs = no<o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'> auto = add<o:p></o:p></p><p class=MsoNormal>firewall# cat ipsec.secrets<o:p></o:p></p><p class=MsoNormal># This file holds shared secrets or RSA private keys for inter-Pluto<o:p></o:p></p><p class=MsoNormal># authentication. See ipsec_pluto(8) manpage, and HTML documentation.<o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'>103.29.172.40 119.225.115.131: PSK "BLANK-BLANK-BLANK"<o:p></o:p></p><p class=MsoNormal>firewall# ip addr<o:p></o:p></p><p class=MsoNormal>1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN<o:p></o:p></p><p class=MsoNormal> link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00<o:p></o:p></p><p class=MsoNormal> inet 127.0.0.1/8 scope host lo<o:p></o:p></p><p class=MsoNormal> inet6 ::1/128 scope host<o:p></o:p></p><p class=MsoNormal> valid_lft forever preferred_lft forever<o:p></o:p></p><p class=MsoNormal>2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000<o:p></o:p></p><p class=MsoNormal> link/ether 00:25:90:35:35:9e brd ff:ff:ff:ff:ff:ff<o:p></o:p></p><p class=MsoNormal> inet 103.29.172.1/24 brd 103.29.172.255 scope global eth0<o:p></o:p></p><p class=MsoNormal> inet 103.29.173.1/24 brd 103.29.173.255 scope global eth0:0<o:p></o:p></p><p class=MsoNormal> inet 103.29.174.1/24 brd 103.29.174.255 scope global eth0:1<o:p></o:p></p><p class=MsoNormal> inet 103.29.175.1/24 brd 103.29.175.255 scope global eth0:2<o:p></o:p></p><p class=MsoNormal> inet 172.16.0.100/24 brd 172.16.0.255 scope global eth0:4<o:p></o:p></p><p class=MsoNormal> inet 103.29.172.40/24 scope global secondary eth0<o:p></o:p></p><p class=MsoNormal> inet6 fe80::225:90ff:fe35:359e/64 scope link<o:p></o:p></p><p class=MsoNormal> valid_lft forever preferred_lft forever<o:p></o:p></p><p class=MsoNormal>3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000<o:p></o:p></p><p class=MsoNormal> link/ether 00:25:90:35:35:9f brd ff:ff:ff:ff:ff:ff<o:p></o:p></p><p class=MsoNormal> inet 202.45.103.162/30 brd 202.45.103.163 scope global eth1<o:p></o:p></p><p class=MsoNormal> inet6 fe80::225:90ff:fe35:359f/64 scope link<o:p></o:p></p><p class=MsoNormal> valid_lft forever preferred_lft forever<o:p></o:p></p><p class=MsoNormal>82: ipsec0: <NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 10<o:p></o:p></p><p class=MsoNormal> link/ether 00:25:90:35:35:9e brd ff:ff:ff:ff:ff:ff<o:p></o:p></p><p class=MsoNormal> inet 103.29.172.1/32 scope global ipsec0<o:p></o:p></p><p class=MsoNormal> inet 103.29.173.1/32 scope global ipsec0<o:p></o:p></p><p class=MsoNormal> inet 103.29.174.1/32 scope global ipsec0<o:p></o:p></p><p class=MsoNormal> inet 103.29.175.1/32 scope global ipsec0<o:p></o:p></p><p class=MsoNormal> inet 172.16.0.100/32 scope global ipsec0<o:p></o:p></p><p class=MsoNormal> inet 103.29.172.40/32 scope global ipsec0<o:p></o:p></p><p class=MsoNormal> inet6 fe80::225:90ff:fe35:359e/128 scope link<o:p></o:p></p><p class=MsoNormal> valid_lft forever preferred_lft forever<o:p></o:p></p><p class=MsoNormal>83: ipsec1: <NOARP> mtu 0 qdisc noop state DOWN qlen 10<o:p></o:p></p><p class=MsoNormal> link/void<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>firewall# cat daemon.log<o:p></o:p></p><p class=MsoNormal>Dec 6 13:51:29 firewall ipsec_setup: Starting Openswan IPsec 2.6.37...<o:p></o:p></p><p class=MsoNormal>Dec 6 13:51:29 firewall ipsec_setup: Using KLIPS/legacy stack<o:p></o:p></p><p class=MsoNormal>Dec 6 13:51:30 firewall ipsec_setup: KLIPS debug `none'<o:p></o:p></p><p class=MsoNormal>Dec 6 13:51:30 firewall ipsec_setup: KLIPS ipsec0 on eth0 103.29.172.1/24 broadcast mtu 1500<o:p></o:p></p><p class=MsoNormal>Dec 6 13:51:30 firewall ipsec_setup: ipsec0 -> NULL mtu=0(0) -> 0<o:p></o:p></p><p class=MsoNormal>Dec 6 13:51:30 firewall ipsec_setup: ...Openswan IPsec started<o:p></o:p></p><p class=MsoNormal>Dec 6 13:51:30 firewall ipsec__plutorun: 023 address family inconsistency in this connection=2 host=2/nexthop=0<o:p></o:p></p><p class=MsoNormal>Dec 6 13:51:30 firewall ipsec__plutorun: 037 attempt to load incomplete connection<o:p></o:p></p><p class=MsoNormal>Dec 6 13:51:30 firewall ipsec__plutorun: 023 address family inconsistency in this connection=2 host=2/nexthop=0<o:p></o:p></p><p class=MsoNormal>Dec 6 13:51:30 firewall ipsec__plutorun: 037 attempt to load incomplete connection<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>