[Openswan Users] OpenS/WAN and Win2K/XP
David Spear
dspear at telus.net
Mon Jan 24 15:47:54 CET 2005
>
> conn roadwarrior
> left=%any
> right=192.168.1.101
> rightid=explorer.fdns.net
>Either leave out the rightid= or use the X.509 subjectname. Not a
hostname.
Okay, here's my new win2k ipsec.conf:
**************begin win2k ipsec.conf****************
conn roadwarrior
left=%any
right=192.168.1.101
rightca="C=CA, S=BC, L=Penticton, O=HMEXC, CN=remote"
network=auto
auto=start
pfs=yes
conn roadwarrior-net
left=%any
right=192.168.1.101
rightsubnet=192.168.1.0/24
rightca="C=CA, S=BC, L=Penticton, O=HMEXC, CN=remote"
network=auto
auto=start
pfs=yes
****************end win2k ipsec.conf*******************
> rightca="C=CA, S=BC, L=Penticton, O=H&M Excavating Ltd.,
>CN=samesub"
>
>You've ignored a few warnings about 'do not use weird symbols such as
"&"'. >Try
>generating certificates without nonstandard characters.
As you can see, I am using a new cert, started from the ground up: new
CA, new cert, everything is new with no "&" or other funky characters.
However, things seem to have gotten worse, not better. Here's my
openswan ipsec.conf, revised:
**************begin openswan ipsec.conf**********************
version 2.0 # conforms to second version of ipsec.conf specification
# basic configuration
config setup
# Debug-logging controls: "none" for (almost) none, "all" for
lots.
# klipsdebug=all
plutodebug=all
# crlcheckinterval=600
# strictcrlpolicy=yes
myid=@explorer.fdns.net
conn %default
rightrsasigkey=%cert
leftrsasigkey=%cert
authby=rsasig
disablearrivalcheck=no
compress=yes
keyingtries=1
conn roadwarrior-net
leftsubnet=192.168.1.0/24
also=roadwarrior
conn roadwarrior-all
leftsubnet=0.0.0.0/0
also=roadwarrior
conn roadwarrior
left=192.168.1.101
leftcert=remote.pem
right=%any
auto=add
pfs=yes
******************end openswan ipsec.conf*******************
Now here's the bad part, my Pluto log. It does not appear that I am
getting nearly as far as I was before. I completely removed all certs
and policies from my win2k box, imported new certs, changed ipsec.conf
to reflect new info.
****************begin Pluto log*****************************
Jan 24 15:04:56 explorer pluto[756]: | instantiated "roadwarrior" for
192.168.1.102
Jan 24 15:04:56 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #1:
responding to Main Mode from unknown peer 192.168.1.102
Jan 24 15:04:58 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #1:
transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Jan 24 15:05:00 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #2:
responding to Main Mode from unknown peer 192.168.1.102
Jan 24 15:05:02 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #2:
transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Jan 24 15:05:03 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #3:
responding to Main Mode from unknown peer 192.168.1.102
Jan 24 15:05:05 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #3:
transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Jan 24 15:05:08 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #1:
discarding packet received during DNS lookup in STATE_MAIN_R1
Jan 24 15:05:09 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #1:
discarding packet received during DNS lookup in STATE_MAIN_R1
Jan 24 15:05:10 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #1:
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Jan 24 15:05:12 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #1:
ignoring Delete SA payload: not encrypted
Jan 24 15:05:12 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #1:
received and ignored informational message
Jan 24 15:05:12 explorer pluto[756]: | handling event EVENT_RETRANSMIT
for 192.168.1.102 "roadwarrior" #2
Jan 24 15:05:13 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #3:
ignoring informational payload, type INVALID_COOKIE
Jan 24 15:05:13 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #3:
received and ignored informational message
Jan 24 15:05:13 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #1:
ignoring informational payload, type INVALID_COOKIE
Jan 24 15:05:13 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #1:
received and ignored informational message
Jan 24 15:05:14 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #2:
ignoring informational payload, type INVALID_COOKIE
*******************end Pluto log********************************
and so forth until I get "max number of retransmits" and "deleting
connection to..."
