<div dir="ltr"><span style="font-size:13px">Hi</span><div style="font-size:13px"><br></div><div style="font-size:13px">In my secrets conf I already had</div><div style="font-size:13px"><div>%any <vpn ip> : PSK "key"</div><div><br></div><div>but after adding, it still didn't work </div><div><br></div><div>@mykey: PSK "key"</div></div><div style="font-size:13px"><br></div><div style="font-size:13px"><div><font face="monospace, monospace">➜ ~ sudo ipsec auto --add office </font></div><div><font face="monospace, monospace">➜ ~ sudo ipsec auto --up office </font></div><div class=""><div id=":1n9" class="" tabindex="0"><img class="" src="https://ssl.gstatic.com/ui/v1/icons/mail/images/cleardot.gif"></div></div><div class=""><span class="im"><div><font face="monospace, monospace">104 "office" #1: STATE_MAIN_I1: initiate</font></div><div><font face="monospace, monospace">003 "office" #1: received Vendor ID payload [Dead Peer Detection]</font></div><div><font face="monospace, monospace">003 "office" #1: ignoring unknown Vendor ID payload [8299031757a36082c6a621de00050282]</font></div><div><font face="monospace, monospace">106 "office" #1: STATE_MAIN_I2: sent MI2, expecting MR2</font></div><div><font face="monospace, monospace">108 "office" #1: STATE_MAIN_I3: sent MI3, expecting MR3</font></div><div><font face="monospace, monospace">003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3</font></div><div><font face="monospace, monospace">010 "office" #1: STATE_MAIN_I3: retransmission; will wait 20s for response</font></div><div><font face="monospace, monospace">003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3</font></div><div><font face="monospace, monospace">010 "office" #1: STATE_MAIN_I3: retransmission; will wait 40s for response</font></div><div><font face="monospace, monospace">031 "office" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message</font></div><div><font face="monospace, monospace">000 "office" #1: starting keying attempt 2 of an unlimited number, but releasing whack</font></div></span></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, May 1, 2015 at 12:17 PM, Hajder Rabiee <span dir="ltr"><<a href="mailto:hajderr@gmail.com" target="_blank">hajderr@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi<div><br></div><div>In my secrets conf I already had</div><div><div>%any <vpn ip> : PSK "key"</div><div><br></div><div>but after adding, it still didn't work </div><div><br></div><div>@mykey: PSK "key"</div></div><div><br></div><div><div><font face="monospace, monospace">➜ ~ sudo ipsec auto --add office </font></div><div><font face="monospace, monospace">➜ ~ sudo ipsec auto --up office </font></div><span class=""><div><font face="monospace, monospace">104 "office" #1: STATE_MAIN_I1: initiate</font></div><div><font face="monospace, monospace">003 "office" #1: received Vendor ID payload [Dead Peer Detection]</font></div><div><font face="monospace, monospace">003 "office" #1: ignoring unknown Vendor ID payload [8299031757a36082c6a621de00050282]</font></div><div><font face="monospace, monospace">106 "office" #1: STATE_MAIN_I2: sent MI2, expecting MR2</font></div><div><font face="monospace, monospace">108 "office" #1: STATE_MAIN_I3: sent MI3, expecting MR3</font></div><div><font face="monospace, monospace">003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3</font></div><div><font face="monospace, monospace">010 "office" #1: STATE_MAIN_I3: retransmission; will wait 20s for response</font></div><div><font face="monospace, monospace">003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3</font></div><div><font face="monospace, monospace">010 "office" #1: STATE_MAIN_I3: retransmission; will wait 40s for response</font></div><div><font face="monospace, monospace">031 "office" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message</font></div><div><font face="monospace, monospace">000 "office" #1: starting keying attempt 2 of an unlimited number, but releasing whack</font></div></span></div><div><div class="h5"><div><br></div><div><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, May 1, 2015 at 10:47 AM, Paul Young <span dir="ltr"><<a href="mailto:paul@arkig.com" target="_blank">paul@arkig.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">I think - not entirely sure!<div><br></div><div>you need a leftid to tie in your secret key.