<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<!-- Template generated by Exclaimer Signature Manager Exchange Edition on 01:21:25 Wednesday, 2 September 2015 -->
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css">P.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
LI.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
DIV.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
TABLE.ImprintUniqueIDTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style><!-- Template generated by Exclaimer Signature Manager Exchange Edition on 01:21:25 Wednesday, 2 September 2015 --><style type="text/css">P.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
LI.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
DIV.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
TABLE.ImprintUniqueIDTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style>
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Latha;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.imprintuniqueid, li.imprintuniqueid, div.imprintuniqueid
{mso-style-name:imprintuniqueid;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.imprintuniqueid1, li.imprintuniqueid1, div.imprintuniqueid1
{mso-style-name:imprintuniqueid1;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#2F5496;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">Thanks a lot Daniel, that did the trick.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">Interestingly it works only when we comment out or remove ike & phase2alg from the config file, it doesn’t work even if we specify “3des-md5;modp1536”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">Prakash<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"><o:p> </o:p></span></p>
<div></div>
</div>
<br>
<a href="www.sdl.com/" target=""><img width="150" height="68" style="" src="http://dr0muzwhcp26z.cloudfront.net/static/corporate/SDL-logo-2014.png"></a><br>
www.sdl.com <br>
<br>
<table style="BORDER-COLLAPSE: collapse" class="ImprintUniqueIDTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
</tr>
</tbody>
</table>
<table style="BORDER-COLLAPSE: collapse" class="ImprintUniqueIDTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
</tbody>
</table>
<div class="WordSection1">
<div></div>
</div>
<br>
<table style="BORDER-COLLAPSE: collapse" class="ImprintUniqueIDTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td width="800"><font style="COLOR: #a1a1a1; FONT-SIZE: 8pt" size="+0">SDL PLC confidential, all rights reserved. If you are not the intended recipient of this mail SDL requests and requires that you delete it without acting upon or copying any of its contents,
and we further request that you advise us.<br>
<br>
SDL PLC is a public limited company registered in England and Wales. Registered number: 02675207.
<br>
Registered address: Globe House, Clivemont Road, Maidenhead, Berkshire SL6 7DY, UK.
</font></td>
</tr>
</tbody>
</table>
<br>
<div class="WordSection1">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Daniel Cave [mailto:dan.cave@me.com]
<br>
<b>Sent:</b> Tuesday, September 1, 2015 6:45 PM<br>
<b>To:</b> Prakash Palanisamy <ppalanisamy@sdl.com><br>
<b>Cc:</b> users@lists.openswan.org<br>
<b>Subject:</b> Re: [Openswan Users] Connection is getting reset every few seconds<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Prakesh,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">What happens when you set both sides of the Ipsec (asa and OpenSwan ) to use 3des-md5 ? i noticed you had the same compatibility problems with AES-Sha256 that I did.. Your start up logs are telling you that on the OpenSwan server..<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> It seems the ASA does not like the OpenSwan proposal for AES(256)-SHA.. if you comment out the phase 1&2 specific negotiation on the OpenSwan side, restart that, then re-configure the ASA to use 3des-md5 - i believe it should work - as
this is what we're using.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hope that helps.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">d.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">On Aug 27, 2015, at 03:44 PM, Prakash Palanisamy <ppalanisamy@sdl.com> wrote:<o:p></o:p></p>
</div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">Hi Daniel,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">Please find below the complete details. Will it be something to do with different DPD timeout configuration
at both the ends?</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">Configuration details at ASA:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">No Nat and Access-list :</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">access-list inside_nat0_outbound extended permit ip 10.100.0.0 255.255.0.0 172.21.8.0 255.255.255.0</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">access-list Outside_cryptomap_120 extended permit ip 10.100.0.0 255.255.0.0 172.21.8.0 255.255.255.0</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">Phase 1 ( any one of the policy will be picked up, here for aws tunnel the phase 1 policy is 60 ) :</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">crypto isakmp policy 10</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">authentication pre-share</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">encryption 3des</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">hash sha</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">group 2</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">lifetime 86400</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">crypto isakmp policy 20</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">authentication pre-share</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">encryption 3des</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">hash md5</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">group 2</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">lifetime 86400</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">crypto isakmp policy 30</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">authentication