<html><body><div>Paul, Thanks for this, indeed as you stated the pfs=no is very important, it doesn't work without it on the Cisco VPN 3000 concentrators. :) </div><div><br></div><div>Thanks a lot !! </div><div><br>On May 01, 2015, at 03:07 AM, Paul Young <paul@arkig.com> wrote:<br><br></div><div><blockquote type="cite"><div class="msg-quote"><div dir="ltr">Hi Dan,<div><br></div><div>OpenSwan is a ball breaker - so hopefully this helps. I connect to a Cisco ASA with just these set in the conn</div><div><br></div><div><div><em>conn <blah></em></div><div><em> authby=secret</em></div><div><em> left=203.xxx.xxx.xxx</em></div><div><em> leftid=@<blah></em></div><div><em> leftnexthop=%defaultroute</em></div><div><em> leftsubnet=<a href="http://192.168.67.0/29" data-mce-href="http://192.168.67.0/29">192.168.67.0/29</a></em></div><div><em> leftsourceip=192.168.67.1</em></div><div><em> right=89.xxx.xxx.xxx</em></div><div><em> rightsubnets= { 10.22x.xxx.xxx/28 10.22x.xxx.xxx/28 }</em></div><div><em> type=tunnel</em></div><div><em> auto=start</em></div><div><em> pfs=no</em></div><div><em> ikelifetime=86400s</em></div><div><em> salifetime=28800s</em></div></div><div><br></div><div>I have removed some details but you get the idea. From memory <em>pfs=no</em> was important........I need to refresh what that did myself!</div><div><br></div><div>I have had issues in the past with Cisco endpoints - I'll just go and find that thread. It was a very specific problem though.</div><div><br></div><div>Cheers,</div><div>Paul Young</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 1 May 2015 at 03:03, Daniel Cave <span dir="ltr"><<a href="mailto:dan.cave@me.com" data-mce-href="mailto:dan.cave@me.com">dan.cave@me.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex" data-mce-style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;"><div><div><div><br></div><div>i've trawled through the lists archives and have tried a few fixes before sending this email.</div><div><br></div><div>Issue is :</div><div><br></div><div>Openswan connecting to cisco ASA 5520 *third party device, not ours*</div><div><br></div><div>Openswan version is latest ( on ubuntu 14.04 lts apt-get package 'openswan' ) </div><div>using net key</div><div><br></div><div>third party have sent me the configuration for the connection which uses : 3des-md5 for phase 1 & 2 using DH Group2 and PFS disabled. Using a pre-shared key.</div><div><br></div><div>it seems to be failing phase 2, i see the phase 1 and 2 packets leaving the openswan hosts and replies, but not sure why its not completing.</div><div><br></div><div><br></div><div>config is :</div><div><br></div><div># /etc/ipsec.conf - Openswan IPsec configuration file</div><div><br></div><div># This file: /usr/share/doc/openswan/ipsec.conf-sample</div><div>#</div><div># Manual: ipsec.conf.5</div><div><br></div><div><br></div><div>version2.0# conforms to second version of ipsec.conf specification</div><div><br></div><div># basic configuration</div><div>config setup</div><div># Do not set debug options to debug configuration issues!</div><div># plutodebug / klipsdebug = "all", "none" or a combation from below:</div><div># "raw crypt parsing emitting control klips pfkey natt x509 dpd private"</div><div># eg:</div><div># plutodebug="control parsing"</div><div># Again: only enable plutodebug or klipsdebug when asked by a developer</div><div><br></div><div>#interfaces=%defaultroute</div><div>#</div><div>#plutodebug=all</div><div># enable to get logs per-peer</div><div># plutoopts="--perpeerlog"</div><div>#</div><div># Enable core dumps (might require system changes, like ulimit -C)</div><div># This is required for abrtd to work properly</div><div># Note: incorrect SElinux policies might prevent pluto writing the core</div><div>dumpdir=/var/run/pluto/</div><div>#</div><div># NAT-TRAVERSAL support, see README.NAT-Traversal</div><div>nat_traversal=yes</div><div># exclude networks used on server side by adding %v4:!a.b.c.0/24</div><div># It seems that T-Mobile in the US and Rogers/Fido in Canada are</div><div># using 25/8 as "private" address space on their 3G network.</div><div># This range has not been announced via BGP (at least upto 2010-12-21)</div><div>virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10" data-mce-href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10">10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10</a></div><div># OE is now off by default. Uncomment and change to on, to enable.