[Openswan Users]

Robert W. Burgholzer rburgholzer at maptech-inc.com
Mon Aug 30 17:48:12 CEST 2004


LapTop Windows XP to freeswan 2.04

Laptop is using a wireless lan card, going through a router via a dynamic 
IP. The initial connection is reported by the gateway, but then radio 
silence in the freeswan logs. Meanwhile, the oakley.log reports two 
messages that seemn bad to me: "CertFindExtenstion failed with 0" and 
"received an unencrypted packet when crypto active". I saw some postings 
that suggested some packet fragmentation was occuring (which is beyond my 
knowledge), so I regenerated the client certificate with 1024 bits, as this 
was a solution that supposedly worked before. No luck for me however. I am 
using the same ipsec.conf setup on the WinXP side as I have used for other 
WinXP clients that have had no trouble. The only difference that I can see 
initially is that the other clients (the ones that work) are not wireless.

Below are my freeswan logs, and oakley logs, any help would be appreciated.

Thanks,
Robert

Linux side:
Aug 30 16:23:01 www2 pluto[2485]: packet from 66.207.89.15:500: received 
Vendor ID Payload; ASCII hash: \036+Qi\005\031\034}|\026|?5\007da
Aug 30 16:23:01 www2 pluto[2485]: "maptech-client"[132] 66.207.89.15 #4623: 
responding to Main Mode from unknown peer 66.207.89.15
Aug 30 16:24:05 www2 pluto[2485]: "maptech-client"[132] 66.207.89.15 #4623: 
encrypted Informational Exchange message is invalid because it is for 
incomplete ISAKMP SA


