<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<!-- Template generated by Exclaimer Signature Manager Exchange Edition on 09:02:10 Monday, 24 August 2015 -->
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css">P.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
LI.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
DIV.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
TABLE.ImprintUniqueIDTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style><!-- Template generated by Exclaimer Signature Manager Exchange Edition on 09:02:10 Monday, 24 August 2015 --><style type="text/css">P.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
LI.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
DIV.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
TABLE.ImprintUniqueIDTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style>
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Latha;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:#2F5496;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#2F5496">VPN connection between Linux Openswan U2.6.38 (Ubuntu EC2 instance in VPC with EIP) & Cisco ASA 5510 got stuck at “#1: pending Phase 2 for "Connection1/1x1" replacing #0”.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Please find below the complete details about the setup & logs. Any guidance would be helpful.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="color:#2F5496">Configuration details at ASA:<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">No Nat and Access-list :<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">access-list inside_nat0_outbound extended permit ip 10.100.0.0 255.255.0.0 172.21.8.0 255.255.255.0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">access-list Outside_cryptomap_120 extended permit ip 10.100.0.0 255.255.0.0 172.21.8.0 255.255.255.0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Phase 1 ( any one of the policy will be picked up, here for aws tunnel the phase 1 policy is 60 ) :<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">crypto isakmp policy 10<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">authentication pre-share<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">encryption 3des<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">hash sha<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">group 2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">lifetime 86400<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">crypto isakmp policy 20<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">authentication pre-share<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">encryption 3des<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">hash md5<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">group 2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">lifetime 86400<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">crypto isakmp policy 30<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">authentication pre-share<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">encryption aes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">hash sha<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">group 2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">lifetime 86400<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">crypto isakmp policy 40<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">authentication pre-share<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">encryption aes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">hash sha<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">group 2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">lifetime 28800<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">crypto isakmp policy 50<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">authentication pre-share<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">encryption aes-256<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">hash sha<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">group 2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">lifetime 28800<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">crypto isakmp policy 60<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">authentication pre-share<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">encryption aes-256<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">hash sha<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">group 5<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">lifetime 28800<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Crypto and PHase 2 :<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">crypto map Outside_map 120 match address Outside_cryptomap_120<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">crypto map Outside_map 120 set pfs<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">crypto map Outside_map 120 set peer 52.17.237.123<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">crypto map Outside_map 120 set transform-set ESP-AES-256-SHA<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">crypto map Outside_map 120 set security-association lifetime seconds 3600<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">tunnel-group 52.17.237.123 type ipsec-l2l<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">tunnel-group 52.17.237.123 ipsec-attributes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">pre-shared-key ********<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Transform set :<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="color:#2F5496">Configuration at OpenSwan:<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="color:#2F5496">config setup<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> protostack=netkey<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> nat_traversal=no<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">conn Connection1 # Connection Name<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> type=tunnel<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> authby=secret<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> auto=start<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> pfs=yes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> ike=aes256-sha1;modp1536!