<div dir="ltr">Posting updated configuration, adding aggresive mode in accordance to info received. Suddenly I get an error about invalid hash information. Thought the parameters were correctly set...<div><br></div><div><b>ipsec auto --status</b><br><br><font face="monospace, monospace">000 "office": myip=unset; hisip=unset;<br>000 "office": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0<br>000 "office": policy: PSK+AUTHENTICATE+UP+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 32,24; interface: wlan0;<br>000 "office": newest ISAKMP SA: #0; newest IPsec SA: #0;<br>000 "office": IKE algorithms wanted: 3DES_CBC(5)_000-SHA1(2)_000-MODP1536(5); flags=-strict<br>000 "office": IKE algorithms found: 3DES_CBC(5)_192-SHA1(2)_160-MODP1536(5)<br>000 "office": AH algorithms wanted: SHA1(2)_000; pfsgroup=MODP1536(5); flags=-strict<br>000 "office": AH algorithms loaded: SHA1(2)_160<br>000 <br>000 #3: "office":500 STATE_AGGR_I1 (sent AI1, expecting AR1); none in -1s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate<br>000 #3: pending Phase 2 for "office" replacing #0</font><br><br><b>Trying to up the connection</b><br><br><font face="monospace, monospace">➜ /etc sudo ipsec auto --up office<br>112 "office" #1: STATE_AGGR_I1: initiate<br>003 "office" #1: received Vendor ID payload [Dead Peer Detection]<br>003 "office" #1: received Vendor ID payload [XAUTH]<br>003 "office" #1: ignoring unknown Vendor ID payload [8299031757a36082c6a621de00050282]<br>003 "office" #1: received Hash Payload does not match computed value<br>223 "office" #1: STATE_AGGR_I1: INVALID_HASH_INFORMATION</font><br><br><b>Updated config</b></div><div><b><br></b><font face="monospace, monospace">conn office<br> aggrmode=yes<br> left=%defaultroute<br> right=<vpn gateway><br> phase2=ah<br> phase2alg=sha1;modp1536<br> type=transport<br> ike=3des-sha1;modp1536<br><br> authby=secret<br> pfs=no<br> compress=no<br> keyingtries=%forever</font></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, May 1, 2015 at 3:04 PM, Hajder Rabiee <span dir="ltr"><<a href="mailto:hajderr@gmail.com" target="_blank">hajderr@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><span class=""><span style="font-size:13px">Hi</span><div style="font-size:13px"><br></div><div style="font-size:13px">In my secrets conf I already had</div><div style="font-size:13px"><div>%any <vpn ip> : PSK "key"</div><div><br></div><div>but after adding, it still didn't work </div><div><br></div><div>@mykey: PSK "key"</div></div><div style="font-size:13px"><br></div></span><div style="font-size:13px"><span class=""><div><font face="monospace, monospace">➜ ~ sudo ipsec auto --add office </font></div><div><font face="monospace, monospace">➜ ~ sudo ipsec auto --up office </font></div></span><div><div><img src="https://ssl.gstatic.com/ui/v1/icons/mail/images/cleardot.gif"></div></div><span class=""><div><span><div><font face="monospace, monospace">104 "office" #1: STATE_MAIN_I1: initiate</font></div><div><font face="monospace, monospace">003 "office" #1: received Vendor ID payload [Dead Peer Detection]</font></div><div><font face="monospace, monospace">003 "office" #1: ignoring unknown Vendor ID payload [8299031757a36082c6a621de00050282]</font></div><div><font face="monospace, monospace">106 "office" #1: STATE_MAIN_I2: sent MI2, expecting MR2</font></div><div><font face="monospace, monospace">108 "office" #1: STATE_MAIN_I3: sent MI3, expecting MR3</font></div><div><font face="monospace, monospace">003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3</font></div><div><font face="monospace, monospace">010 "office" #1: STATE_MAIN_I3: retransmission; will wait 20s for response</font></div><div><font face="monospace, monospace">003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3</font></div><div><font face="monospace, monospace">010 "office" #1: STATE_MAIN_I3: retransmission; will wait 40s for response</font></div><div><font face="monospace, monospace">031 "office" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message</font></div><div><font face="monospace, monospace">000 "office" #1: starting keying attempt 2 of an unlimited number, but releasing whack</font></div></span></div></span></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Fri, May 1, 2015 at 12:17 PM, Hajder Rabiee <span dir="ltr"><<a href="mailto:hajderr@gmail.com" target="_blank">hajderr@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi<div><br></div><div>In my secrets conf I already had</div><div><div>%any <vpn ip> : PSK "key"</div><div><br></div><div>but after adding, it still didn't work </div><div><br></div><div>@mykey: PSK "key"</div></div><div><br></div><div><div><font face="monospace, monospace">➜ ~ sudo ipsec auto --add office </font></div><div><font face="monospace, monospace">➜ ~ sudo ipsec auto --up office </font></div><span><div><font face="monospace, monospace">104 "office" #1: STATE_MAIN_I1: initiate</font></div><div><font face="monospace, monospace">003 "office" #1: received Vendor ID payload [Dead Peer Detection]</font></div><div><font face="monospace, monospace">003 "office" #1: ignoring unknown Vendor ID payload [8299031757a36082c6a621de00050282]</font></div><div><font face="monospace, monospace">106 "office" #1: STATE_MAIN_I2: sent MI2, expecting MR2</font></div><div><font face="monospace, monospace">108 "office" #1: STATE_MAIN_I3: sent MI3, expecting MR3</font></div><div><font face="monospace, monospace">003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3</font></div><div><font face="monospace, monospace">010 "office" #1: STATE_MAIN_I3: retransmission; will wait 20s for response</font></div><div><font face="monospace, monospace">003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3</font></div><div><font face="monospace, monospace">010 "office" #1: STATE_MAIN_I3: retransmission; will wait 40s for response</font></div><div><font face="monospace, monospace">031 "office" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message</font></div><div><font face="monospace, monospace">000 "office" #1: starting keying attempt 2 of an unlimited number, but releasing whack</font></div></span></div><div><div><div><br></div><div><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, May 1, 2015 at 10:47 AM, Paul Young <span dir="ltr"><<a href="mailto:paul@arkig.com" target="_blank">paul@arkig.