pre-share</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">encryption aes</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">hash sha</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">group 2</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">lifetime 86400</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">crypto isakmp policy 40</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">authentication pre-share</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">encryption aes</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">hash sha</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">group 2</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">lifetime 28800</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">crypto isakmp policy 50</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">authentication pre-share</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">encryption aes-256</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">hash sha</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">group 2</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">lifetime 28800</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">crypto isakmp policy 60</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">authentication pre-share</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">encryption aes-256</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">hash sha</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">group 5</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">lifetime 28800</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">Crypto and PHase 2 :</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">crypto map Outside_map 120 match address Outside_cryptomap_120</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">crypto map Outside_map 120 set pfs</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">crypto map Outside_map 120 set peer 52.17.237.123</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">crypto map Outside_map 120 set transform-set ESP-AES-256-SHA</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">crypto map Outside_map 120 set security-association lifetime seconds 3600</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">tunnel-group 52.17.237.123 type ipsec-l2l</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">tunnel-group 52.17.237.123 ipsec-attributes</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">pre-shared-key ********</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">Transform set :</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">Configuration at OpenSwan:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">config setup</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> protostack=netkey</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> nat_traversal=no</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">conn Connection1 # Connection Name</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> type=tunnel</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> authby=secret</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> auto=start</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> pfs=yes</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> ike=aes256-sha1;modp1536!</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> phase2alg=aes256-sha1;modp1536</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> ikelifetime=28800s</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> salifetime=3600s</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> left=%defaultroute</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> leftid=52.17.237.123</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> leftsubnets={172.21.8.0/24}</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> right=87.213.46.220</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> rightsubnets={10.100.0.0/16}</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">ipsec status:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 using kernel interface: netkey</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 interface lo/lo ::1</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 interface lo/lo 127.0.0.1</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 interface eth0/eth0 172.21.8.61</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 %myid = (none)</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 debug none</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 virtual_private (%priv):</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 - allowed 0 subnets:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 - disallowed 0 subnets:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 WARNING: Either virtual_private= is not specified, or there is a syntax</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 error in that line. 'left/rightsubnet=vhost:%priv' will not work!</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 WARNING: Disallowed subnets in virtual_private= is empty. If you have</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 private address space in internal use, it should be excluded!</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8, keysizemin=40, keysizemax=128</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8, keysizemin=160, keysizemax=288</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP auth attr: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384, keysizemin=384, keysizemax=384</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP auth attr: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512, keysizemin=512, keysizemax=512</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP auth attr: id=8, name=AUTH_ALGORITHM_HMAC_RIPEMD, keysizemin=160, keysizemax=160</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm ESP auth attr: id=251, name=AUTH_ALGORITHM_NULL_KAME, keysizemin=0, keysizemax=0</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,3,64} trans={0,3,3072} attrs={0,3,2048}</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 "Connection1/1x1": 172.21.8.0/24===172.21.8.61[52.17.237.123]...87.213.46.220<87.213.46.220>===10.100.0.0/16;
