<div dir="ltr">Unfortunately, YY.YY.YY.YY is our customer's server, so I'll have to wait several hours for them to wake up in Africa and see if they can help out. It's starting to look like I've done everything I can on my end for now, and I really appreciate your help. Please let me know if you have any other suggestions of any debugging I can do only on the XX.XX.XX.XX end before they wake up.<br>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Mar 19, 2014 at 3:56 PM, simon charles <span dir="ltr"><<a href="mailto:charlessimon@hotmail.com" target="_blank">charlessimon@hotmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><div dir="ltr">Ok - thats good. So it is leaving your XX.XX.XX.XX server. Now run a tcpdump on the outside interface of the YY.YY.YY.YY server. If you see ESP traffic on the outside interface of that server then check the following on the YY.YY.YY.YY server<br>
1. route to XX.XX.XX.XX pointing to your Cisco device<br><br>2. Firewall rules to accept traffic from XX.XX.XX.XX<br><br><br>If you don't see ESP traffic on the outside interface of the YY.YY.YY.YY server then the traffic is not passing on from your Cisco device towards your YY.YY.YY.YY server.<br>
<br><span style="font-family:Tahoma,Helvetica,Sans-Serif;font-style:italic;font-weight:bold">-<span style="font-family:Times New Roman,Times,Serif"> Simon Charles - </span></span><br><br><br><div><hr>Date: Wed, 19 Mar 2014 15:45:56 -0700<div>
<div class="h5"><br>Subject: Re: [Openswan Users] Connecting to Cisco VPN, getting INVALID_ID_INFORMATION followed by "perhaps peer likes no proposal"<br>From: <a href="mailto:tim@mccune.name" target="_blank">tim@mccune.name</a><br>
To: <a href="mailto:charlessimon@hotmail.com" target="_blank">charlessimon@hotmail.com</a><br>CC: <a href="mailto:users@lists.openswan.org" target="_blank">users@lists.openswan.org</a><br><br><div dir="ltr">I do see ESP traffic going towards the Cisco device.<br>
<br>15:44:57.624680 IP XX.XX.XX.XX > <a href="http://CC.CC.CC.CC" target="_blank">CC.CC.CC.CC</a>: ESP(spi=0x74126044,seq=0xb), length 116<br></div><div>
<br><br><div>On Wed, Mar 19, 2014 at 3:38 PM, simon charles <span dir="ltr"><<a href="mailto:charlessimon@hotmail.com" target="_blank">charlessimon@hotmail.com</a>></span> wrote:<br><blockquote style="border-left:1px #ccc solid;padding-left:1ex">
<div><div dir="ltr">What happens when you run this ping and do a tcpdump on the outside interface. If you see ESP traffic going towards your Cisco device then the pings are making its way out through the tunnel and not coming back. If you don't see ESP packets in the tcpdump then the pings are not making its way through the tunnel.<br>
<br><br><br><span style="font-family:Tahoma,Helvetica,Sans-Serif;font-style:italic;font-weight:bold">-<span style="font-family:Times New Roman,Times,Serif"> Simon Charles - </span></span><br><br><br><div><hr>Date: Wed, 19 Mar 2014 15:32:43 -0700<div>
<div><br>Subject: Re: [Openswan Users] Connecting to Cisco VPN, getting INVALID_ID_INFORMATION followed by "perhaps peer likes no proposal"<br>From: <a href="mailto:tim@mccune.name" target="_blank">tim@mccune.name</a><br>
To: <a href="mailto:charlessimon@hotmail.com" target="_blank">charlessimon@hotmail.com</a><br>CC: <a href="mailto:users@lists.openswan.org" target="_blank">users@lists.openswan.org</a><br><br><div dir="ltr">Looks like the FAILED status was a red herring. I have bastille installed on this device, and stopped it to see if that made any difference in being able to reach YY.YY.YY.YY (it didn't), but when I restarted bastille, "ipsec verify" no longer showed a FAILED status for IP forwarding. Still unable to reach YY.YY.YY.YY.<br>
</div><div><br><br><div>On Wed, Mar 19, 2014 at 3:10 PM, Tim McCune <span dir="ltr"><<a href="mailto:tim@mccune.name" target="_blank">tim@mccune.name</a>></span> wrote:<br><blockquote style="border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div><div># ping YY.YY.YY.YY -I
XX.XX.XX.XX
