<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" id="owaParaStyle"></style><style type="text/css"></style>
</head>
<body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">
<div>Hi everyone, </div>
<div><br>
</div>
<div>my openswan <-> openswan tunnel is working completely fine, but the server keeps retransmitting phase 1 messages until the tunnel collapses. </div>
<div>My setup is like this:</div>
<div>192.168.54.0/24 -> openswan a.b.c.d <----------> openswan w.x.y.z <- 192.168.0.0/24</div>
<div><br>
</div>
<div>The tunnel comes up and works (can transmit data from left to right), but soon after, the right side retransmits phase 1 messages and receives no answer, thus shutting down everything at attempt 3xx or so.</div>
<div><br>
</div>
<div>Left config: </div>
<div><br>
</div>
<div>version 2.0 # conforms to second version of ipsec.conf specification</div>
<div># basic configuration</div>
<div>config setup</div>
<div># nat_traversal=yes</div>
<div># virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10</div>
<div> oe=off</div>
<div> protostack=auto</div>
<div> interfaces=%defaultorute</div>
<div> uniqueids=yes</div>
<div><br>
</div>
<div># Add connections here</div>
<div><br>
</div>
<div># default settings for connections</div>
<div>conn %default</div>
<div> keyingtries=0</div>
<div> disablearrivalcheck=no</div>
<div> authby=rsasig</div>
<div><br>
</div>
<div>conn conn1</div>
<div> authby=secret</div>
<div> left=a.b.c.d</div>
<div> leftid="a.b.c.d"</div>
<div> leftsubnet=192.168.54.0/24</div>
<div> right=w.x.y.z</div>
<div> rightid="w.x.y.z"</div>
<div> rightsubnet=192.168.50.0/24</div>
<div> auto=start</div>
<div><br>
</div>
<div> type=tunnel</div>
<div> keyexchange=ike</div>
<div> ike=3des-md5-modp1024,aes256-sha1-modp1024</div>
<div> ikelifetime=86400s</div>
<div> rekey=yes</div>
<div> phase2=esp</div>
<div> phase2alg=3des-md5;modp1024</div>
<div> pfs=no</div>
<div><br>
</div>
<div><br>
</div>
<div>Right config:</div>
<div><br>
</div>
<div>version 2.0 # conforms to second version of ipsec.conf specification</div>
<div><br>
</div>
<div># basic configuration</div>
<div>config setup</div>
<div> dumpdir=/var/run/pluto/</div>
<div># nat_traversal=yes</div>
<div> oe=off</div>
<div> protostack=auto</div>
<div> interfaces="ipsec0=eth1"</div>
<div> virtual_private=%v4:192.168.0.0/16,%v4:!172.16.0.0/12,%v4:!192.168.0.0/24,%v4:!192.168.50.0/24,%v4:!192.168.40.0/24,%v4:!192.168.8.0/24</div>
<div><br>
</div>
<div># default settings for connections</div>
<div>conn %default</div>
<div> keyingtries=0</div>
<div><br>
</div>
<div>conn conn1</div>
<div> authby=secret</div>
<div> left=a.b.c.d</div>
<div> leftid="a.b.c.d"</div>
<div> leftsubnet=192.168.54.0/24</div>
<div> right=w.x.y.z</div>
<div> rightid="w.x.y.z"</div>
<div> rightsubnet=192.168.50.0/24</div>
<div> auto=start</div>
<div><br>
</div>
<div> type=tunnel</div>
<div> keyexchange=ike</div>
<div> ike=3des-md5-modp1024,aes256-sha1-modp1024</div>
<div> ikelifetime=86400s</div>
<div> rekey=yes</div>
<div> phase2=esp</div>
<div> phase2alg=3des-md5;modp1024</div>
<div> pfs=no</div>
<div><br>
</div>
<div><br>
</div>
<div>There is no NAT-T involved as the public IPs of left and right are in my own class C net and face the internet directly.</div>
<div><br>
</div>
<div>left ipsec auto --status:</div>
<div>000 "conn1": 192.168.54.0/24===a.b.c.d<a.b.c.d>[+S=C]...w.x.y.z<w.x.y.z>[+S=C]===192.168.50.0/24; erouted; eroute owner: #2</div>
<div>000 "conn1": myip=unset; hisip=unset;</div>