erouted; eroute owner: #4</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 "Connection1/1x1": myip=unset; hisip=unset;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 "Connection1/1x1": ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%;
keyingtries: 0</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 "Connection1/1x1": policy: PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 24,16;
interface: eth0;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 "Connection1/1x1": newest ISAKMP SA: #3; newest IPsec SA: #4;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 "Connection1/1x1": aliases: Connection1</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 "Connection1/1x1": IKE algorithms wanted: AES_CBC(7)_256-SHA1(2)_000-MODP1536(5); flags=strict</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 "Connection1/1x1": IKE algorithms found: AES_CBC(7)_256-SHA1(2)_160-MODP1536(5)</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 "Connection1/1x1": IKE algorithm newest: AES_CBC_256-SHA1-MODP1536</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 "Connection1/1x1": ESP algorithms wanted: AES(12)_256-SHA1(2)_000; pfsgroup=MODP1536(5); flags=-strict</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 "Connection1/1x1": ESP algorithms loaded: AES(12)_256-SHA1(2)_160</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 "Connection1/1x1": ESP algorithm newest: AES_256-HMAC_SHA1; pfsgroup=MODP1536</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 #5: "Connection1/1x1":500 STATE_QUICK_I1 (sent QI1, expecting QR1); EVENT_RETRANSMIT in 18s; lastdpd=-1s(seq
in:0 out:0); idle; import:admin initiate</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 #4: "Connection1/1x1":500 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 3252s; newest
IPSEC; eroute owner; isakmp#3; idle; import:not set</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 #4: "Connection1/1x1"
<a href="mailto:esp.70598aa@87.213.46.220">esp.70598aa@87.213.46.220</a> <a href="mailto:esp.6fd8d5cc@172.21.8.61">
esp.6fd8d5cc@172.21.8.61</a> <a href="mailto:tun.0@87.213.46.220">tun.0@87.213.46.220</a>
<a href="mailto:tun.0@172.21.8.61">tun.0@172.21.8.61</a> ref=0 refhim=4294901761</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">000 #3: "Connection1/1x1":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in
28452s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">Thanks,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496">Prakash</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#2F5496"> </span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
<span style="border:solid windowtext 1.0pt;padding:0in"><img border="0" width="150" height="68" id="_x0000_i1027" src="cid:image001.jpg@01D0E58A.9A5602C0" alt="Image removed by sender."></span><br>
<a href="http://www.sdl.com">http://www.sdl.com</a> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td width="800" style="width:600.0pt;padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-size:8.0pt;color:#A1A1A1">SDL PLC confidential, all rights reserved. If you are not the intended recipient of this mail SDL requests and requires that you delete it without acting upon or copying any of its contents, and
we further request that you advise us.<br>
<br>
SDL PLC is a public limited company registered in England and Wales. Registered number: 02675207.
<br>
Registered address: Globe House, Clivemont Road, Maidenhead, Berkshire SL6 7DY, UK.
</span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><strong><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></strong><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Daniel Cave [mailto:dan.cave@me.com]
<br>
<strong><span style="font-family:"Calibri",sans-serif">Sent:</span></strong> Thursday, August 27, 2015 3:50 PM<br>
<strong><span style="font-family:"Calibri",sans-serif">To:</span></strong> Prakash Palanisamy <ppalanisamy@sdl.com><br>
<strong><span style="font-family:"Calibri",sans-serif">Cc:</span></strong> <a href="mailto:users@lists.openswan.org">
users@lists.openswan.org</a><br>
<strong><span style="font-family:"Calibri",sans-serif">Subject:</span></strong> Re: [Openswan Users] Connection is getting reset every few seconds</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hi Prakash, I think you misunderstood me (as I didn't make myself very clear)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I think the issues you're getting are configuration related at either side and not related to the EC2 instance specifically.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Can you post your config file from both sizes, it looks like - from your logs that Phase1/2 are not negotiating correctly and there's some kind of mismatch in timings .<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Where im working, we have setup an EC2 instance, t2.small to a client in the USA, on a Cisco ASA 5510.. 3des-md5.. the tunnel has been up for months.. we're using the same version
of OpenSwan/racoon that you are.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">What I did originally was to remove any options to set phase1/2 algorithms and commented them out in my config until i got a working config on the openswan side.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">if you run 'ipsec auto status' what do you see ?