<div dir="ltr">Hi all,<div><br></div><div>Well this is now fixed. I carefully (very carefully) re-read the man page - <a href="http://linux.die.net/man/5/ipsec.secrets">http://linux.die.net/man/5/ipsec.secrets</a></div><div>
<br></div><div>and then modified my PSK files accordingly and am now back in business.</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 24 September 2013 10:35, Paul Young <span dir="ltr"><<a href="mailto:paul@arkig.com" target="_blank">paul@arkig.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">The host does not but the router it connects to the internet with does.<div><br></div><div>It is a little bit of a stretch as the router connects to the internet by a 4G dongle. Which itself is doing things to make life difficult. For example it is not strictly addressable from the internet.</div>
<div><br></div><div>So that is why I am trying to set up a host -> VPN server type of setup. Road runner basically.</div><div><br></div><div>I am not referencing IPs in the secret file itself.</div><div><br></div><div>
I set an id and use that to relate the conf file to the secret file - @<blah> format.</div><div><br></div><div>So for example in the conf file I have an entry like:</div><div><br></div><div>leftid=@wow<br></div><div>
<br></div><div>and in the secrets file associated with the conf file I have this format:</div><div><br></div><div>@wow: PSK "asecret"<br></div><div><br></div><div>and as far as I know that is part of the tie in</div>
<span class="HOEnZb"><font color="#888888">
<div><br></div><div>Paul</div></font></span></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On 24 September 2013 10:24, Leto <span dir="ltr"><<a href="mailto:letoams@gmail.com" target="_blank">letoams@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div>shouldn't be needed. Dos your host get a new IP on reboot and you use the old ip in either ipsec.conf or ipsec.secrets?<div>
<br><br>sent from a tiny device </div></div><div><div><div><br>On 2013-09-23, at 20:08, Paul Young <<a href="mailto:paul@arkig.com" target="_blank">paul@arkig.com</a>> wrote:<br><br></div><blockquote type="cite">
<div><div dir="ltr">The next things I did was change the PSK to something really simple - did not change the symptoms.<div><br></div><div>So now I have rebuilt the entire server on one side and am starting from scratch. Which is bulls__t</div>
<div><br></div><div>But I don't have much time to get this to work</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 24 September 2013 07:10, Paul Young <span dir="ltr"><<a href="mailto:paul@arkig.com" target="_blank">paul@arkig.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Leto,<div><br></div><div>Thanks for the reply. It looks ok and I basically generated the PSK with:</div>
<div><br></div><div>ipsec ranbits --continuous 128<br></div><div><br></div><div>Cheers,</div><div>Paul</div>
</div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On 24 September 2013 02:52, Leto <span dir="ltr"><<a href="mailto:letoams@gmail.com" target="_blank">letoams@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="auto"><div>try avoiding some strange characters in the psk. ensure you're not mixing up ASCII vs hex?<br><br>sent from a tiny device </div><div><div><div><br>On 2013-09-23, at 10:09, Paul Young <<a href="mailto:paul@arkig.com" target="_blank">paul@arkig.com</a>> wrote:<br>
<br></div><blockquote type="cite"><div><div dir="ltr">Hi Guys,<div><br></div><div>What other reasons other than mismatched PSKs could cause this issue?</div><div><br></div><div>Thanks</div></div><div class="gmail_extra">
<br>
<br><div class="gmail_quote">On 23 September 2013 18:46, Paul Young <span dir="ltr"><<a href="mailto:paul@arkig.com" target="_blank">paul@arkig.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I also just tried replacing the PSK on both sides and got the same issue continued</div><div>
<div><div class="gmail_extra"><br><br><div class="gmail_quote">On 23 September 2013 18:39, Paul Young <span dir="ltr"><<a href="mailto:paul@arkig.com" target="_blank">paul@arkig.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi all,<div><br></div><div>After rebooting one side of my Openswan setup without changing config and so on I am getting this error and cannot create a tunnel anymore.</div>
<div><br></div><div>The reason I rebooted the host is I applied a bunch of firmware updates to the hardware.</div>
<div><br></div><div><div>Sep 23 18:33:23 lobster pluto[38968]: "conn"[11] <outside IP address> #55: next payload type of ISAKMP Identification Payload has an unknown value: 23</div><div>Sep 23 18:33:23 lobster pluto[38968]: "conn"[11] <outside IP address> #55: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet</div>
<div>Sep 23 18:33:23 lobster pluto[38968]: | payload malformed after IV</div><div>Sep 23 18:33:23 lobster pluto[38968]: | 74 40 8b d3 5a 30 3e 52 dc 54 26 a5 d9 88 bc e9</div><div>Sep 23 18:33:23 lobster pluto[38968]: | e4 ea 8e 4b</div>
<div>Sep 23 18:33:23 lobster pluto[38968]: "conn"[11] <outside IP address> #55: sending notification PAYLOAD_MALFORMED to <outside IP address>:500</div></div><div><br></div><div>I have triple checked the PSK and it appears to be fine. What am I missing?</div>
<div><br></div><div>Thanks,</div><div>Paul</div></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></blockquote></div></div><blockquote type="cite"><div><span>_______________________________________________</span><br><span><a href="mailto:Users@lists.openswan.org" target="_blank">Users@lists.openswan.org</a></span><br>
<span><a href="https://lists.openswan.org/mailman/listinfo/users" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a></span><br><span>Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a></span><br>
<span>Building and Integrating Virtual Private Networks with Openswan:</span><br><span><a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a></span><br>
</div></blockquote></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span><a href="mailto:Users@lists.openswan.org" target="_blank">Users@lists.openswan.org</a></span><br><span><a href="https://lists.openswan.org/mailman/listinfo/users" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a></span><br>
<span>Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a></span><br><span>Building and Integrating Virtual Private Networks with Openswan:</span><br>
<span><a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a></span><br></div></blockquote></div></div>
</div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>