<br></div>PING YY.YY.YY.YY (YY.YY.YY.YY) from XX.XX.XX.XX : 56(84) bytes of data.<br>^C<br>--- YY.YY.YY.YY ping statistics ---<br>17 packets transmitted, 0 received, 100% packet loss, time 16003ms<br><br></div>Not pingable. Also of note, when I run "ipsec verify", I get a "FAILED" status for "Two or more interfaces found, checking IP forwarding". However, "cat /proc/sys/net/ipv4/ip_forward" outputs "1". I don't know why I'm getting back a FAILED status, or if this is the reason that I can't reach YY.YY.YY.YY. I was previously running an older version of openswan on this machine (2.6.23), and I didn't get the FAILED status from that. It only started occurring after I upgraded to 2.6.38.<br>
</div><div><div><div><br><br><div>On Wed, Mar 19, 2014 at 2:52 PM, simon charles <span dir="ltr"><<a href="mailto:charlessimon@hotmail.com" target="_blank">charlessimon@hotmail.com</a>></span> wrote:<br>
<blockquote style="border-left:1px #ccc solid;padding-left:1ex">
<div><div dir="ltr">Tim , <br> Looks like the vpn tunnel has been established. What does your firewall rules look like on XX.XX.XX.XX and YY.YY.YY.YY <br><br>What happens when do you execute this command from the XX.XX.XX.XX server<br>
<br><br># ping YY.YY.YY.YY -I
XX.XX.XX.XX
<br><br><span style="font-family:Tahoma,Helvetica,Sans-Serif;font-style:italic;font-weight:bold">-<span style="font-family:Times New Roman,Times,Serif"> Simon Charles - </span></span><br><br><br><div><hr>Date: Wed, 19 Mar 2014 14:30:51 -0700<div>
<div><br>Subject: Re: [Openswan Users] Connecting to Cisco VPN, getting INVALID_ID_INFORMATION followed by "perhaps peer likes no proposal"<br>From: <a href="mailto:tim@mccune.name" target="_blank">tim@mccune.name</a><br>
To: <a href="mailto:charlessimon@hotmail.com" target="_blank">charlessimon@hotmail.com</a><br>CC: <a href="mailto:users@lists.openswan.org" target="_blank">users@lists.openswan.org</a><br><br><div dir="ltr">Progress! I just went back into ipsec.conf and removed all of the additional settings that I had been trying to experiment with, until I just had a very basic configuration:<br>
<br>conn server-a<br> left=XX.XX.XX.XX<br>
right=<a href="http://CC.CC.CC.CC" target="_blank">CC.CC.CC.CC</a><br> rightsubnet=YY.YY.YY.YY/32<br> authby=secret<br> auto=start<br><br><div>Now I can ping <a href="http://CC.CC.CC.CC" target="_blank">CC.CC.CC.CC</a> and my pluto.log file ends with:<br>
STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xd574cb40 <0xb49adebe xfrm=3DES_0-HMAC_SHA1 NATOA=none NATD=none DPD=none}<br><br></div><div>However, I cannot seem to reach the port that is supposed to be open on YY.YY.YY.YY.<br>
</div><div><br><div>On Wed, Mar 19, 2014 at 1:40 PM, Tim McCune <span dir="ltr"><<a href="mailto:tim@mccune.name" target="_blank">tim@mccune.name</a>></span> wrote:<br><blockquote style="border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">THANK YOU. That was clearly a piece of the puzzle that I had failed to wrap my head around: that I needed 2 different connection declarations for the 2 different hosts, even though they were both routing through the same VPN appliance. I am now getting a different error message, which seems like progress. :) Now, instead of INVALID_ID_INFORMATION, I'm getting back NO_PROPOSAL_CHOSEN. Off to google that message, but if anyone has any insights into that one as well, I would appreciate it. Thanks again for moving me what seems to be one step closer.<br>
</div><div><div><div><br><br><div>On Wed, Mar 19, 2014 at 12:43 PM, simon charles <span dir="ltr"><<a href="mailto:charlessimon@hotmail.com" target="_blank">charlessimon@hotmail.com</a>></span> wrote:<br>
<blockquote style="border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div><div dir="ltr">Tim , <br> Based on your ip addressing convention - i am presuming the following<br><br>XX.XX.XX.XX is your Server A<br>YY.YY.YY.YY is your Server B<br>ZZ.ZZ.ZZ.ZZ is your Server C<br><br><br>If that is true then the ipsec configuration should look something like this<br>
<br><br>
<span>conn ServerA-to-ServerB<br>
left=XX.XX.XX.XX</span><br><span> leftsubnet=</span>
<span>XX.XX.XX.XX</span>
<span>/32<br> right=<a href="http://CC.CC.CC.CC" target="_blank">CC.CC.CC.CC</a> ( public ip addr of the Cisco VPN device )</span><br><span> rightsubnet=</span>
