<div dir="ltr"><div><div>I currently have two Amazon VPC clouds setup, each has a nat gateway/firewall and I've setup a vpn server in the public subnet for each VPC and NAT'd UDP500/4500. I've setup both servers (configs below) and it seems as though the tunnel is up, but when I try to ping the private IP of the other server, it doesn't work. Any suggestions?</div><div><br></div><div>VPC1 (<a href="http://10.10.0.0/16">10.10.0.0/16</a>) (external IP x.x.x.x)</div><div>config setup</div><div> klipsdebug=none</div><div> plutodebug=none</div><div> plutostderrlog=/var/log/pluto.log</div><div> protostack=netkey</div><div> nat_traversal=yes</div><div> virtual_private=%v4:<a href="http://10.10.0.0/16,%v4:!192.168.0.0/24">10.10.0.0/16,%v4:!192.168.0.0/24</a></div><div> oe=off</div><div>conn site-to-site</div><div> auto=start</div><div> type=tunnel</div><div> left=10.10.10.43</div><div> leftsourceip=x.x.x.x</div><div> leftsubnet=<a href="http://10.10.0.0/16">10.10.0.0/16</a></div><div> leftid=x.x.x.x</div><div> right=y.y.y.y</div><div> rightsubnet=<a href="http://192.168.0.0/24">192.168.0.0/24</a></div><div> rightid=y.y.y.y</div><div> #phase 1 encryption-integrity-DiffieHellman</div><div> keyexchange=ike</div><div> ike=3des-md5-modp1024,aes256-sha1-modp1024</div><div> ikelifetime=86400s</div><div> authby=secret #use presharedkey</div><div> rekey=yes #should we rekey when key lifetime is about to expire</div><div> #phase 2 encryption-pfsgroup</div><div> phase2=esp #esp for encryption | ah for authentication only</div><div> phase2alg=3des-md5;modp1024</div><div> pfs=no</div><div> forceencaps=yes</div><div><br></div><div>VPC2 (<a href="http://192.168.0.0/24">192.168.0.0/24</a>) (external IP y.y.y.y)</div><div>config setup</div><div> klipsdebug=none</div><div> plutodebug=none</div><div> plutostderrlog=/var/log/pluto.log</div><div> protostack=netkey</div><div> nat_traversal=yes</div><div> virtual_private=%v4:<a href="http://192.168.0.0/24,%v4:!10.10.0.0/16">192.168.0.0/24,%v4:!10.10.0.0/16</a></div><div> oe=off</div><div>conn site-to-site</div><div> auto=start</div><div> type=tunnel</div><div> left=192.168.0.22</div><div> leftsourceip=y.y.y.y</div><div> leftsubnet=<a href="http://192.168.0.0/24">192.168.0.0/24</a></div><div> leftid=y.y.y.y</div><div> right=x.x.x.x</div><div> rightsubnet=<a href="http://10.10.0.0/16">10.10.0.0/16</a></div><div> rightid=x.x.x.x</div><div> #phase 1 encryption-integrity-DiffieHellman</div><div> keyexchange=ike</div><div> ike=3des-md5-modp1024,aes256-sha1-modp1024</div><div> ikelifetime=86400s</div><div> authby=secret #use presharedkey</div><div> rekey=yes #should we rekey when key lifetime is about to expire</div><div> #phase 2 encryption-pfsgroup</div><div> phase2=esp #esp for encryption | ah for authentication only</div><div> phase2alg=3des-md5;modp1024</div><div> pfs=no</div><div> forceencaps=yes</div><div><br></div><div>Output of "service ipsec status" shows 2 tunnels up on both sides</div><div><br></div><div>IPsec running - pluto pid: 19702</div><div>pluto pid 19702</div><div>2 tunnels up</div><div>some eroutes exist</div><div><br></div><div>VPC1 log</div><div>adjusting ipsec.d to /etc/ipsec.d</div><div>nss directory plutomain: /etc/ipsec.d</div><div>NSS Initialized</div><div>Non-fips mode set in /proc/sys/crypto/fips_enabled</div><div>Starting Pluto (Openswan Version 2.6.37; Vendor ID OEu\134d\134jy\134\134ap) pid:19702</div><div>Non-fips mode set in /proc/sys/crypto/fips_enabled</div><div>LEAK_DETECTIVE support [disabled]</div><div>OCF support for IKE [disabled]</div><div>SAref support [disabled]: Protocol not available</div><div>SAbind support [disabled]: Protocol not available</div><div>NSS support [enabled]</div><div>HAVE_STATSD notification support not compiled in</div><div>Setting NAT-Traversal port-4500 floating to on</div><div> port floating activation criteria nat_t=1/port_float=1</div><div> NAT-Traversal support [enabled]</div><div>ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)</div><div>starting up 1 cryptographic helpers</div><div>started helper (thread) pid=140413867869952 (fd:7)</div><div>Using Linux 2.6 IPsec interface code on 3.14.44-32.39.amzn1.x86_64 (experimental