</div><div><br></div><div>So in the conn:</div><div><br></div><div><div><i>leftid=@something</i></div></div><div><br></div><div>and then in the secret file:</div><div><br></div><div><i>@something: PSK "<blah>"</i><br></div><div><br></div><div>Cheers,</div><div>Paul Young</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div>On 1 May 2015 at 17:17, Hajder Rabiee <span dir="ltr"><<a href="mailto:hajderr@gmail.com" target="_blank">hajderr@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div><div dir="ltr">Hi<div><br></div><div>Trying to setup a VPN connection to Office Fortigate but I can't pass phase 2.</div><div><br></div><div>Received info from sysadmins:</div><div><br></div><div><ul><li>PSK<br></li><li>IKE v1<br></li><li>Aggressive mode<br><br></li><li>Phase1 3DES-SHA1<br></li><li>DH group 5<br></li><li>Key lifetime 28800<br><br></li><li>XAUTH PAP Server (not sure if this necessary to know)<br><br></li><li>Phase2 3DES-SHA1<br></li><li>PFS no<br></li></ul></div><div><br></div><div><br></div><div><b>This is one of many configuration attempts, I've tried adding/removing different parameters.</b></div><div><br></div><div><div><font face="monospace, monospace">config setup</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>interfaces=%defaultroute</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>plutodebug="control parsing"</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>#klipsdebug=all</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>plutoopts="--interface=wlan0"</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>dumpdir=/var/run/pluto/</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>nat_traversal=no</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10" target="_blank">10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10</a></font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>oe=off</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>protostack=netkey</font></div><div><br></div><div><font face="monospace, monospace">conn office </font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> left=%defaultroute</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> right=<my gateway ip></font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> phase2=ah</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> phase2alg=sha1;modp1536</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> type=transport</font></div><div><span style="white-space:pre-wrap"><font face="monospace, monospace"> </font></span></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> authby=secret</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> pfs=no</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> compress=no</font></div><div><font face="monospace, monospace"> <span style="white-space:pre-wrap"> </span>keyingtries=%forever</font></div></div><div><br></div><div><b>This is the output</b></div><div><div>➜ /etc sudo service ipsec restart </div><div>➜ /etc sudo ipsec auto --add office && sudo ipsec auto --up office</div><div>104 "office" #1: STATE_MAIN_I1: initiate</div><div>003 "office" #1: received Vendor ID payload [Dead Peer Detection]</div><div>003 "office" #1: ignoring unknown Vendor ID payload [8299031757a36082c6a621de00050282]</div><div>106 "office" #1: STATE_MAIN_I2: sent MI2, expecting MR2</div><div>108 "office" #1: STATE_MAIN_I3: sent MI3, expecting MR3</div><div>003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3</div><div>010 "office" #1: STATE_MAIN_I3: retransmission; will wait 20s for response</div><div>003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3</div><div>010 "office" #1: STATE_MAIN_I3: retransmission; will wait 40s for response</div><div>031 "office" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message</div><div>000 "office" #1: starting keying attempt 2 of an unlimited number, but releasing whack</div></div><span><font color="#888888"><div><br></div><div><br></div><div><br></div><div><br clear="all"><div><br></div>-- <br><div>Med vänliga hälsningar / Best Regards<div>Hajder</div></div>
</div></font></span></div>
<br></div></div>_______________________________________________<br>
<a href="mailto:Users@lists.openswan.org" target="_blank">Users@lists.openswan.org</a><br>
<a href="https://lists.openswan.org/mailman/listinfo/users" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a><br>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
<br></blockquote></div><br></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div>Med vänliga hälsningar / Best Regards<div>Hajder</div></div>
</div></div></div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">Med vänliga hälsningar / Best Regards<div>Hajder</div></div>
</div>