Client oakley.log:
  8-30: 15:57:57:752:714 entered kill_old_policy_sas
  8-30: 15:58:18:301:b0 Acquire from driver: op=FFA6ADC0 src=192.168.0.100.0
dst=192.168.1.201.0 proto = 0, SrcMask=255.255.255.255, DstMask=255.255.255.0,
Tunnel 1, TunnelEndpt=a.b.c.d Inbound TunnelEndpt=192.168.0.100
  8-30: 15:58:18:331:714 Filter to match: Src a.b.c.d Dst 192.168.0.100
  8-30: 15:58:18:391:714 MM PolicyName: 3
  8-30: 15:58:18:391:714 MMPolicy dwFlags 2 SoftSAExpireTime 28800
  8-30: 15:58:18:391:714 MMOffer[0] LifetimeSec 28800 QMLimit 1 DHGroup 2
  8-30: 15:58:18:421:714 MMOffer[0] Encrypt: Triple DES CBC Hash: SHA
  8-30: 15:58:18:421:714 MMOffer[1] LifetimeSec 28800 QMLimit 1 DHGroup 2
  8-30: 15:58:18:421:714 MMOffer[1] Encrypt: Triple DES CBC Hash: MD5
  8-30: 15:58:18:421:714 MMOffer[2] LifetimeSec 28800 QMLimit 1 DHGroup 1
  8-30: 15:58:18:421:714 MMOffer[2] Encrypt: DES CBC Hash: SHA
  8-30: 15:58:18:421:714 MMOffer[3] LifetimeSec 28800 QMLimit 1 DHGroup 1
  8-30: 15:58:18:421:714 MMOffer[3] Encrypt: DES CBC Hash: MD5
  8-30: 15:58:18:421:714 Auth[0]:RSA Sig C=US, S=Virginia, L=Blacksburg,
O=MapTech Incorporated, OU=Network, CN=www2.maptech-inc.com,
E=rburgholzer at maptech-inc.com
  8-30: 15:58:18:421:714 QM PolicyName: Host-maptech-client filter action
dwFlags 1
  8-30: 15:58:18:421:714 QMOffer[0] LifetimeKBytes 50000 LifetimeSec 3600
  8-30: 15:58:18:421:714 QMOffer[0] dwFlags 0 dwPFSGroup 268435456
  8-30: 15:58:18:421:714  Algo[0] Operation: ESP Algo: Triple DES CBC HMAC: MD5
  8-30: 15:58:18:421:714 Starting Negotiation: src = 192.168.0.100.0000, dst =
12.5.17.226.0500, proto = 00, context = FFA6ADC0, ProxySrc =
192.168.0.100.0000, ProxyDst = 192.168.1.0.0000 SrcMask = 255.255.255.255
DstMask = 255.255.255.0
  8-30: 15:58:18:421:714 constructing ISAKMP Header
  8-30: 15:58:18:421:714 constructing SA (ISAKMP)
  8-30: 15:58:18:421:714 Constructing Vendor
  8-30: 15:58:18:421:714
  8-30: 15:58:18:421:714 Sending: SA = 0x000FEA00 to 12.5.17.226:Type 2
  8-30: 15:58:18:431:714 ISAKMP Header: (V1.0), len = 216
  8-30: 15:58:18:431:714   I-COOKIE 72db281985c1bc2a
  8-30: 15:58:18:431:714   R-COOKIE 0000000000000000
  8-30: 15:58:18:431:714   exchange: Oakley Main Mode
  8-30: 15:58:18:431:714   flags: 0
  8-30: 15:58:18:431:714   next payload: SA
  8-30: 15:58:18:431:714   message ID: 00000000
  8-30: 15:58:18:542:714
  8-30: 15:58:18:542:714 Receive: (get) SA = 0x000fea00 from 12.5.17.226
  8-30: 15:58:18:542:714 ISAKMP Header: (V1.0), len = 84
  8-30: 15:58:18:542:714   I-COOKIE 72db281985c1bc2a
  8-30: 15:58:18:542:714   R-COOKIE 1830a6b579ac5c77
  8-30: 15:58:18:542:714   exchange: Oakley Main Mode
  8-30: 15:58:18:542:714   flags: 0
  8-30: 15:58:18:542:714   next payload: SA
  8-30: 15:58:18:542:714   message ID: 00000000
  8-30: 15:58:18:542:714 processing payload SA
  8-30: 15:58:18:542:714 Received Phase 1 Transform 1
  8-30: 15:58:18:542:714      Encryption Alg Triple DES CBC(5)
  8-30: 15:58:18:542:714      Hash Alg SHA(2)
  8-30: 15:58:18:542:714      Oakley Group 2
  8-30: 15:58:18:542:714      Auth Method RSA Signature with Certificates(3)
  8-30: 15:58:18:542:714      Life type in Seconds
  8-30: 15:58:18:542:714      Life duration of 28800
  8-30: 15:58:18:542:714 Phase 1 SA accepted: transform=1
  8-30: 15:58:18:542:714 SA - Oakley proposal accepted
  8-30: 15:58:18:542:714 constructing ISAKMP Header
  8-30: 15:58:18:712:714 constructing KE
  8-30: 15:58:18:712:714 constructing NONCE (ISAKMP)
  8-30: 15:58:18:712:714
  8-30: 15:58:18:712:714 Sending: SA = 0x000FEA00 to 12.5.17.226:Type 2
  8-30: 15:58:18:712:714 ISAKMP Header: (V1.0), len = 184
  8-30: 15:58:18:712:714   I-COOKIE 72db281985c1bc2a
  8-30: 15:58:18:712:714   R-COOKIE 1830a6b579ac5c77
  8-30: 15:58:18:712:714   exchange: Oakley Main Mode
  8-30: 15:58:18:712:714   flags: 0
  8-30: 15:58:18:712:714   next payload: KE
  8-30: 15:58:18:712:714   message ID: 00000000
  8-30: 15:58:18:862:714
  8-30: 15:58:18:862:714 Receive: (get) SA = 0x000fea00 from 12.5.17.226
  8-30: 15:58:18:862:714 ISAKMP Header: (V1.0), len = 188
  8-30: 15:58:18:862:714   I-COOKIE 72db281985c1bc2a
  8-30: 15:58:18:862:714   R-COOKIE 1830a6b579ac5c77
  8-30: 15:58:18:862:714   exchange: Oakley Main Mode
  8-30: 15:58:18:862:714   flags: 0
  8-30: 15:58:18:862:714   next payload: KE
  8-30: 15:58:18:862:714   message ID: 00000000
  8-30: 15:58:18:862:714 processing payload KE
  8-30: 15:58:18:922:714 processing payload NONCE
  8-30: 15:58:18:922:714 processing payload CRP
  8-30: 15:58:18:922:714 constructing ISAKMP Header
  8-30: 15:58:18:922:714 constructing ID
  8-30: 15:58:18:922:714 Received no valid CRPs.  Using all configured
  8-30: 15:58:18:922:714 Looking for IPSec only cert
  8-30: 15:58:18:972:714 Cert Trustes.  0 100
  8-30: 15:58:18:972:714 CertFindExtenstion failed with 0