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">I think - not entirely sure!<div><br></div><div>you need a leftid to tie in your secret key.</div><div><br></div><div>So in the conn:</div><div><br></div><div><div><i>leftid=@something</i></div></div><div><br></div><div>and then in the secret file:</div><div><br></div><div><i>@something: PSK "<blah>"</i><br></div><div><br></div><div>Cheers,</div><div>Paul Young</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div>On 1 May 2015 at 17:17, Hajder Rabiee <span dir="ltr"><<a href="mailto:hajderr@gmail.com" target="_blank">hajderr@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div><div dir="ltr">Hi<div><br></div><div>Trying to setup a VPN connection to Office Fortigate but I can't pass phase 2.</div><div><br></div><div>Received info from sysadmins:</div><div><br></div><div><ul><li>PSK<br></li><li>IKE v1<br></li><li>Aggressive mode<br><br></li><li>Phase1 3DES-SHA1<br></li><li>DH group 5<br></li><li>Key lifetime 28800<br><br></li><li>XAUTH PAP Server (not sure if this necessary to know)<br><br></li><li>Phase2 3DES-SHA1<br></li><li>PFS no<br></li></ul></div><div><br></div><div><br></div><div><b>This is one of many configuration attempts, I've tried adding/removing different parameters.</b></div><div><br></div><div><div><font face="monospace, monospace">config setup</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>interfaces=%defaultroute</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>plutodebug="control parsing"</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>#klipsdebug=all</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>plutoopts="--interface=wlan0"</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>dumpdir=/var/run/pluto/</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>nat_traversal=no</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10" target="_blank">10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10</a></font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>oe=off</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span>protostack=netkey</font></div><div><br></div><div><font face="monospace, monospace">conn office </font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> left=%defaultroute</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> right=<my gateway ip></font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> phase2=ah</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> phase2alg=sha1;modp1536</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> type=transport</font></div><div><span style="white-space:pre-wrap"><font face="monospace, monospace"> </font></span></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> authby=secret</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> pfs=no</font></div><div><font face="monospace, monospace"><span style="white-space:pre-wrap"> </span> compress=no</font></div><div><font face="monospace, monospace"> <span style="white-space:pre-wrap"> </span>keyingtries=%forever</font></div></div><div><br></div><div><b>This is the output</b></div><div><div>➜ /etc sudo service ipsec restart </div><div>➜ /etc sudo ipsec auto --add office && sudo ipsec auto --up office</div><div>104 "office" #1: STATE_MAIN_I1: initiate</div><div>003 "office" #1: received Vendor ID payload [Dead Peer Detection]</div><div>003 "office" #1: ignoring unknown Vendor ID payload [8299031757a36082c6a621de00050282]</div><div>106 "office" #1: STATE_MAIN_I2: sent MI2, expecting MR2</div><div>108 "office" #1: STATE_MAIN_I3: sent MI3, expecting MR3</div><div>003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3</div><div>010 "office" #1: STATE_MAIN_I3: retransmission; will wait 20s for response</div><div>003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3</div><div>010 "office" #1: STATE_MAIN_I3: retransmission; will wait 40s for response</div><div>031 "office" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message</div><div>000 "office" #1: starting keying attempt 2 of an unlimited number, but releasing whack</div></div><span><font color="#888888"><div><br></div><div><br></div><div><br></div><div><br clear="all"><div><br></div>-- <br><div>Med vänliga hälsningar / Best Regards<div>Hajder</div></div>
</div></font></span></div>
<br></div></div>_______________________________________________<br>
<a href="mailto:Users@lists.openswan.org" target="_blank">Users@lists.openswan.org</a><br>
<a href="https://lists.openswan.org/mailman/listinfo/users" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a><br>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
<br></blockquote></div><br></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div>Med vänliga hälsningar / Best Regards<div>Hajder</div></div>
</div></div></div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div>Med vänliga hälsningar / Best Regards<div>Hajder</div></div>
</div>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">Med vänliga hälsningar / Best Regards<div>Hajder</div></div>
</div>