<html><body>
<p><font size="2" face="sans-serif">Would appreciate some help with my questions. All my servers are RHELl6.x86_64 virtual machines.</font><br>
<br>
<font size="2" face="sans-serif">I have an apache web server that I want to establish IPsec tunnels with "n" number of backend servers. Lets call the apache server "A" (IP 10.60.87.6) and the backend server "B" (IP 10.62.66.49).</font><br>
<font size="2" face="sans-serif">One "A" I have my /etc/ipsec.d/gateway.conf as follows..</font><br>
<font size="2" face="sans-serif">conn gateway-conn</font><br>
<font size="2" face="sans-serif"> type=transport</font><br>
<font size="2" face="sans-serif"> authby=secret</font><br>
<font size="2" face="sans-serif"> left=10.60.87.6</font><br>
<font size="2" face="sans-serif"> right=%any</font><br>
<font size="2" face="sans-serif"> pfs=yes</font><br>
<font size="2" face="sans-serif"> auto=add</font><br>
<br>
<font size="2" face="sans-serif">with a /etc/ipsec.d/gateway.secrets as follows..</font><br>
<font size="2" face="sans-serif">10.60.87.6 %any: "mybigsecret"</font><br>
<br>
<font size="2" face="sans-serif">One "B" I have my /etc/ipsec.d/gateway1.conf as follows..</font><br>
<font size="2" face="sans-serif">conn gateway1-conn</font><br>
<font size="2" face="sans-serif"> type=transport</font><br>
<font size="2" face="sans-serif"> authby=secret</font><br>
<font size="2" face="sans-serif"> right=10.62.66.49</font><br>
<font size="2" face="sans-serif"> left=10.60.87.6</font><br>
<font size="2" face="sans-serif"> pfs=yes</font><br>
<font size="2" face="sans-serif"> auto=up</font><br>
<br>
<font size="2" face="sans-serif">with a /etc/ipsec.d/gateway1.secrets as follows..</font><br>
<font size="2" face="sans-serif">10.60.87.6 %any: "mybigsecret"</font><br>
<br>
<font size="2" face="sans-serif">I cannot ping "B" from "A" or vice versa. </font><br>
<br>
<font size="2" face="sans-serif">On "A" an "ipsec auto status" shows...</font><br>
<font size="2" face="sans-serif">000 "gateway-conn": 10.60.87.6<10.60.87.6>[+S=C]...%any[+S=C]; unrouted; eroute owner: #0</font><br>
<font size="2" face="sans-serif">000 "gateway-conn": myip=unset; hisip=unset;</font><br>
<font size="2" face="sans-serif">000 "gateway-conn": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; nat_keepalive: yes </font><br>
<font size="2" face="sans-serif">000 "gateway-conn": policy: PSK+ENCRYPT+PFS+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 32,32; interface: eth0; </font><br>
<font size="2" face="sans-serif">000 "gateway-conn": newest ISAKMP SA: #0; newest IPsec SA: #0; </font><br>
<font size="2" face="sans-serif">000 "gateway-conn"[22]: 10.60.87.6<10.60.87.6>[+S=C]...10.62.66.49[+S=C]; unrouted; eroute owner: #0</font><br>
<font size="2" face="sans-serif">000 "gateway-conn"[22]: myip=unset; hisip=unset;</font><br>
<font size="2" face="sans-serif">000 "gateway-conn"[22]: ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; nat_keepalive: yes </font><br>
<font size="2" face="sans-serif">000 "gateway-conn"[22]: policy: PSK+ENCRYPT+PFS+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 32,32; interface: eth0; </font><br>
<font size="2" face="sans-serif">000 "gateway-conn"[22]: newest ISAKMP SA: #0; newest IPsec SA: #0; </font><br>
<font size="2" face="sans-serif">000 </font><br>
<font size="2" face="sans-serif">000 #44: "gateway-conn"[22] 10.62.66.49:500 STATE_MAIN_R2 (sent MR2, expecting MI3); EVENT_RETRANSMIT in 27s; lastdpd=-1s(seq in:0 out:0); idle; import:not set</font><br>
<br>
<font size="2" face="sans-serif">and /var/log/secure shows...</font><br>
<font size="2" face="sans-serif">2015-06-01T15:09:12.148880-05:00 gw11 pluto[19853]: "gateway-conn"[22] 10.62.66.49 #46: sending notification PAYLOAD_MALFORMED to 10.62.66.49:500</font><br>