  8-30: 15:58:19:12:714 Entered CRL check
  8-30: 15:58:19:42:714 Left CRL check
  8-30: 15:58:19:42:714 Cert SHA Thumbprint eda6d473e2ca6ccaa5229d81606cd2d8
  8-30: 15:58:19:42:714 e55134ec
  8-30: 15:58:19:42:714 SubjectName: C=US, S=Virginia, L=Christiansburg,
O=MapTech Incorporated, OU=fieldservices, CN=maptechfs2,
E=efitchett at maptech-inc.com
  8-30: 15:58:19:42:714 Cert Serialnumber 09
  8-30: 15:58:19:42:714 Cert SHA Thumbprint eda6d473e2ca6ccaa5229d81606cd2d8
  8-30: 15:58:19:42:714 e55134ec
  8-30: 15:58:19:42:714 SubjectName: C=US, S=Virginia, L=Blacksburg, O=MapTech
Incorporated, OU=Network, CN=www2.maptech-inc.com,
E=rburgholzer at maptech-inc.com
  8-30: 15:58:19:42:714 Cert Serialnumber 00
  8-30: 15:58:19:42:714 Cert SHA Thumbprint 17c99d27eb1ee0efd37f17b294558bf1
  8-30: 15:58:19:42:714 81e25bbb
  8-30: 15:58:19:52:714 constructing CERT
  8-30: 15:58:19:52:714 Construct SIG
  8-30: 15:58:19:162:714 Constructing Cert Request
  8-30: 15:58:19:172:714 C=US, S=Virginia, L=Blacksburg, O=MapTech
Incorporated, OU=Network, CN=www2.maptech-inc.com,
E=rburgholzer at maptech-inc.com
  8-30: 15:58:19:172:714
  8-30: 15:58:19:172:714 Sending: SA = 0x000FEA00 to 12.5.17.226:Type 2
  8-30: 15:58:19:172:714 ISAKMP Header: (V1.0), len = 1980
  8-30: 15:58:19:172:714   I-COOKIE 72db281985c1bc2a
  8-30: 15:58:19:172:714   R-COOKIE 1830a6b579ac5c77
  8-30: 15:58:19:172:714   exchange: Oakley Main Mode
  8-30: 15:58:19:172:714   flags: 1 ( encrypted )
  8-30: 15:58:19:172:714   next payload: ID
  8-30: 15:58:19:172:714   message ID: 00000000
  8-30: 15:58:20:184:b8 retransmit: sa = 000FEA00 centry 00000000 , count = 1
  8-30: 15:58:20:184:b8
  8-30: 15:58:20:184:b8 Sending: SA = 0x000FEA00 to 12.5.17.226:Type 2
  8-30: 15:58:20:184:b8 ISAKMP Header: (V1.0), len = 1980
  8-30: 15:58:20:184:b8   I-COOKIE 72db281985c1bc2a
  8-30: 15:58:20:184:b8   R-COOKIE 1830a6b579ac5c77
  8-30: 15:58:20:184:b8   exchange: Oakley Main Mode
  8-30: 15:58:20:184:b8   flags: 1 ( encrypted )
  8-30: 15:58:20:184:b8   next payload: ID
  8-30: 15:58:20:184:b8   message ID: 00000000
  8-30: 15:58:22:187:b8 retransmit: sa = 000FEA00 centry 00000000 , count = 2
  8-30: 15:58:22:187:b8
  8-30: 15:58:22:187:b8 Sending: SA = 0x000FEA00 to 12.5.17.226:Type 2
  8-30: 15:58:22:187:b8 ISAKMP Header: (V1.0), len = 1980
  8-30: 15:58:22:187:b8   I-COOKIE 72db281985c1bc2a
  8-30: 15:58:22:187:b8   R-COOKIE 1830a6b579ac5c77
  8-30: 15:58:22:187:b8   exchange: Oakley Main Mode
  8-30: 15:58:22:187:b8   flags: 1 ( encrypted )
  8-30: 15:58:22:187:b8   next payload: ID
  8-30: 15:58:22:187:b8   message ID: 00000000
  8-30: 15:58:26:193:b8 retransmit: sa = 000FEA00 centry 00000000 , count = 3
  8-30: 15:58:26:193:b8
  8-30: 15:58:26:193:b8 Sending: SA = 0x000FEA00 to 12.5.17.226:Type 2
