[Openswan Users] nated vpn

Alberto Gallardo agallardo at LACASA.ES
Fri Apr 22 13:36:42 CEST 2005


Hello everybody.
 
I am trying to established a vpn connections between two linux suse 9.2 with openswan 2.3.1.
One linux server is behind an adsl router and the another linux is behind another.
 
Is there a good guide or example that explains how configure this?
 
I have my current configuration with PSK authentication. 
Here are the traces of one of the linux: It sends "phase 1 I ident" and "receives a phase R ident" but it seems not to 
authenticate the preshared secret.
 
ipsec.secret on linux 1:
192.168.254.3 a.b.c.d : PSK "mysecret"
ipsec.secret on linux 2:
192.168.250.3 e.f.g.h : PSK  "mysecret"
 
a.b.c.d is the public ip of adsl router 1
e.f.g.h is the public ip of adsl router 2
 
 
Apr 22 12:07:41 backup pluto[2094]: | *received 136 bytes from a.b.c.d:500 on eth0 (port=500)
Apr 22 12:07:41 backup pluto[2094]: | **parse ISAKMP Message:
Apr 22 12:07:41 backup pluto[2094]: |    initiator cookie:
Apr 22 12:07:41 backup pluto[2094]: |   98 11 e5 30  51 e5 bf 64
Apr 22 12:07:41 backup pluto[2094]: |    responder cookie:
Apr 22 12:07:41 backup pluto[2094]: |   6a 01 af 33  59 92 35 94
Apr 22 12:07:41 backup pluto[2094]: |    next payload type: ISAKMP_NEXT_SA
Apr 22 12:07:41 backup pluto[2094]: |    ISAKMP version: ISAKMP Version 1.0
Apr 22 12:07:41 backup pluto[2094]: |    exchange type: ISAKMP_XCHG_IDPROT
Apr 22 12:07:41 backup pluto[2094]: |    flags: none
Apr 22 12:07:41 backup pluto[2094]: |    message ID:  00 00 00 00
Apr 22 12:07:41 backup pluto[2094]: |    length: 136
Apr 22 12:07:41 backup pluto[2094]: | ICOOKIE:  98 11 e5 30  51 e5 bf 64
Apr 22 12:07:41 backup pluto[2094]: | RCOOKIE:  6a 01 af 33  59 92 35 94
Apr 22 12:07:41 backup pluto[2094]: | peer:  51 21 19 8a
Apr 22 12:07:41 backup pluto[2094]: | state hash entry 13
Apr 22 12:07:41 backup pluto[2094]: | state object not found
Apr 22 12:07:41 backup pluto[2094]: | ICOOKIE:  98 11 e5 30  51 e5 bf 64
Apr 22 12:07:41 backup pluto[2094]: | RCOOKIE:  00 00 00 00  00 00 00 00
Apr 22 12:07:41 backup pluto[2094]: | peer:  51 21 19 8a
Apr 22 12:07:41 backup pluto[2094]: | state hash entry 2
Apr 22 12:07:41 backup pluto[2094]: | peer and cookies match on #1, provided msgid 00000000 vs 00000000
Apr 22 12:07:41 backup pluto[2094]: | state object #1 found, in STATE_MAIN_I1
Apr 22 12:07:41 backup pluto[2094]: | processing connection linux1-linux2
Apr 22 12:07:41 backup pluto[2094]: | ***parse ISAKMP Security Association Payload:
Apr 22 12:07:41 backup pluto[2094]: |    next payload type: ISAKMP_NEXT_VID
Apr 22 12:07:41 backup pluto[2094]: |    length: 52
Apr 22 12:07:41 backup pluto[2094]: |    DOI: ISAKMP_DOI_IPSEC
Apr 22 12:07:41 backup pluto[2094]: | ***parse ISAKMP Vendor ID Payload:
Apr 22 12:07:41 backup pluto[2094]: |    next payload type: ISAKMP_NEXT_VID
Apr 22 12:07:41 backup pluto[2094]: |    length: 16
Apr 22 12:07:41 backup pluto[2094]: | ***parse ISAKMP Vendor ID Payload:
Apr 22 12:07:41 backup pluto[2094]: |    next payload type: ISAKMP_NEXT_VID
Apr 22 12:07:41 backup pluto[2094]: |    length: 20
Apr 22 12:07:41 backup pluto[2094]: | ***parse ISAKMP Vendor ID Payload:
Apr 22 12:07:41 backup pluto[2094]: |    next payload type: ISAKMP_NEXT_NONE
Apr 22 12:07:41 backup pluto[2094]: |    length: 20
Apr 22 12:07:41 backup pluto[2094]: "linux1-linux2" #1: received Vendor ID payload [Openswan (this version) 2.3.1  X.509-1.5.4 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR]
Apr 22 12:07:41 backup pluto[2094]: "linux1-linux2" #1: received Vendor ID payload [Dead Peer Detection]
Apr 22 12:07:41 backup pluto[2094]: "linux1-linux2" #1: received Vendor ID payload [RFC 3947] method set to=109
Apr 22 12:07:41 backup pluto[2094]: | ****parse IPsec DOI SIT:
Apr 22 12:07:41 backup pluto[2094]: |    IPsec DOI SIT: SIT_IDENTITY_ONLY
Apr 22 12:07:41 backup pluto[2094]: | ****parse ISAKMP Proposal Payload:
Apr 22 12:07:41 backup pluto[2094]: |    next payload type: ISAKMP_NEXT_NONE
Apr 22 12:07:41 backup pluto[2094]: |    length: 40
Apr 22 12:07:41 backup pluto[2094]: |    proposal number: 0
Apr 22 12:07:41 backup pluto[2094]: |    protocol ID: PROTO_ISAKMP
Apr 22 12:07:41 backup pluto[2094]: |    SPI size: 0
Apr 22 12:07:41 backup pluto[2094]: |    number of transforms: 1
Apr 22 12:07:41 backup pluto[2094]: | *****parse ISAKMP Transform Payload (ISAKMP):
Apr 22 12:07:41 backup pluto[2094]: |    next payload type: ISAKMP_NEXT_NONE
Apr 22 12:07:41 backup pluto[2094]: |    length: 32
Apr 22 12:07:41 backup pluto[2094]: |    transform number: 0
Apr 22 12:07:41 backup pluto[2094]: |    transform ID: KEY_IKE
Apr 22 12:07:41 backup pluto[2094]: | ******parse ISAKMP Oakley attribute:
Apr 22 12:07:41 backup pluto[2094]: |    af+type: OAKLEY_LIFE_TYPE
Apr 22 12:07:41 backup pluto[2094]: |    length/value: 1
Apr 22 12:07:41 backup pluto[2094]: |    [1 is OAKLEY_LIFE_SECONDS]
Apr 22 12:07:41 backup pluto[2094]: | ******parse ISAKMP Oakley attribute:
Apr 22 12:07:41 backup pluto[2094]: |    af+type: OAKLEY_LIFE_DURATION
Apr 22 12:07:41 backup pluto[2094]: |    length/value: 3600
Apr 22 12:07:41 backup pluto[2094]: | ******parse ISAKMP Oakley attribute:
Apr 22 12:07:41 backup pluto[2094]: |    af+type: OAKLEY_ENCRYPTION_ALGORITHM
Apr 22 12:07:41 backup pluto[2094]: |    length/value: 5
Apr 22 12:07:41 backup pluto[2094]: |    [5 is OAKLEY_3DES_CBC]
Apr 22 12:07:41 backup pluto[2094]: | ******parse ISAKMP Oakley attribute:
Apr 22 12:07:41 backup pluto[2094]: |    af+type: OAKLEY_HASH_ALGORITHM
Apr 22 12:07:41 backup pluto[2094]: |    length/value: 1
Apr 22 12:07:41 backup pluto[2094]: |    [1 is OAKLEY_MD5]
Apr 22 12:07:41 backup pluto[2094]: | ******parse ISAKMP Oakley attribute:
Apr 22 12:07:41 backup pluto[2094]: |    af+type: OAKLEY_AUTHENTICATION_METHOD
Apr 22 12:07:41 backup pluto[2094]: |    length/value: 1
Apr 22 12:07:41 backup pluto[2094]: |    [1 is OAKLEY_PRESHARED_KEY]
Apr 22 12:07:41 backup pluto[2094]: | started looking for secret for 192.168.254.3->a.b.c.d of kind PPK_PSK
Apr 22 12:07:41 backup pluto[2094]: | actually looking for secret for 192.168.254.3->a.b.c.dof kind PPK_PSK
Apr 22 12:07:41 backup pluto[2094]: | 1: compared PSK a.b.c.d to 192.168.254.3 / a.b.c.d-> 0
Apr 22 12:07:41 backup pluto[2094]: | 2: compared PSK 192.168.254.3 to 192.168.254.3 / a.b.c.d-> 4
Apr 22 12:07:41 backup pluto[2094]: | concluding with best_match=0 best=(nil) (lineno=-1)
Apr 22 12:07:41 backup pluto[2094]: "linux1-linux2" #1: Can't authenticate: no preshared key found for `192.168.254.3' and `a.b.c.d'.  Attribute OAKLEY_AUTHENTICATION_METHOD
Apr 22 12:07:41 backup pluto[2094]: "linux1-linux2" #1: no acceptable Oakley Transform
Apr 22 12:07:41 backup pluto[2094]: | complete state transition with (null)
Apr 22 12:07:41 backup pluto[2094]: "linux1-linux2" #1: sending notification NO_PROPOSAL_CHOSEN to a.b.c.d:500
Apr 22 12:07:41 backup pluto[2094]: "linux1-linux2" #1: failed to build notification for spisize=0
Apr 22 12:07:41 backup pluto[2094]: | state transition function for STATE_MAIN_I1 failed: NO_PROPOSAL_CHOSEN
Apr 22 12:07:41 backup pluto[2094]: | next event EVENT_PENDING_PHASE2 in 119 seconds

 

________________________________ 
Alberto Gallardo Doñate 
Departamento Sistemas de Información
Grupo Lacasa 
Tfno.: 976-462111 Ext. 337, Fax : 976772091 
mailto:agallardo at lacasa.es 

 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.openswan.org/pipermail/users/attachments/20050422/b0ae9c90/attachment-0001.htm


More information about the Users mailing list