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> phase2alg=aes256-sha1;modp1536<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> ikelifetime=28800s<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> salifetime=3600s<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> left=%defaultroute<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> leftid=52.17.237.123<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> leftsubnets={172.21.8.0/24}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> right=87.213.46.220<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> rightsubnets={10.100.0.0/16}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="color:#2F5496">Snippet of whack status:<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="color:#2F5496">000 "Connection1/1x1": 172.21.8.0/24===172.21.8.43[52.17.237.123]...87.213.46.220<87.213.46.220>===10.100.0.0/16; unrouted; eroute owner: #0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">000 "Connection1/1x1": myip=unset; hisip=unset;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">000 "Connection1/1x1": ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">000 "Connection1/1x1": policy: PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 24,16; interface: eth0;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">000 "Connection1/1x1": newest ISAKMP SA: #0; newest IPsec SA: #0;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">000 "Connection1/1x1": aliases: Connection1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">000 "Connection1/1x1": IKE algorithms wanted: AES_CBC(7)_256-SHA1(2)_000-MODP1536(5); flags=strict<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">000 "Connection1/1x1": IKE algorithms found: AES_CBC(7)_256-SHA1(2)_160-MODP1536(5)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">000 "Connection1/1x1": ESP algorithms wanted: AES(12)_256-SHA1(2)_000; pfsgroup=MODP1536(5); flags=-strict<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">000 "Connection1/1x1": ESP algorithms loaded: AES(12)_256-SHA1(2)_160<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">000<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">000 #8: "Connection1/1x1":500 STATE_MAIN_R2 (sent MR2, expecting MI3); EVENT_RETRANSMIT in 8s; lastdpd=-1s(seq in:0 out:0); idle; import:not set<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">000 #7: "Connection1/1x1":500 STATE_MAIN_R2 (sent MR2, expecting MI3); EVENT_RETRANSMIT in 21s; lastdpd=-1s(seq in:0 out:0); idle; import:not set<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">000 #1: "Connection1/1x1":500 STATE_MAIN_I3 (sent MI3, expecting MR3); none in -1s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">000 #1: pending Phase 2 for "Connection1/1x1" replacing #0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="color:#2F5496">Auth logs:<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 ipsec__plutorun: Starting Pluto subsystem...<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: Starting Pluto (Openswan Version 2.6.38; Vendor ID OEvy\134kgzWq\134s) pid:21900<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: LEAK_DETECTIVE support [disabled]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: OCF support for IKE [disabled]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: SAref support [disabled]: Protocol not available<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: SAbind support [disabled]: Protocol not available<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: NSS support [disabled]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: HAVE_STATSD notification support not compiled in<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: Setting NAT-Traversal port-4500 floating to off<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: port floating activation criteria nat_t=0/port_float=1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: NAT-Traversal support [disabled]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: using /dev/urandom as source of random entropy<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: starting up 1 cryptographic helpers<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: started helper pid=21903 (fd:6)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: Using Linux 2.6 IPsec interface code on 3.13.0-53-generic (experimental code)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21903]: using /dev/urandom as source of random entropy<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: ike_alg_register_enc(): Activating aes_ccm_8: Ok (ret=0)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: ike_alg_register_enc(): Activating aes_ccm_12: FAILED (ret=-17)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: ike_alg_register_enc(): Activating aes_ccm_16: FAILED (ret=-17)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: ike_alg_register_enc(): Activating aes_gcm_8: FAILED (ret=-17)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: ike_alg_register_enc(): Activating aes_gcm_12: FAILED (ret=-17)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: ike_alg_register_enc(): Activating aes_gcm_16: FAILED (ret=-17)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: added connection description "Connection1/1x1"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: listening for IKE messages<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: adding interface eth0/eth0 172.21.8.43:500<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: adding interface lo/lo 127.0.0.1:500<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: adding interface lo/lo ::1:500<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: loading secrets from "/etc/ipsec.secrets"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: initiating all conns with alias='Connection1'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: "Connection1/1x1" #1: initiating Main Mode<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: "Connection1/1x1" #1: ignoring Vendor ID payload [Cisco IKE Fragmentation]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: "Connection1/1x1" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: "Connection1/1x1" #1: STATE_MAIN_I2: sent MI2, expecting MR2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: "Connection1/1x1" #1: received Vendor ID payload [Cisco-Unity]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: "Connection1/1x1" #1: received Vendor ID payload [XAUTH]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: "Connection1/1x1" #1: ignoring unknown Vendor ID payload [fcf4799afa86cc27fe698e78bd2eba5f]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: "Connection1/1x1" #1: ignoring Vendor ID payload [Cisco VPN 3000 Series]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: "Connection1/1x1" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: "Connection1/1x1" #1: STATE_MAIN_I3: sent MI3, expecting MR3<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: "Connection1/1x1" #1: received Vendor ID payload [Dead Peer Detection]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: "Connection1/1x1" #1: Main mode peer ID is ID_FQDN: '@Connection1-ASA.global.sdl.corp'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: "Connection1/1x1" #1: we require peer to have ID '87.213.46.220', but peer declares '@Connection1-ASA.global.sdl.corp'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:27 gateway3 pluto[21900]: "Connection1/1x1" #1: sending encrypted notification INVALID_ID_INFORMATION to 87.213.46.220:500<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:28 gateway3 pluto[21900]: packet from 87.213.46.220:500: Informational Exchange is for an unknown (expired?) SA with