YY.YY.YY.YY
<span>/32<div><br>
authby=secret<br>
auto=start<br>
ike=aes128-sha1;modp1024<br>
phase2=esp<br>
phase2alg=aes128-sha1;modp1024<br>
pfs=yes<br>
aggrmode=no<br>
salifetime=28800s<br>
<br>
</div></span><br><br><br><br><br>
<span>conn ServerA-to-ServerC<br>
left=XX.XX.XX.XX</span><br><span> leftsubnet=</span>
<span>XX.XX.XX.XX</span>
<span>/32<br> right=<a href="http://CC.CC.CC.CC" target="_blank">CC.CC.CC.CC</a> ( public ip addr of the Cisco VPN device )</span><br><span> rightsubnet=</span> ZZ.ZZ.ZZ.ZZ/32<br><div><span><br>
authby=secret<br>
auto=start<br>
ike=aes128-sha1;modp1024<br>
phase2=esp<br>
phase2alg=aes128-sha1;modp1024<br>
pfs=yes<br>
aggrmode=no<br>
salifetime=28800s<br>
</span><br></div><span><font color="#888888"> <br><br><span style="font-family:Tahoma,Helvetica,Sans-Serif;font-style:italic;font-weight:bold">-<span style="font-family:Times New Roman,Times,Serif"> Simon Charles - </span></span><br>
</font></span><div><br><br></div><div><div><hr>Date: Wed, 19 Mar 2014 12:24:58 -0700<br>Subject: Re: [Openswan Users] Connecting to Cisco VPN, getting INVALID_ID_INFORMATION followed by "perhaps peer likes no proposal"<br>
From: <a href="mailto:tim@mccune.name" target="_blank">tim@mccune.name</a><br>To: <a href="mailto:charlessimon@hotmail.com" target="_blank">charlessimon@hotmail.com</a><br>CC: <a href="mailto:users@lists.openswan.org" target="_blank">users@lists.openswan.org</a></div>
<div><div><br><br><div dir="ltr"><div>Thanks Simon. This seems like a reasonable guess based on other stuff I've found while searching online. However, I have to confess that I just don't understand how to translate from what I've pasted from the Cisco configuration into an openswan config. Here is the network topology that we are trying to accomplish:<br>
<br></div><font face="courier new,monospace"> ---->[Customer Server B]</font><br><div><span style="font-family:courier new,monospace">[My Server A (running openswan)] <-------> [Customer Cisco VPN appliance] -----|</span><br>
<font face="courier new,monospace"> ---->[Customer Server C]</font><br></div><div><br>Where all 4 of the servers in that diagram have public IP addresses. What would the rightsubnet and leftsubnet settings on the openswan side need to be in a case like that? I'm confused because we are not trying to reach a private network. We just want to tell our server "when communicating with server B and server C, use the ipsec tunnel."<br>
</div></div><div><br><br><div>On Wed, Mar 19, 2014 at 11:44 AM, simon charles <span dir="ltr"><<a href="mailto:charlessimon@hotmail.com" target="_blank">charlessimon@hotmail.com</a>></span> wrote:<br>
<blockquote style="border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div><div dir="ltr">Tim , <br> I did not see the rightsubnet and leftsubnet listed in your ipsec configuration. It is possible that you have a mismatch between what you have for your leftsubnet/rightsubnet and what Cisco side has for its access-list 127 ( which is a translation of {local subnet} { remote subnet } )<br>
<br><br><br><br><span style="font-family:Tahoma,Helvetica,Sans-Serif;font-style:italic;font-weight:bold">-<span style="font-family:Times New Roman,Times,Serif"> Simon Charles - </span></span><br><br><br><div><hr>Date: Wed, 19 Mar 2014 09:52:12 -0700<br>
From: <a href="mailto:tim@mccune.name" target="_blank">tim@mccune.name</a><br>To: <a href="mailto:users@lists.openswan.org" target="_blank">users@lists.openswan.org</a><br>Subject: [Openswan Users] Connecting to Cisco VPN, getting INVALID_ID_INFORMATION followed by "perhaps peer likes no proposal"<div>
<div><br><br><div dir="ltr"><div><div><div><div><div><div>Hi there. I was wondering if anyone could help me out with this problem I'm having trying to connect from openswan 2.6.38 on Ubuntu Lucid to a Cisco VPN appliance. I don't seem to be able to establish a connection. Here is the output I get in pluto.log:<br>
<br>"mine" #1: initiating Main Mode<br>"mine" #1: ignoring Vendor ID payload [Cisco IKE Fragmentation]<br>"mine" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2<br>"mine" #1: STATE_MAIN_I2: sent MI2, expecting MR2<br>
