<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Lucida Console";
panose-1:2 11 6 9 4 5 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m running OpenSwan on Ubuntu 14.04 for a site-to-site VPN. We have twice managed to get the tunnel up and working but each time it has gone down again shortly after (30-90 minutes after coming up) and then never come back up.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The 2<sup>nd</sup> time it came up after completely removing and purging Openswan from the system and reinstalling, at which point it wasn’t coming up (failing at Phase 2) and after some changes in xl2tpd based on the OpenSwan wiki it suddenly
came. Without further input it went down and now won’t come up anymore.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It appears to be failing in Phase 2. We’ve triple checked the config and the remote host is a live system and are adamant their config is correct. The tunnel has come up at some point so it shouldn’t be an issue with a config mismatch.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">To explain the network topography remote host A sits in front of remote host B, A is connected to the internet. Our server C needs to connect to B. So our server is both establishing the connection and also the system using it, no further
subnet. There is no NAT traversal required. If I restart ipsec it just show no tunnels up. If I check the logs there are no errors. If I run ipsec auto –up conn-name it just gets stuck at STATE_QUICK_I1: retransmission.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">If I first run ipsec auto –down conn-name and then ipsec auto –verbose –up conn-name I can see what looks to me like Phase 1 is successful. Here is the output:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console";color:#FF4040">root</span><span style="font-family:"Lucida Console";color:#FFFF40">@</span><span style="font-family:"Lucida Console";color:#40FFFF">dev
</span><span style="font-family:"Lucida Console";color:#FFFF40">~ </span><span style="font-family:"Lucida Console";color:#FF40FF">#
</span><span style="font-family:"Lucida Console"">ipsec auto --verbose --up conn-name<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">002 "easypay-ipsec-vpn" #11: initiating Main Mode<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">104 "easypay-ipsec-vpn" #11: STATE_MAIN_I1: initiate<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">003 "easypay-ipsec-vpn" #11: received Vendor ID payload [Dead Peer Detection]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">002 "easypay-ipsec-vpn" #11: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">106 "easypay-ipsec-vpn" #11: STATE_MAIN_I2: sent MI2, expecting MR2<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">002 "easypay-ipsec-vpn" #11: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">108 "easypay-ipsec-vpn" #11: STATE_MAIN_I3: sent MI3, expecting MR3<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">002 "easypay-ipsec-vpn" #11: Main mode peer ID is ID_IPV4_ADDR: '111.111.111.85'<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">002 "easypay-ipsec-vpn" #11: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">004 "easypay-ipsec-vpn" #11: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1024}<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">002 "easypay-ipsec-vpn" #12: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+DONTREKEY+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#11 msgid:dbb4aee3 proposal=3DES(3)_192-SHA1(2)_160
pfsgroup=OAKLEY_GROUP_MODP1024}<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">117 "easypay-ipsec-vpn" #12: STATE_QUICK_I1: initiate<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">010 "easypay-ipsec-vpn" #12: STATE_QUICK_I1: retransmission; will wait 20s for response<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The IPSec Conf file (removed comments and changed IPs):<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">version 2.0 # conforms to second version of ipsec.conf specification<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""># basic configuration<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">config setup<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> plutodebug=all<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> plutostderrlog=/var/log/openswan.log<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> dumpdir=/var/run/pluto/<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> interfaces=%defaultroute<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> nat_traversal=yes<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> oe=off<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> protostack=netkey<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">conn easypay-ipsec-vpn<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> authby=secret<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> auto=start<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> aggrmode=no<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> ike=3des-sha1;modp1024<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> ikelifetime=1440m<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> ## phase 1 ##<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> keyexchange=ike<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> rekey=no<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> rekeymargin=3m<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> keyingtries=%forever<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> ## phase 2 ##<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> phase2=esp<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> phase2alg=3des-sha1;modp1024<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> compress=no<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> # Perfect Forward Secrecy<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> pfs=yes<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> type=tunnel<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> left=321.321.321.82<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> leftsubnet=321.321.321.82/32<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> right=123.123.123.85<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> rightsubnet=123.123.123.28/24<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Output of ipsec verify:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Checking your system to see if IPsec got installed and started correctly:<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Version check and ipsec on-path [<span style="color:#40FF40">OK</span>]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Linux Openswan U2.6.38/K3.13.0-105-generic (netkey)<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Checking for IPsec support in kernel [<span style="color:#40FF40">OK</span>]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">SAref kernel support [<span style="color:#FFFF40">N/A</span>]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">NETKEY: Testing XFRM related proc values [<span style="color:#40FF40">OK</span>]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> [<span style="color:#40FF40">OK</span>]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> [<span style="color:#40FF40">OK</span>]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Checking that pluto is running [<span style="color:#40FF40">OK</span>]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Pluto listening for IKE on udp 500 [<span style="color:#40FF40">OK</span>]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Pluto listening for NAT-T on udp 4500 [<span style="color:#40FF40">OK</span>]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Two or more interfaces found, checking IP forwarding Checking NAT and MASQUERADEing [<span style="color:#40FF40">OK</span>]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Checking for 'ip' command [<span style="color:#40FF40">OK</span>]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Checking /bin/sh is not /bin/dash [<span style="color:#FFFF40">WARNING</span>]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Checking for 'iptables' command [<span style="color:#40FF40">OK</span>]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Opportunistic Encryption Support [<span style="color:#FFFF40">DISABLED</span>]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Syslog from restarting ipsec:<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Dec 14 11:47:36 dev ipsec_setup: Stopping Openswan IPsec...<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Dec 14 11:47:37 dev kernel: [86214.880112] NET: Unregistered protocol family 15<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Dec 14 11:47:37 dev ipsec_setup: ...Openswan IPsec stopped<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Dec 14 11:47:37 dev kernel: [86214.938903] NET: Registered protocol family 15<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Dec 14 11:47:37 dev ipsec_setup: Starting Openswan IPsec U2.6.38/K3.13.0-105-generic...<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Dec 14 11:47:37 dev ipsec_setup: Using NETKEY(XFRM) stack<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Dec 14 11:47:37 dev kernel: [86215.022321] Initializing XFRM netlink socket<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Dec 14 11:47:37 dev kernel: [86215.088946] AVX2 instructions are not detected.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Dec 14 11:47:37 dev kernel: [86215.114049] AVX2 or AES-NI instructions are not detected.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Dec 14 11:47:37 dev ipsec_setup: ...Openswan IPsec started<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Dec 14 11:47:37 dev pluto: adjusting ipsec.d to /etc/ipsec.d<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Dec 14 11:47:37 dev ipsec__plutorun: 002 added connection description "conn-name"<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console"">Dec 14 11:47:37 dev ipsec__plutorun: 104 "conn-name" #1: STATE_MAIN_I1: initiate<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal">Pluto log is just full of retransmits. No PSK error, nothing else.<o:p></o:p></p>
<p class="MsoNormal">The current status is that I am unable to even get the tunnel up, let alone understand why it won’t stay up. Any assistance would be greatly appreciated, if any other info is required I will be happy to supply.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Cheers,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Michael<o:p></o:p></p>
</div>
</body>
</html>