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">it should look *something* like this <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt"># ipsec auto status</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">ipsec auto: warning: obsolete command syntax used</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 using kernel interface: netkey</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 interface lo/lo ::1</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 interface lo/lo 127.0.0.1</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 interface lo/lo 127.0.0.1</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 interface eth0/eth0 172.11.44.240</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 interface eth0/eth0 172.11.44.240</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 interface tun0/tun0 10.8.0.1</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 interface tun0/tun0 10.8.0.1</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 %myid = (none)</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 debug none</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 virtual_private (%priv):</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 - allowed 0 subnets: </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 - disallowed 0 subnets: </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 WARNING: Either virtual_private= is not specified, or there is a syntax </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 error in that line. 'left/rightsubnet=vhost:%priv' will not work!</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 WARNING: Disallowed subnets in virtual_private= is empty. If you have </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 private address space in internal use, it should be excluded!</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8, keysizemin=40, keysizemax=128</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8, keysizemin=160, keysizemax=288</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP auth attr: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384, keysizemin=384, keysizemax=384</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP auth attr: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512, keysizemin=512, keysizemax=512</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP auth attr: id=8, name=AUTH_ALGORITHM_HMAC_RIPEMD, keysizemin=160, keysizemax=160</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm ESP auth attr: id=251, name=AUTH_ALGORITHM_NULL_KAME, keysizemin=0, keysizemax=0</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,11,64} trans={0,11,3072} attrs={0,11,2048} </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 "idc-dr/1x1": 172.11.44.0/16===172.11.44.240[52.x.x.x]...172.11.44.1---72.11.62.33<72.11.62.33>===192.168.30.0/24; erouted; eroute owner: #171</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 "idc-dr/1x1": myip=172.11.44.240; hisip=unset;</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 "idc-dr/1x1": ike_life: 86400s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 "idc-dr/1x1": policy: PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 16,24; interface: eth0; </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 "idc-dr/1x1": newest ISAKMP SA: #169; newest IPsec SA: #171; </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 "idc-dr/1x1": aliases: idc-dr </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 "idc-dr/1x1": IKE algorithms wanted: 3DES_CBC(5)_000-MD5(1)_000-MODP1536(5), 3DES_CBC(5)_000-MD5(1)_000-MODP1024(2); flags=-strict</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 "idc-dr/1x1": IKE algorithms found: 3DES_CBC(5)_192-MD5(1)_128-MODP1536(5)3DES_CBC(5)_192-MD5(1)_128-MODP1024(2)</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 "idc-dr/1x1": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 "idc-dr/1x1": ESP algorithms wanted: 3DES(3)_000-MD5(1)_000; flags=-strict</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 "idc-dr/1x1": ESP algorithms loaded: 3DES(3)_192-MD5(1)_128</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 "idc-dr/1x1": ESP algorithm newest: 3DES_000-HMAC_MD5; pfsgroup=<N/A></span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 #171: "idc-dr/1x1":4500 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 24593s; newest IPSEC; eroute owner; isakmp#169; idle; import:not set</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 #171: "idc-dr/1x1"
<a href="mailto:esp.ace0ffe6@72.11.62.33">esp.ace0ffe6@72.11.62.33</a> <a href="mailto:esp.7cc12623@172.11.44.240">
esp.7cc12623@172.11.44.240</a> <a href="mailto:tun.0@72.11.62.33">tun.0@72.11.62.33</a>
<a href="mailto:tun.0@172.11.44.240">tun.0@172.11.44.240</a> ref=0 refhim=4294901761</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 #169: "idc-dr/1x1":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 45423s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:not
set</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;background:#FFF7AB"><span style="font-size:9.0pt">000 </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">start off by posting the configs from both sides (ipsec.conf / cisco asa) and check your phase 1/2 key times<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt">On Aug 27, 2015, at 10:14 AM, Prakash Palanisamy <ppalanisamy@sdl.com> wrote:<o:p></o:p></p>
</div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Hi Daniel,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Thanks for your input. I tried different instance types, even with m4.2xlarge which got High Network performance & Enhanced Networking I could see the
connection is getting reset after 90 seconds.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Thanks,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Prakash</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496"> </span><o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><br>
<span style="border:solid windowtext 1.0pt;padding:0in"><img border="0" width="150" height="68" id="_x0000_i1026" src="cid:image002.jpg@01D0E58A.9A5602C0" alt="Image removed by sender."></span><br>
<a href="http://www.sdl.com">http://www.sdl.com</a><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td width="800" style="width:600.0pt;padding:0in 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:8.0pt;color:#A1A1A1">SDL PLC confidential, all rights reserved. If you are not the intended recipient of this mail SDL requests and requires that you delete
it without acting upon or copying any of its contents, and we further request that you advise us.<br>
<br>
SDL PLC is a public limited company registered in England and Wales. Registered number: 02675207.