<font size="2" face="sans-serif">2015-06-01T15:09:32.166369-05:00 gw11 pluto[19853]: "gateway-conn"[22] 10.62.66.49 #46: next payload type of ISAKMP Identification Payload has an unknown value: 140</font><br>
<font size="2" face="sans-serif">2015-06-01T15:09:32.166402-05:00 gw11 pluto[19853]: "gateway-conn"[22] 10.62.66.49 #46: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet</font><br>
<font size="2" face="sans-serif">2015-06-01T15:09:32.166413-05:00 gw11 pluto[19853]: | payload malformed after IV</font><br>
<font size="2" face="sans-serif">2015-06-01T15:09:32.166434-05:00 gw11 pluto[19853]: | ef e3 e5 65 2a 8f eb a2 f7 7e 02 7e 81 0f 85 01</font><br>
<font size="2" face="sans-serif">2015-06-01T15:09:32.166444-05:00 gw11 pluto[19853]: | e6 89 ec 98</font><br>
<font size="2" face="sans-serif">2015-06-01T15:09:32.166453-05:00 gw11 pluto[19853]: "gateway-conn"[22] 10.62.66.49 #46: sending notification PAYLOAD_MALFORMED to 10.62.66.49:500</font><br>
<br>
<br>
<font size="2" face="sans-serif">On "B" an "ipsec auto status" shows...</font><br>
<font size="2" face="sans-serif">000 #46: "gateway1-conn":500 STATE_MAIN_I3 (sent MI3, expecting MR3); EVENT_RETRANSMIT in 6s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate</font><br>
<font size="2" face="sans-serif">000 #46: pending Phase 2 for "gateway1-conn" replacing #0</font><br>
<br>
<font size="2" face="sans-serif">and /var/log/secure shows...</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #46: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #46: starting keying attempt 42 of an unlimited number</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: initiating Main Mode to replace #46</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: received Vendor ID payload [Openswan (this version) 2.6.32 ]</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: received Vendor ID payload [Dead Peer Detection]</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: received Vendor ID payload [RFC 3947] method set to=109 </font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: enabling possible NAT-traversal with method 4</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: STATE_MAIN_I2: sent MI2, expecting MR2</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: I will NOT send an initial contact payload</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: Not sending INITIAL_CONTACT</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: STATE_MAIN_I3: sent MI3, expecting MR3</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:32 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: received 1 malformed payload notifies</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:42 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: discarding duplicate packet; already STATE_MAIN_I3</font><br>
<font size="2" face="sans-serif">Jun 1 15:05:42 SIDR36APMXGREEN-3a7 pluto[29896]: "gateway1-conn" #47: received 2 malformed payload notifies</font><br>
<br>
<font size="2" face="sans-serif">What could be causing the " sending notification PAYLOAD_MALFORMED to 10.62.66.49:500" error on "A"? </font><br>
<font size="2" face="sans-serif">What about the "pending Phase 2 for gateway1-conn replacing #0" message?</font><br>
<font size="2" face="sans-serif">Do you see anything wrong with my configuration?</font><br>
<br>
<font size="2" face="sans-serif">One mystery is this sometimes works and other times it does not. It intermittently works and when it gets in this state I cannot recover it.</font><br>
<br>
<font size="2" face="sans-serif">Your help would be greatly appreciated.</font><br>
<br>
<font size="2" face="sans-serif">Thanks</font><br>
<br>
<font size="2" face="sans-serif">Jesse N. Perez<br>
IBM Software Group | Cloud and Smarter Infrastructure Division<br>
(352) 341-3872 | perezje@us.ibm.com<br>
</font></body></html>