MSGID:0xab33e4a2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:29 gateway3 pluto[21900]: "Connection1/1x1" #1: Quick Mode message is unacceptable because it is for an incomplete ISAKMP SA<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:29 gateway3 pluto[21900]: | payload malformed after IV<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:29 gateway3 pluto[21900]: | 48 70 2e a3 52 84 62 3a 36 27 ad e2 4e b8 a0 4f<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:29 gateway3 pluto[21900]: "Connection1/1x1" #1: sending notification PAYLOAD_MALFORMED to 87.213.46.220:500<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:34 gateway3 pluto[21900]: packet from 87.213.46.220:500: phase 1 message is part of an unknown exchange<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:37 gateway3 pluto[21900]: "Connection1/1x1" #1: Quick Mode message is unacceptable because it is for an incomplete ISAKMP SA<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:37 gateway3 pluto[21900]: | payload malformed after IV<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:37 gateway3 pluto[21900]: | 48 70 2e a3 52 84 62 3a 36 27 ad e2 4e b8 a0 4f<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:37 gateway3 pluto[21900]: "Connection1/1x1" #1: sending notification PAYLOAD_MALFORMED to 87.213.46.220:500<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:42 gateway3 pluto[21900]: packet from 87.213.46.220:500: Informational Exchange is for an unknown (expired?) SA with MSGID:0x690eb3ad<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:45 gateway3 pluto[21900]: "Connection1/1x1" #1: Quick Mode message is unacceptable because it is for an incomplete ISAKMP SA<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:45 gateway3 pluto[21900]: | payload malformed after IV<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:45 gateway3 pluto[21900]: | 48 70 2e a3 52 84 62 3a 36 27 ad e2 4e b8 a0 4f<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:45 gateway3 pluto[21900]: "Connection1/1x1" #1: sending notification PAYLOAD_MALFORMED to 87.213.46.220:500<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:53 gateway3 pluto[21900]: "Connection1/1x1" #1: Quick Mode message is unacceptable because it is for an incomplete ISAKMP SA<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:53 gateway3 pluto[21900]: | payload malformed after IV<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:53 gateway3 pluto[21900]: | 48 70 2e a3 52 84 62 3a 36 27 ad e2 4e b8 a0 4f<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:46:53 gateway3 pluto[21900]: "Connection1/1x1" #1: sending notification PAYLOAD_MALFORMED to 87.213.46.220:500<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:47:01 gateway3 pluto[21900]: "Connection1/1x1" #1: next payload type of ISAKMP Hash Payload has an unknown value: 192<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:47:01 gateway3 pluto[21900]: "Connection1/1x1" #1: malformed payload in packet<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:47:01 gateway3 pluto[21900]: | payload malformed after IV<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:47:01 gateway3 pluto[21900]: | 48 70 2e a3 52 84 62 3a 36 27 ad e2 4e b8 a0 4f<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:47:01 gateway3 pluto[21900]: "Connection1/1x1" #1: sending notification PAYLOAD_MALFORMED to 87.213.46.220:500<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:47:01 gateway3 pluto[21900]: "Connection1/1x1" #1: next payload type of ISAKMP Hash Payload has an unknown value: 146<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:47:01 gateway3 pluto[21900]: "Connection1/1x1" #1: malformed payload in packet<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:47:02 gateway3 pluto[21900]: packet from 87.213.46.220:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but port floating is off<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:47:02 gateway3 pluto[21900]: packet from 87.213.46.220:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but port floating is off<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:47:02 gateway3 pluto[21900]: packet from 87.213.46.220:500: received Vendor ID payload [RFC 3947] meth=115, but port floating is off<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 07:47:02 gateway3 pluto[21900]: packet from 87.213.46.220:500: ignoring Vendor ID payload [Cisco IKE Fragmentation]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="color:#2F5496">Iptables rules:<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="color:#2F5496"># iptables -t nat -n -L --line-numbers<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Chain PREROUTING (policy ACCEPT)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">num target prot opt source destination<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Chain INPUT (policy ACCEPT)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">num target prot opt source destination<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Chain OUTPUT (policy ACCEPT)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">num target prot opt source destination<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Chain POSTROUTING (policy ACCEPT)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">num target prot opt source destination<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">1 ACCEPT all -- 172.21.8.0/24 10.100.0.0/16<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">2 MASQUERADE all -- 172.21.8.0/24 0.0.0.0/0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Prakash<o:p></o:p></span></p>
</div>
<br>
<a href="www.sdl.com/" target=""><img width="150" height="68" style="" src="http://dr0muzwhcp26z.cloudfront.net/static/corporate/SDL-logo-2014.png"></a><br>
www.sdl.com <br>
<br>
<table style="BORDER-COLLAPSE: collapse" class="ImprintUniqueIDTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
</tr>
</tbody>
</table>
<table style="BORDER-COLLAPSE: collapse" class="ImprintUniqueIDTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
</tbody>
</table>
<br>
<table style="BORDER-COLLAPSE: collapse" class="ImprintUniqueIDTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td width="800"><font style="COLOR: #a1a1a1; FONT-SIZE: 8pt" size="+0">SDL PLC confidential, all rights reserved. If you are not the intended recipient of this mail SDL requests and requires that you delete it without acting upon or copying any of its contents,
and we further request that you advise us.<br>
<br>
SDL PLC is a public limited company registered in England and Wales. Registered number: 02675207.
<br>
Registered address: Globe House, Clivemont Road, Maidenhead, Berkshire SL6 7DY, UK.
</font></td>
</tr>
</tbody>
</table>
<br>
<br><br>
<P align=center><FONT style="BACKGROUND-COLOR: #ffffff">This message has been scanned for malware by Websense. </FONT><A href="http://www.websense.com/"><FONT style="BACKGROUND-COLOR: #ffffff" color=#000000>www.websense.com</FONT></A></P>
</body>
</html>