</div><div>#oe=off</div><div># which IPsec stack to use. auto will try netkey, then klips then mast</div><div>protostack=netkey</div><div># Use this to log to a file, or disable logging on embedded systems (like openwrt)</div><div>#plutostderrlog=/dev/null</div><div><br></div><div> force_keepalive=yes</div><div><br></div><div> keep_alive=60</div><div>nhelpers=0</div><div># Add connections here</div><div><br></div><div>conn idc-dr</div><div> type=tunnel</div><div> connaddrfamily=ipv4</div><div> authby=secret</div><div> auto=start</div><div> compress=yes</div><div> ike=3des-md5</div><div> phase2alg=3des-md5</div><div> phase2=esp</div><div> ikelifetime=86400s</div><div> keyexchange=ike</div><div> keylife=86400s</div><div> keyingtries=%forever</div><div><br></div><div> left=xx.xx.104.250</div><div># leftsourceip=10.99.0.240</div><div> leftid=xx.xx.104.250</div><div> leftsubnets=<a href="http://10.99.0.0/16" data-mce-href="http://10.99.0.0/16">10.99.0.0/16</a></div><div><br></div><div>#IDC</div><div> right=xx.xx.190.103</div><div> rightsubnets=<a href="http://192.168.30.0/24" data-mce-href="http://192.168.30.0/24">192.168.30.0/24</a></div><div># rightsourceip=192.168.30.247</div><div> rightid=xx.xx.190.103</div><div> forceencaps=yes</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div>debug from /var/log/auth.log shows</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #38: starting keying attempt 2 of an unlimited number</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: initiating Main Mode</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106 </div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: ignoring Vendor ID payload [Cisco IKE Fragmentation]</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: enabling possible NAT-traversal with method draft-ietf-ipsec-nat-t-ike-05</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: STATE_MAIN_I2: sent MI2, expecting MR2</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: received Vendor ID payload [Cisco-Unity]</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: received Vendor ID payload [XAUTH]</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: ignoring unknown Vendor ID payload [b368e08c2191f3e5b9fa7ef92ceb0748]</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: ignoring Vendor ID payload [Cisco VPN 3000 Series]</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: both are NATed</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: STATE_MAIN_I3: sent MI3, expecting MR3</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: received Vendor ID payload [Dead Peer Detection]</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: | protocol/port in Phase 1 ID Payload is 17/0. accepted with port_floating NAT-T</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: Main mode peer ID is ID_IPV4_ADDR: 'xx.xx.190.103'</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #42: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#41 msgid:1796d848 proposal=3DES(3)_192-MD5(1)_128 pfsgroup=OAKLEY_GROUP_MODP1024}</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: ignoring informational payload, type NO_PROPOSAL_CHOSEN msgid=00000000</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: received and ignored informational message</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: "idc-dr/1x1" #41: received Delete SA payload: deleting ISAKMP State #41</div><div>Apr 30 13:55:50 ip-10-99-0-240 pluto[22909]: packet from xx.xx.190.103:4500: received and ignored informational message</div><div><br></div><div><br></div><div>ipsec-auto -status </div><div>root@ip-10-99-0-240:~# ipsec auto --status</div><div>000 using kernel interface: netkey</div><div>000 interface lo/lo ::1</div><div>000 interface lo/lo 127.0.0.1</div><div>000 interface lo/lo 127.0.0.1</div><div>000 interface eth0/eth0 10.99.0.240</div><div>000 interface eth0/eth0 10.99.0.240</div><div>000 interface tun0/tun0 10.8.0.1</div><div>000 interface tun0/tun0 10.8.0.1</div><div>000 %myid = (none)</div><div>000 debug none</div><div>000 </div><div>000 virtual_private (%priv):</div><div>000 - allowed 6 subnets: <a href="http://10.0.0.0/8" data-mce-href="http://10.0.0.0/8">10.0.0.0/8</a>, <a href="http://192.168.0.0/16" data-mce-href="http://192.168.0.0/16">192.168.0.0/16</a>, <a href="http://172.16.0.0/12" data-mce-href="http://172.16.0.0/12">172.16.0.0/12</a>, <a href="http://25.0.0.0/8" data-mce-href="http://25.0.0.0/8">25.0.0.0/8</a>, fd00::/8, fe80::/10</div><div>000 - disallowed 0 subnets: </div><div>000 WARNING: Disallowed subnets in virtual_private= is empty. If you have </div><div>000 private address space in internal use, it should be excluded!