code)</div><div>ike_alg_register_enc(): Activating aes_ccm_8: Ok (ret=0)</div><div>ike_alg_add(): ERROR: Algorithm already exists</div><div>ike_alg_register_enc(): Activating aes_ccm_12: FAILED (ret=-17)</div><div>ike_alg_add(): ERROR: Algorithm already exists</div><div>ike_alg_register_enc(): Activating aes_ccm_16: FAILED (ret=-17)</div><div>ike_alg_add(): ERROR: Algorithm already exists</div><div>ike_alg_register_enc(): Activating aes_gcm_8: FAILED (ret=-17)</div><div>ike_alg_add(): ERROR: Algorithm already exists</div><div>ike_alg_register_enc(): Activating aes_gcm_12: FAILED (ret=-17)</div><div>ike_alg_add(): ERROR: Algorithm already exists</div><div>ike_alg_register_enc(): Activating aes_gcm_16: FAILED (ret=-17)</div><div>Could not change to directory '/etc/ipsec.d/cacerts': /</div><div>Could not change to directory '/etc/ipsec.d/aacerts': /</div><div>Could not change to directory '/etc/ipsec.d/ocspcerts': /</div><div>Could not change to directory '/etc/ipsec.d/crls'</div><div>Non-fips mode set in /proc/sys/crypto/fips_enabled</div><div>Non-fips mode set in /proc/sys/crypto/fips_enabled</div><div>Non-fips mode set in /proc/sys/crypto/fips_enabled</div><div>added connection description "site-to-site"</div><div>listening for IKE messages</div><div>adding interface eth0/eth0 <a href="http://10.10.10.43:500">10.10.10.43:500</a></div><div>adding interface eth0/eth0 <a href="http://10.10.10.43:4500">10.10.10.43:4500</a></div><div>adding interface lo/lo <a href="http://127.0.0.1:500">127.0.0.1:500</a></div><div>adding interface lo/lo <a href="http://127.0.0.1:4500">127.0.0.1:4500</a></div><div>adding interface lo/lo ::1:500</div><div>loading secrets from "/etc/ipsec.secrets"</div><div>loaded private key for keyid: PPK_RSA:AQPBMnX+l</div><div>loading secrets from "/etc/ipsec.d/site-to-site.secrets"</div><div>"site-to-site" #1: initiating Main Mode</div><div>"site-to-site" #1: received Vendor ID payload [Openswan (this version) 2.6.37 ]</div><div>"site-to-site" #1: received Vendor ID payload [Dead Peer Detection]</div><div>"site-to-site" #1: received Vendor ID payload [RFC 3947] method set to=109 </div><div>"site-to-site" #1: enabling possible NAT-traversal with method 4</div><div>"site-to-site" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2</div><div>"site-to-site" #1: STATE_MAIN_I2: sent MI2, expecting MR2</div><div>"site-to-site" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): both are NATed</div><div>"site-to-site" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3</div><div>"site-to-site" #1: STATE_MAIN_I3: sent MI3, expecting MR3</div><div>"site-to-site" #1: received Vendor ID payload [CAN-IKEv2]</div><div>"site-to-site" #1: Main mode peer ID is ID_IPV4_ADDR: 'y.y.y.y'</div><div>"site-to-site" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4</div><div>"site-to-site" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}</div><div>"site-to-site" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:3bd3e66f proposal=3DES(3)_192-MD5(1)_128 pfsgroup=no-pfs}</div><div>"site-to-site" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2</div><div>"site-to-site" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP/NAT=>0x11221f07 <0xa08c7912 xfrm=3DES_0-HMAC_MD5 NATOA=none NATD=y.y.y.y:4500 DPD=none}</div><div>packet from y.y.y.y:500: received Vendor ID payload [Openswan (this version) 2.6.37 ]</div><div>packet from y.y.y.y:500: received Vendor ID payload [Dead Peer Detection]</div><div>packet from y.y.y.y:500: received Vendor ID payload [RFC 3947] method set to=109 </div><div>packet from y.y.y.y:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109</div><div>packet from y.y.y.y:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 109</div><div>packet from y.y.y.y:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109</div><div>packet from y.y.y.y:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]</div><div>"site-to-site" #3: responding to Main Mode</div><div>"site-to-site" #3: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1</div><div>"site-to-site" #3: STATE_MAIN_R1: sent MR1, expecting MI2</div><div>"site-to-site" #3: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): both are