  8-30: 15:58:26:193:b8 ISAKMP Header: (V1.0), len = 1980
  8-30: 15:58:26:193:b8   I-COOKIE 72db281985c1bc2a
  8-30: 15:58:26:193:b8   R-COOKIE 1830a6b579ac5c77
  8-30: 15:58:26:193:b8   exchange: Oakley Main Mode
  8-30: 15:58:26:193:b8   flags: 1 ( encrypted )
  8-30: 15:58:26:193:b8   next payload: ID
  8-30: 15:58:26:193:b8   message ID: 00000000
  8-30: 15:58:28:856:714
  8-30: 15:58:28:856:714 Receive: (get) SA = 0x000fea00 from 12.5.17.226
  8-30: 15:58:28:856:714 ISAKMP Header: (V1.0), len = 188
  8-30: 15:58:28:856:714   I-COOKIE 72db281985c1bc2a
  8-30: 15:58:28:856:714   R-COOKIE 1830a6b579ac5c77
  8-30: 15:58:28:856:714   exchange: Oakley Main Mode
  8-30: 15:58:28:856:714   flags: 0
  8-30: 15:58:28:856:714   next payload: KE
  8-30: 15:58:28:856:714   message ID: 00000000
  8-30: 15:58:28:856:714 received an unencrypted packet when crypto active
  8-30: 15:58:28:856:714 GetPacket failed 35ec
  8-30: 15:58:34:194:b8 retransmit: sa = 000FEA00 centry 00000000 , count = 4
  8-30: 15:58:34:194:b8
  8-30: 15:58:34:194:b8 Sending: SA = 0x000FEA00 to 12.5.17.226:Type 2
  8-30: 15:58:34:194:b8 ISAKMP Header: (V1.0), len = 1980
  8-30: 15:58:34:194:b8   I-COOKIE 72db281985c1bc2a
  8-30: 15:58:34:194:b8   R-COOKIE 1830a6b579ac5c77
  8-30: 15:58:34:194:b8   exchange: Oakley Main Mode
  8-30: 15:58:34:194:b8   flags: 1 ( encrypted )
  8-30: 15:58:34:194:b8   next payload: ID
  8-30: 15:58:34:194:b8   message ID: 00000000
  8-30: 15:58:48:865:714
  8-30: 15:58:48:865:714 Receive: (get) SA = 0x000fea00 from 12.5.17.226
  8-30: 15:58:48:865:714 ISAKMP Header: (V1.0), len = 188
  8-30: 15:58:48:865:714   I-COOKIE 72db281985c1bc2a
  8-30: 15:58:48:865:714   R-COOKIE 1830a6b579ac5c77
  8-30: 15:58:48:865:714   exchange: Oakley Main Mode
  8-30: 15:58:48:865:714   flags: 0
  8-30: 15:58:48:865:714   next payload: KE
  8-30: 15:58:48:865:714   message ID: 00000000
  8-30: 15:58:48:865:714 received an unencrypted packet when crypto active
  8-30: 15:58:48:865:714 GetPacket failed 35ec
  8-30: 15:58:50:197:b8 retransmit: sa = 000FEA00 centry 00000000 , count = 5
  8-30: 15:58:50:197:b8
  8-30: 15:58:50:197:b8 Sending: SA = 0x000FEA00 to 12.5.17.226:Type 2
  8-30: 15:58:50:197:b8 ISAKMP Header: (V1.0), len = 1980
  8-30: 15:58:50:197:b8   I-COOKIE 72db281985c1bc2a
  8-30: 15:58:50:197:b8   R-COOKIE 1830a6b579ac5c77
  8-30: 15:58:50:197:b8   exchange: Oakley Main Mode
  8-30: 15:58:50:197:b8   flags: 1 ( encrypted )
  8-30: 15:58:50:197:b8   next payload: ID
  8-30: 15:58:50:197:b8   message ID: 00000000
  8-30: 15:59:22:203:b8 retransmit exhausted: sa = 000FEA00 centry 00000000,
count = 6
  8-30: 15:59:22:203:b8 SA Dead. sa:000FEA00 status:35ed
  8-30: 15:59:22:203:b8 isadb_set_status sa:000FEA00 centry:00000000 status
35ed
  8-30: 15:59:22:574:b8 Key Exchange Mode (Main Mode)


