[Openswan Users] freeswan-1.99: cannot respond to IPsec SA
Wolfman
BulletinCatcher at web.de
Mon Mar 29 23:41:29 CEST 2004
Hi,
I got a very similar Problem, if not the same:
I have the NAT-T patch installed and working (finally), but it didn't help.
Some TIP: Kompile Kernel without patches, apply patch fox x.509, compile it
again, apply NAT-T patch, compile it again. It really takes time, but
whenever I tried it on another way, it failed. So this are nearly 5
compiler runs.
Ok, back to the Problem, as I said, my NAT-T is working:
Mar 29 21:17:29 Linuxserver pluto[2218]: Starting Pluto (Openswan Version
2.1.0 X.509-1.4.8 PLUTO_USES_KEYRR)
Mar 29 21:17:29 Linuxserver pluto[2218]: including NAT-Traversal patch
(Version 0.6c)
I found something in the google groups, that told me to write down the
remote IP into my ipsec.conf. I did so, nothing changed
I pasted my ipsec.conf and my auth.log. If someone knows how to help, would
be great.
psec.conf:
config setup
nat_traversal=yes
# Add connections here.
conn %default
keyingtries=0
disablearrivalcheck=no
authby=rsasig
rightrsasigkey=%cert
auto=add
left=%defaultroute
leftrsasigkey=%cert
leftcert=VPN-Gateway-Cert.pem
leftid="<Certificate ID>"
leftupdown=/usr/lib/ipsec/_updown_x509
conn p2n
right=%any
leftsubnet=192.168.107.0/24
rightsubnet=192.168.107.123/32
conn n2n
right=%any
rightsubnetwithin=192.168.0.0/24
leftsubnet=192.168.107.0/24
rightsubnet=192.168.107.123/32
conn block
auto=ignore
conn private
auto=ignore
conn private-or-clear
auto=ignore
conn clear
auto=ignore
conn packetdefault
auto=ignore
-------------------------------------------------
auth.log:
Mar 29 21:17:41 Linuxserver pluto[2218]: "p2n"[2] 192.168.107.123 #1:
transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Mar 29 21:17:41 Linuxserver pluto[2218]: "p2n"[2] 192.168.107.123 #1: sent
MR3, ISAKMP SA established
Mar 29 21:17:41 Linuxserver pluto[2218]: "p2n"[2] 192.168.107.123 #1:
cannot respond to IPsec SA request because no connection is known for
80.137.27.45[<Certificate ID>]:17/1701...192.168.107.123[<Certificate
ID>]:17/1701
Mar 29 21:17:42 Linuxserver pluto[2218]: "p2n"[2] 192.168.107.123 #1: Quick
Mode I1 message is unacceptable because it uses a previously used Message
ID 0x670b6e24 (perhaps this is a duplicated packet)
Mar 29 21:17:56 Linuxserver last message repeated 3 times
Mar 29 21:17:59 Linuxserver pluto[2218]: "p2n"[2] 192.168.107.123 #1:
received Delete SA payload: deleting ISAKMP State #1
Mar 29 21:17:59 Linuxserver pluto[2218]: "p2n"[2] 192.168.107.123: deleting
connection "p2n" instance with peer 192.168.107.123 {isakmp=#0/ipsec=#0}
More information about the Users
mailing list