<br>
Registered address: Globe House, Clivemont Road, Maidenhead, Berkshire SL6 7DY, UK.
</span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><strong>From:</strong> Daniel Cave [mailto:dan.cave@me.com]
<br>
<strong>Sent:</strong> Wednesday, August 26, 2015 10:36 PM<br>
<strong>To:</strong> Prakash Palanisamy <ppalanisamy@sdl.com><br>
<strong>Cc:</strong> <a href="mailto:users@lists.openswan.org">users@lists.openswan.org</a><br>
<strong>Subject:</strong> Re: [Openswan Users] Connection is getting reset every few seconds<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">If you search the archives I had a similar problem about four months ago with an Asa except my instance in aws was too small for the volume of traffic I was using it for and my
openSwan tunnel kept collapsing randomly. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><br>
Sent from my iPhone<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><br>
On 26 Aug 2015, at 18:22, Prakash Palanisamy <<a href="mailto:ppalanisamy@sdl.com">ppalanisamy@sdl.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">I have modified the config to set “rekey=no” based on feedback from lots of other threads, but this doesn’t help. I have requested for details at ASA
to check the renegotiation policy at the other end.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">What would be the other possible reasons for continuous reset?</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Thanks,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Prakash</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><br>
<span style="border:solid windowtext 1.0pt;padding:0in"><img border="0" width="150" height="68" id="_x0000_i1025" src="cid:image002.jpg@01D0E58A.9A5602C0" alt="Image removed by sender."></span><br>
<a href="http://www.sdl.com">www.sdl.com</a><o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td width="800" style="width:600.0pt;padding:0in 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:8.0pt;color:#A1A1A1">SDL PLC confidential, all rights reserved. If you are not the intended recipient of this mail SDL requests and requires that you delete
it without acting upon or copying any of its contents, and we further request that you advise us.<br>
<br>
SDL PLC is a public limited company registered in England and Wales. Registered number: 02675207.
<br>
Registered address: Globe House, Clivemont Road, Maidenhead, Berkshire SL6 7DY, UK.
</span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><strong>From:</strong> Prakash Palanisamy
<br>
<strong>Sent:</strong> Monday, August 24, 2015 4:54 PM<br>
<strong>To:</strong> '<a href="mailto:users@lists.openswan.org">users@lists.openswan.org</a>' <<a href="mailto:users@lists.openswan.org">users@lists.openswan.org</a>><br>
<strong>Subject:</strong> Connection is getting reset every few seconds<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">VPN connection between Linux Openswan U2.6.38 (Ubuntu EC2 instance in VPC with EIP) & Cisco ASA 5510 is getting reset every few seconds. Earlier today
with the help of the community I solved the another problem with “pending phase 2” issue and after that we see that the connection is being very flaky.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Other details about the setup can be found in my previous thread -
<a href="https://lists.openswan.org/pipermail/users/2015-August/023391.html">https://lists.openswan.org/pipermail/users/2015-August/023391.html</a>
</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><strong><span style="color:#2F5496">Auth logs:</span></strong><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: initiating Main Mode</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: ignoring Vendor ID payload [Cisco IKE Fragmentation]</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: STATE_MAIN_I2: sent MI2, expecting MR2</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: received Vendor ID payload [Cisco-Unity]</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: received Vendor ID payload [XAUTH]</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: ignoring unknown Vendor ID payload [ec43b53de4bd9e2ec73fcf4ea211143f]</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: ignoring Vendor ID payload [Cisco VPN 3000 Series]</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: STATE_MAIN_I3: sent MI3, expecting MR3</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: received Vendor ID payload [Dead Peer Detection]</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: Main mode peer ID is ID_FQDN: '@Connection1-ASA.global.sdl.corp'</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha
group=modp1536}</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:b9dab225