"mine" #1: received Vendor ID payload [Cisco-Unity]<br>"mine" #1: received Vendor ID payload [XAUTH]<br>"mine" #1: ignoring unknown Vendor ID payload [716e44df1a91b4edaffa5ff96dd22125]<br>"mine" #1: ignoring Vendor ID payload [Cisco VPN 3000 Series]<br>
"mine" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3<br>"mine" #1: STATE_MAIN_I3: sent MI3, expecting MR3<br>"mine" #1: received Vendor ID payload [Dead Peer Detection]<br>"mine" #1: Main mode peer ID is ID_IPV4_ADDR: 'XX.XX.XX.XX'<br>
"mine" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4<br>"mine" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp1024}<br>"mine" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:c359ad28 proposal=AES(12)_128-SHA1(2)_160 pfsgroup=OAKLEY_GROUP_MODP1024}<br>
"mine" #1: ignoring informational payload, type INVALID_ID_INFORMATION msgid=00000000<br>"mine" #1: received and ignored informational message<br>"mine" #1: received Delete SA payload: deleting ISAKMP State #1<br>
packet from <a href="http://80.87.94.106:500" target="_blank">80.87.94.106:500</a>: received and ignored informational message<br>"mine" #2: max number of retransmissions (2) reached STATE_QUICK_I1. No acceptable response to our first Quick Mode message: perhaps peer likes no proposal <br>
"mine" #2: starting keying attempt 2 of an unlimited number<br><br></div>and this output just repeats over and over. As far as I can tell, we are sending all of the correct parameters in our proposal, based on the configuration information we have been given by the organization that maintains the Cisco appliance. Here is what they provided us with:<br>
<br></div><div>Phase 1:<br></div>Encryption scheme: IKE<br>Authentication Method: Pre-Shared Key<br></div>Diffie-Hellman Group: Group 2<br></div>Encryption Algorithm: AES128<br></div>Hashing Algorithm: SHA-1<br></div>Main or Aggressive Mode: Main Mode<br>
Lifetime (for renegotiation): 28800 seconds<div><div><div><div><br></div><div>Phase 2:<br></div><div>Encapsulation mode: tunnel<br></div><div>Encryption algorithm ESP: AES128<br></div><div>Authentication Algorithm: SHA-1<br>
</div><div>Perfect Forward Secrecy: Group 2<br>Lifetime (for renegotiation): 3600 seconds<br><br></div><div>Here is the configuration on our end in ipsec.conf:<br><br>conn mine<br> left=XX.XX.XX.XX<br> right=XX.XX.XX.XX<br>
authby=secret<br> auto=start<br> ike=aes128-sha1;modp1024<br> phase2=esp<br> phase2alg=aes128-sha1;modp1024<br> pfs=yes<br> aggrmode=no<br> salifetime=28800s<br><br><br></div><div>And here is the configuration on their end on the Cisco appliance:<br>
<br>crypto ipsec transform-set MyOrg esp-aes esp-sha-hmac<br>crypto map gtvpn-rules 127 match address 127<br>crypto map gtvpn-rules 127 set pfs group2<br><br>crypto map gtvpn-rules 127 set peer XX.XX.XX.XX<br>crypto map gtvpn-rules 127 set transform-set MyOrg<br>
crypto map gtvpn-rules 127 set security-association lifetime seconds 3600<br><br>tunnel-group XX.XX.XX.XX type ipsec-l2l<br>tunnel-group XX.XX.XX.XX ipsec-attributes<br>pre-shared-key xxxxxxxx<br><br>access-list 127 extended permit ip host YY.YY.YY.YY host XX.XX.XX.XX<br>
access-list 127 extended permit ip host ZZ.ZZ.ZZ.ZZ host XX.XX.XX.XX<br><br></div><div>Any guidance would be appreciated.<br><br>Thank you!!<br></div></div></div></div></div>
<br></div></div><div>_______________________________________________
<a href="mailto:Users@lists.openswan.org" target="_blank">Users@lists.openswan.org</a>
<a href="https://lists.openswan.org/mailman/listinfo/users" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a>
Building and Integrating Virtual Private Networks with Openswan:
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a></div></div> </div></div>
</blockquote></div><br></div></div></div></div> </div></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div></div></div></div></div> </div></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div></div></div></div> </div></div>
</blockquote></div><br></div></div></div></div> </div></div>
</blockquote></div><br></div>