  8-30: 15:59:22:584:b8 Source IP Address 192.168.0.100

Source IP Address Mask 255.255.255.255

Destination IP Address 12.5.17.226

Destination IP Address Mask 255.255.255.255

Protocol 0

Source Port 0

Destination Port 0

IKE Local Addr

IKE Peer Addr


  8-30: 15:59:22:584:b8 Certificate based Identity.

Peer Subject

Peer SHA Thumbprint 0000000000000000000000000000000000000000

Peer Issuing Certificate Authority

Root Certificate Authority

My Subject C=US, S=Virginia, L=Christiansburg, O=MapTech Incorporated,
OU=fieldservices, CN=maptechfs2, E=efitchett at maptech-inc.com

My SHA Thumbprint eda6d473e2ca6ccaa5229d81606cd2d8e55134ec

Peer IP Address: 12.5.17.226


  8-30: 15:59:22:584:b8 Me


  8-30: 15:59:22:584:b8 Negotiation timed out


  8-30: 15:59:22:584:b8 0x0 0x0
  8-30: 15:59:22:584:b8 constructing ISAKMP Header
  8-30: 15:59:22:584:b8 constructing HASH (null)
  8-30: 15:59:22:584:b8 constructing DELETE. MM 000FEA00
  8-30: 15:59:22:584:b8 constructing HASH (Notify/Delete)
  8-30: 15:59:22:584:b8
  8-30: 15:59:22:584:b8 Sending: SA = 0x000FEA00 to 12.5.17.226:Type 1
  8-30: 15:59:22:584:b8 ISAKMP Header: (V1.0), len = 84
  8-30: 15:59:22:584:b8   I-COOKIE 72db281985c1bc2a
  8-30: 15:59:22:584:b8   R-COOKIE 1830a6b579ac5c77
  8-30: 15:59:22:584:b8   exchange: ISAKMP Informational Exchange
  8-30: 15:59:22:584:b8   flags: 1 ( encrypted )
  8-30: 15:59:22:584:b8   next payload: HASH
  8-30: 15:59:22:584:b8   message ID: 7c20d95d



Robert Burgholzer
Environmental Engineer
MapTech Inc.
http://www.maptech-inc.com/ 



More information about the Users mailing list