<div>000 "conn1": ike_life: 86400s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0</div>
<div>000 "conn1": policy: PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 24,24; interface: eth1;</div>
<div>000 "conn1": newest ISAKMP SA: #1; newest IPsec SA: #2;</div>
<div>000 "conn1": IKE algorithms wanted: 3DES_CBC(5)_000-MD5(1)_000-MODP1024(2), AES_CBC(7)_256-SHA1(2)_000-MODP1024(2); flags=-strict</div>
<div>000 "conn1": IKE algorithms found: 3DES_CBC(5)_192-MD5(1)_128-MODP1024(2), AES_CBC(7)_256-SHA1(2)_160-MODP1024(2)</div>
<div>000 "conn1": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024</div>
<div>000 "conn1": ESP algorithms wanted: 3DES(3)_000-MD5(1)_000; pfsgroup=MODP1024(2); flags=-strict</div>
<div>000 "conn1": ESP algorithms loaded: 3DES(3)_192-MD5(1)_128</div>
<div>000 "conn1": ESP algorithm newest: 3DES_000-HMAC_MD5; pfsgroup=<N/A></div>
<div>000</div>
<div>000 #343: "conn1":500 STATE_MAIN_R1 (sent MR1, expecting MI2); EVENT_RETRANSMIT in 4s; lastdpd=-1s(seq in:0 out:0); idle; import:not set</div>
<div>000 #2: "conn1":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 12260s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate</div>
<div>000 #2: "conn1" esp.7d011f40@w.x.y.z esp.edb8e4ff@a.b.c.d tun.0@w.x.y.z tun.0@a.b.c.d ref=0 refhim=4294901761</div>
<div>000 #1: "conn1":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 70286s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate</div>
<div>000 #344: "conn1":500 STATE_MAIN_R1 (sent MR1, expecting MI2); EVENT_RETRANSMIT in 5s; lastdpd=-1s(seq in:0 out:0); idle; import:not set</div>
<div><br>
</div>
<div>right ipsec auto --status:</div>
<div>000 "conn1": 192.168.50.0/24===w.x.y.z<w.x.y.z>[+S=C]...a.b.c.d<a.b.c.d>[+S=C]===192.168.54.0/24; erouted; eroute owner: #4</div>
<div>000 "conn1": myip=unset; hisip=unset;</div>
<div>000 "conn1": ike_life: 86400s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0</div>
<div>000 "conn1": policy: PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 24,24; interface: eth1;</div>
<div>000 "conn1": newest ISAKMP SA: #3; newest IPsec SA: #4;</div>
<div>000 "conn1": IKE algorithms wanted: 3DES_CBC(5)_000-MD5(1)_000-MODP1024(2), AES_CBC(7)_256-SHA1(2)_000-MODP1024(2); flags=-strict</div>
<div>000 "conn1": IKE algorithms found: 3DES_CBC(5)_192-MD5(1)_128-MODP1024(2), AES_CBC(7)_256-SHA1(2)_160-MODP1024(2)</div>
<div>000 "conn1": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024</div>
<div>000 "conn1": ESP algorithms wanted: 3DES(3)_000-MD5(1)_000; pfsgroup=MODP1024(2); flags=-strict</div>
<div>000 "conn1": ESP algorithms loaded: 3DES(3)_192-MD5(1)_128</div>
<div>000 "conn1": ESP algorithm newest: 3DES_000-HMAC_MD5; pfsgroup=<N/A></div>
<div>000</div>
<div>000 #4: "conn1":500 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 12904s; newest IPSEC; eroute owner; isakmp#3; idle; import:not set</div>
<div>000 #4: "conn1" esp.edb8e4ff@a.b.c.d esp.7d011f40@w.x.y.z tun.0@a.b.c.d tun.0@w.x.y.z ref=0 refhim=4294901761</div>
<div>000 #3: "conn1":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 70504s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:not set</div>
<div><br>
</div>
<div><br>
</div>
<div>Sometimes the left side even opens up more than 1 tunnel (even 4, seen via ipsec setup status), although the right side has only one.</div>
<div><br>
</div>
<div>Can anyone shed some light on this? I'm afraid I'm completely lost here, but I think I am missing something in my configs.</div>
<div><br>
</div>
<div>Best regards</div>
<div>Len</div>
<div><br>
</div>
</div>
</body>
</html>