NATed</div><div>"site-to-site" #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2</div><div>"site-to-site" #3: STATE_MAIN_R2: sent MR2, expecting MI3</div><div>"site-to-site" #3: Main mode peer ID is ID_IPV4_ADDR: 'y.y.y.y'</div><div>"site-to-site" #3: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3</div><div>"site-to-site" #3: new NAT mapping for #3, was y.y.y.y:500, now y.y.y.y:4500</div><div>"site-to-site" #3: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}</div><div>"site-to-site" #3: the peer proposed: <a href="http://10.10.0.0/16:0/0">10.10.0.0/16:0/0</a> -> <a href="http://192.168.0.0/24:0/0">192.168.0.0/24:0/0</a></div><div>"site-to-site" #4: responding to Quick Mode proposal {msgid:ee8d0a53}</div><div>"site-to-site" #4: us: <a href="http://10.10.0.0/16===10.10.10.43">10.10.0.0/16===10.10.10.43</a><10.10.10.43>[x.x.x.x,+S=C]</div><div>"site-to-site" #4: them: y.y.y.y<y.y.y.y>[+S=C]===<a href="http://192.168.0.0/24">192.168.0.0/24</a></div><div>"site-to-site" #4: keeping refhim=4294901761 during rekey</div><div>"site-to-site" #4: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1</div><div>"site-to-site" #4: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2</div><div>"site-to-site" #4: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2</div><div>"site-to-site" #4: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP/NAT=>0x82e90be9 <0x0e8a4136 xfrm=3DES_0-HMAC_MD5 NATOA=none NATD=y.y.y.y:4500 DPD=none}</div><div><br></div><div><br></div><div>VPC2 log</div><div>adjusting ipsec.d to /etc/ipsec.d</div><div>nss directory plutomain: /etc/ipsec.d</div><div>NSS Initialized</div><div>Non-fips mode set in /proc/sys/crypto/fips_enabled</div><div>Starting Pluto (Openswan Version 2.6.37; Vendor ID OEu\134d\134jy\134\134ap) pid:28146</div><div>Non-fips mode set in /proc/sys/crypto/fips_enabled</div><div>LEAK_DETECTIVE support [disabled]</div><div>OCF support for IKE [disabled]</div><div>SAref support [disabled]: Protocol not available</div><div>SAbind support [disabled]: Protocol not available</div><div>NSS support [enabled]</div><div>HAVE_STATSD notification support not compiled in</div><div>Setting NAT-Traversal port-4500 floating to on</div><div> port floating activation criteria nat_t=1/port_float=1</div><div> NAT-Traversal support [enabled]</div><div>ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)</div><div>starting up 1 cryptographic helpers</div><div>started helper (thread) pid=140498468075264 (fd:7)</div><div>Using Linux 2.6 IPsec interface code on 3.14.35-28.38.amzn1.x86_64 (experimental code)</div><div>ike_alg_register_enc(): Activating aes_ccm_8: Ok (ret=0)</div><div>ike_alg_add(): ERROR: Algorithm already exists</div><div>ike_alg_register_enc(): Activating aes_ccm_12: FAILED (ret=-17)</div><div>ike_alg_add(): ERROR: Algorithm already exists</div><div>ike_alg_register_enc(): Activating aes_ccm_16: FAILED (ret=-17)</div><div>ike_alg_add(): ERROR: Algorithm already exists</div><div>ike_alg_register_enc(): Activating aes_gcm_8: FAILED (ret=-17)</div><div>ike_alg_add(): ERROR: Algorithm already exists</div><div>ike_alg_register_enc(): Activating aes_gcm_12: FAILED (ret=-17)</div><div>ike_alg_add(): ERROR: Algorithm already exists</div><div>ike_alg_register_enc(): Activating aes_gcm_16: FAILED (ret=-17)</div><div>Could not change to directory '/etc/ipsec.d/cacerts': /</div><div>Could not change to directory '/etc/ipsec.d/aacerts': /</div><div>Could not change to directory '/etc/ipsec.d/ocspcerts': /</div><div>Could not change to directory '/etc/ipsec.d/crls'</div><div>Non-fips mode set in /proc/sys/crypto/fips_enabled</div><div>Non-fips mode set in /proc/sys/crypto/fips_enabled</div><div>Non-fips mode set in /proc/sys/crypto/fips_enabled</div><div>added connection description "site-to-site"</div><div>listening for IKE messages</div><div>adding interface eth0/eth0 <a href="http://192.168.0.22:500">192.168.0.22:500</a></div><div>adding interface eth0/eth0 <a href="http://192.168.0.22:4500">192.168.0.22:4500</a></div><div>adding interface lo/lo <a href="http://127.0.0.1:500">127.0.0.1:500</a></div><div>adding interface lo/lo <a href="http://127.0.0.1:4500">127.0.0.1:4500</a></div><div>adding interface lo/lo ::1:500</div><div>loading secrets from "/etc/ipsec.secrets"</div><div>loaded private key for keyid: PPK_RSA:AQOYRIj+s</div><div>loading secrets from "/etc/ipsec.d/site-to-site.secrets"</div><div>"site-to-site" #1: initiating Main Mode</div><div>"site-to-site" #1: ERROR: asynchronous network error report on eth0 (sport=500) for message to x.x.x.x port 500, complainant x.x.x.x: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]</div><div>packet from x.x.x.x:500: received Vendor ID payload [Openswan (this version) 2.6.37 ]</div><div>packet from x.x.x.x:500: received Vendor ID payload [Dead Peer Detection]</div><div>packet from x.x.x.x:500: received Vendor ID payload [RFC 3947] method set to=109 </div><div>packet from x.x.x.x:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109</div><div>packet from x.x.x.x:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 109</div><div>packet from x.x.x.x:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109</div><div>packet from x.x.x.x:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]</div><div>"site-to-site" #2: responding to Main Mode</div><div>"site-to-site" #2: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1</div><div>"site-to-site" #2: STATE_MAIN_R1: sent MR1, expecting MI2</div><div>"site-to-site" #2: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): both are NATed</div><div>"site-to-site" #2: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2</div><div>"site-to-site" #2: STATE_MAIN_R2: sent MR2, expecting MI3</div><div>"site-to-site" #2: Main mode peer ID is ID_IPV4_ADDR: 'x.x.x.x'</div><div>"site-to-site" #2: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3</div><div>"site-to-site" #2: new NAT mapping for #2, was x.x.x.x:500, now x.x.x.x:4500</div><div>"site-to-site" #2: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}</div><div>"site-to-site" #2: the peer proposed: <a href="http://192.168.0.0/24:0/0">192.168.0.0/24:0/0</a> -> <a href="http://10.10.0.0/16:0/0">10.10.0.0/16:0/0</a></div><div>"site-to-site" #3: responding to Quick Mode proposal {msgid:3bd3e66f}</div><div>"site-to-site" #3: us: <a href="http://192.168.0.0/24===192.168.0.22">192.168.0.0/24===192.168.0.22</a><192.168.0.22>[y.y.y.y,+S=C]</div><div>"site-to-site" #3: them: x.x.x.x<x.x.x.x>[+S=C]===<a href="http://10.10.0.0/16">10.10.0.0/16</a></div><div>"site-to-site" #3: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1</div><div>"site-to-site" #3: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2</div><div>"site-to-site" #3: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2</div><div>"site-to-site" #3: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP/NAT=>0xa08c7912 <0x11221f07 xfrm=3DES_0-HMAC_MD5 NATOA=none NATD=x.x.x.x:4500 DPD=none}</div><div>"site-to-site" #1: received Vendor ID payload [Openswan (this version) 2.6.37 ]</div><div>"site-to-site" #1: received Vendor ID payload [Dead Peer Detection]</div><div>"site-to-site" #1: received Vendor ID payload [RFC 3947] method set to=109 </div><div>"site-to-site" #1: enabling possible NAT-traversal with method 4</div><div>"site-to-site" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2</div><div>"site-to-site" #1: STATE_MAIN_I2: sent MI2, expecting MR2</div><div>"site-to-site" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): both are NATed</div><div>"site-to-site" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3</div><div>"site-to-site" #1: STATE_MAIN_I3: sent MI3, expecting MR3</div><div>"site-to-site" #1: received Vendor ID payload [CAN-IKEv2]</div><div>"site-to-site" #1: Main mode peer ID is ID_IPV4_ADDR: 'x.x.x.x'</div><div>"site-to-site" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4</div><div>"site-to-site" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}</div><div>"site-to-site" #4: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:ee8d0a53 proposal=3DES(3)_192-MD5(1)_128 pfsgroup=no-pfs}</div><div>"site-to-site" #4: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2</div><div>"site-to-site" #4: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP/NAT=>0x0e8a4136 <0x82e90be9 xfrm=3DES_0-HMAC_MD5 NATOA=none NATD=x.x.x.x:4500 DPD=none}</div></div><div><br></div><br clear="all"><div><div class="gmail_signature">Matt</div></div>
</div>