proposal=AES(12)_256-SHA1(2)_160 pfsgroup=OAKLEY_GROUP_MODP1536}</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: ignoring informational payload, type NO_PROPOSAL_CHOSEN msgid=00000000</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: received and ignored informational message</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: received Delete SA payload: deleting ISAKMP State #1</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: packet from 87.213.46.220:500: received and ignored informational message</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: packet from 87.213.46.220:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but port
floating is off</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: packet from 87.213.46.220:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but port floating
is off</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: packet from 87.213.46.220:500: received Vendor ID payload [RFC 3947] meth=115, but port floating is off</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: packet from 87.213.46.220:500: ignoring Vendor ID payload [Cisco IKE Fragmentation]</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: responding to Main Mode</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: Oakley Transform [OAKLEY_3DES_CBC (192), OAKLEY_SHA1, OAKLEY_GROUP_MODP1024] refused due
to strict flag</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: Oakley Transform [OAKLEY_3DES_CBC (192), OAKLEY_MD5, OAKLEY_GROUP_MODP1024] refused due
to strict flag</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: Oakley Transform [OAKLEY_AES_CBC (128), OAKLEY_SHA1, OAKLEY_GROUP_MODP1024] refused due
to strict flag</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: Oakley Transform [OAKLEY_AES_CBC (128), OAKLEY_SHA1, OAKLEY_GROUP_MODP1024] refused due
to strict flag</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: Oakley Transform [OAKLEY_AES_CBC (256), OAKLEY_SHA1, OAKLEY_GROUP_MODP1024] refused due
to strict flag</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: STATE_MAIN_R1: sent MR1, expecting MI2</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: received Vendor ID payload [Cisco-Unity]</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: received Vendor ID payload [XAUTH]</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: ignoring unknown Vendor ID payload [f7d4c0744bc4c632afa9ec7e85bf857b]</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: ignoring Vendor ID payload [Cisco VPN 3000 Series]</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: STATE_MAIN_R2: sent MR2, expecting MI3</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: received Vendor ID payload [Dead Peer Detection]</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: Main mode peer ID is ID_FQDN: '@Connection1-ASA.global.sdl.corp'</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256
prf=oakley_sha group=modp1536}</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: the peer proposed: 172.21.8.0/24:0/0 -> 10.100.0.0/16:0/0</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #4: responding to Quick Mode proposal {msgid:b23b46bc}</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #4: us: 172.21.8.0/24===172.21.8.43[52.17.237.123]</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #4: them: 87.213.46.220<87.213.46.220>[@Connection1-ASA.global.sdl.corp]===10.100.0.0/16</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #4: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #4: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #4: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #4: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0x22ef875d <0x409dd686 xfrm=AES_256-HMAC_SHA1
NATOA=none NATD=none DPD=none}</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Thanks,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#2F5496">Prakash</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"> <o:p></o:p></p>
<p align="center" style="text-align:center"><span style="background:white">This message has been scanned for malware by Websense.
</span><a href="http://www.websense.com/"><span style="color:black;background:white">www.websense.com</span></a><o:p></o:p></p>
</div>
</blockquote>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">_______________________________________________<br>
<a href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a><br>
<a href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a><br>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">
https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><o:p></o:p></p>
</div>
</blockquote>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><span style="background:white"> </span><o:p></o:p></p>
<p align="center" style="text-align:center"><span style="background:white">Click <a href="https://www.mailcontrol.com/sr/d9CXhEllK63GX2PQPOmvUnS2K3gDJIy6lzRXt7oNsiicPNUt9nJV030BY+HvHblPiMAdEB7HuPeCTIJSz5pNWQ==">
here</a> to report this email as spam.</span><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>