</div><div>000 </div><div>000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64</div><div>000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192</div><div>000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8, keysizemin=40, keysizemax=128</div><div>000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448</div><div>000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0</div><div>000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8, keysizemin=160, keysizemax=288</div><div>000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256</div><div>000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128</div><div>000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160</div><div>000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256</div><div>000 algorithm ESP auth attr: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384, keysizemin=384, keysizemax=384</div><div>000 algorithm ESP auth attr: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512, keysizemin=512, keysizemax=512</div><div>000 algorithm ESP auth attr: id=8, name=AUTH_ALGORITHM_HMAC_RIPEMD, keysizemin=160, keysizemax=160</div><div>000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128</div><div>000 algorithm ESP auth attr: id=251, name=AUTH_ALGORITHM_NULL_KAME, keysizemin=0, keysizemax=0</div><div>000 </div><div>000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131</div><div>000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192</div><div>000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128</div><div>000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16</div><div>000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20</div><div>000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32</div><div>000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64</div><div>000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024</div><div>000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536</div><div>000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048</div><div>000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072</div><div>000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096</div><div>000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144</div><div>000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192</div><div>000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024</div><div>000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048</div><div>000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048</div><div>000 </div><div>000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0} </div><div>000 </div><div>000 "idc-dr/1x1": <a href="http://10.99.0.0/16===xx.xx.104.250" data-mce-href="http://10.99.0.0/16===xx.xx.104.250">10.99.0.0/16===xx.xx.104.250</a><xx.xx.104.250>...xx.xx.190.103<xx.xx.190.103>===<a href="http://192.168.30.0/24" data-mce-href="http://192.168.30.0/24">192.168.30.0/24</a>; unrouted; eroute owner: #0</div><div>000 "idc-dr/1x1": myip=unset; hisip=unset;</div><div>000 "idc-dr/1x1": ike_life: 86400s; ipsec_life: 86400s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 </div><div>000 "idc-dr/1x1": policy: PSK+ENCRYPT+COMPRESS+TUNNEL+PFS+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 16,24; interface: ; </div><div>000 "idc-dr/1x1": newest ISAKMP SA: #0; newest IPsec SA: #0; </div><div>000 "idc-dr/1x1": aliases: idc-dr </div><div>000 "idc-dr/1x1": IKE algorithms wanted: 3DES_CBC(5)_000-MD5(1)_000-MODP1536(5), 3DES_CBC(5)_000-MD5(1)_000-MODP1024(2); flags=-strict</div><div>000 "idc-dr/1x1": IKE algorithms found: 3DES_CBC(5)_192-MD5(1)_128-MODP1536(5)3DES_CBC(5)_192-MD5(1)_128-MODP1024(2)</div><div>000 "idc-dr/1x1": ESP algorithms wanted: 3DES(3)_000-MD5(1)_000; flags=-strict</div><div>000 "idc-dr/1x1": ESP algorithms loaded: 3DES(3)_192-MD5(1)_128</div><div>000 </div><div>000 </div><div>root@ip-10-99-0-240:~# </div><div><br></div><div><br></div><div><br></div><div>Can someone help please ? the third party who we've set this up with don't know anything other than cisco and I've read some inter-op issues with asa's ?</div><div><br></div><div>Thanks in advance.</div><div><br></div><div>Dan.</div></div></div><br>_______________________________________________<br> <a href="mailto:Users@lists.openswan.org" data-mce-href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a><br> <a href="https://lists.openswan.org/mailman/listinfo/users" data-mce-href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a><br> Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" data-mce-href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br> Building and Integrating Virtual Private Networks with Openswan:<br> <a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" data-mce-href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br> <br></blockquote></div><br></div></div></blockquote></div></body></html>