Sorry for the length, but here's the raw log:
*******************begin Pluto log*****************************
Jan 24 15:05:10 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #1:
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Jan 24 15:05:10 explorer pluto[756]: | sending reply packet
Jan 24 15:05:10 explorer pluto[756]: | sending 180 bytes for
STATE_MAIN_R1 through eth0 to 192.168.1.102:500:
Jan 24 15:05:10 explorer pluto[756]: | 79 cd 50 99 03 de 87 d3 04 a9
e1 af 27 f0 6d 51
Jan 24 15:05:10 explorer pluto[756]: | 04 10 02 00 00 00 00 00 00 00
00 b4 0a 00 00 84
Jan 24 15:05:10 explorer pluto[756]: | ad 98 90 0f 77 6c 5a 34 ef b3
70 4f d9 eb 97 4a
Jan 24 15:05:10 explorer pluto[756]: | e5 90 47 09 da ca 58 37 51 7b
8c 41 b1 20 d8 62
Jan 24 15:05:11 explorer pluto[756]: | 46 78 d6 d0 bd 73 0e 22 2b 62
b9 0b 0f 3e c9 b6
Jan 24 15:05:11 explorer pluto[756]: | 86 5a 3d 89 d3 83 a6 0b 2e 3c
e3 e4 33 96 40 b4
Jan 24 15:05:11 explorer pluto[756]: | e3 61 4d 6d c3 00 4a e7 b1 80
2f ce c6 09 d5 2d
Jan 24 15:05:11 explorer pluto[756]: | bf 35 82 c5 9f d6 15 49 d4 e7
3e 18 09 0e 3b b2
Jan 24 15:05:11 explorer pluto[756]: | c7 4b a3 1c e3 84 a7 01 77 48
df 1b 44 bd 16 6c
Jan 24 15:05:11 explorer pluto[756]: | cb f7 bb 82 83 06 b5 fe 10 0e
e1 76 12 bb ff da
Jan 24 15:05:11 explorer pluto[756]: | 00 00 00 14 56 02 b9 31 d3 d9
0d 7e a7 b2 9e 8a
Jan 24 15:05:11 explorer pluto[756]: | 9f 3a 86 93
Jan 24 15:05:11 explorer pluto[756]: | inserting event EVENT_RETRANSMIT,
timeout in 10 seconds for #1
Jan 24 15:05:11 explorer pluto[756]: | modecfg pull: noquirk policy:push
not-client
Jan 24 15:05:11 explorer pluto[756]: | phase 1 is done, looking for
phase 1 to unpend
Jan 24 15:05:11 explorer pluto[756]: | next event EVENT_RETRANSMIT in 1
seconds for #2
Jan 24 15:05:11 explorer pluto[756]: |
Jan 24 15:05:11 explorer pluto[756]: | *received 56 bytes from
192.168.1.102:500 on eth0
Jan 24 15:05:11 explorer pluto[756]: | 79 cd 50 99 03 de 87 d3 04 a9
e1 af 27 f0 6d 51
Jan 24 15:05:11 explorer pluto[756]: | 0c 10 05 00 c6 32 9c 42 00 00
00 38 00 00 00 1c
Jan 24 15:05:11 explorer pluto[756]: | 00 00 00 01 01 10 00 01 79 cd
50 99 03 de 87 d3
Jan 24 15:05:11 explorer pluto[756]: | 04 a9 e1 af 27 f0 6d 51
Jan 24 15:05:11 explorer pluto[756]: | **parse ISAKMP Message:
Jan 24 15:05:11 explorer pluto[756]: | initiator cookie:
Jan 24 15:05:11 explorer pluto[756]: | 79 cd 50 99 03 de 87 d3
Jan 24 15:05:11 explorer pluto[756]: | responder cookie:
Jan 24 15:05:11 explorer pluto[756]: | 04 a9 e1 af 27 f0 6d 51
Jan 24 15:05:11 explorer pluto[756]: | next payload type:
ISAKMP_NEXT_D
Jan 24 15:05:11 explorer pluto[756]: | ISAKMP version: ISAKMP Version
1.0
Jan 24 15:05:11 explorer pluto[756]: | exchange type:
ISAKMP_XCHG_INFO
Jan 24 15:05:11 explorer pluto[756]: | flags: none
Jan 24 15:05:11 explorer pluto[756]: | message ID: c6 32 9c 42
Jan 24 15:05:11 explorer pluto[756]: | length: 56
Jan 24 15:05:11 explorer pluto[756]: | ICOOKIE: 79 cd 50 99 03 de 87
d3
Jan 24 15:05:11 explorer pluto[756]: | RCOOKIE: 04 a9 e1 af 27 f0 6d
51
Jan 24 15:05:11 explorer pluto[756]: | peer: c0 a8 01 66
Jan 24 15:05:11 explorer pluto[756]: | state hash entry 7
Jan 24 15:05:11 explorer pluto[756]: | peer and cookies match on #1,
provided msgid 00000000 vs 00000000
Jan 24 15:05:11 explorer pluto[756]: | state object #1 found, in
STATE_MAIN_R2
Jan 24 15:05:11 explorer pluto[756]: | ***parse ISAKMP Delete Payload:
Jan 24 15:05:11 explorer pluto[756]: | next payload type:
ISAKMP_NEXT_NONE
Jan 24 15:05:11 explorer pluto[756]: | length: 28
Jan 24 15:05:11 explorer pluto[756]: | DOI: ISAKMP_DOI_IPSEC
Jan 24 15:05:11 explorer pluto[756]: | protocol ID: 1
Jan 24 15:05:11 explorer pluto[756]: | SPI size: 16
Jan 24 15:05:11 explorer pluto[756]: | number of SPIs: 1
Jan 24 15:05:12 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #1:
ignoring Delete SA payload: not encrypted
Jan 24 15:05:12 explorer pluto[756]: | del: 79 cd 50 99 03 de 87 d3
04 a9 e1 af 27 f0 6d 51
Jan 24 15:05:12 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #1:
received and ignored informational message
Jan 24 15:05:12 explorer pluto[756]: | complete state transition with
STF_IGNORE
Jan 24 15:05:12 explorer pluto[756]: | next event EVENT_RETRANSMIT in 0
seconds for #2
Jan 24 15:05:12 explorer pluto[756]: |
Jan 24 15:05:12 explorer pluto[756]: | *time to handle event
Jan 24 15:05:12 explorer pluto[756]: | handling event EVENT_RETRANSMIT
Jan 24 15:05:12 explorer pluto[756]: | event after this is
EVENT_RETRANSMIT in 3 seconds
Jan 24 15:05:12 explorer pluto[756]: | handling event EVENT_RETRANSMIT
for 192.168.1.102 "roadwarrior" #2
Jan 24 15:05:12 explorer pluto[756]: | sending 104 bytes for
EVENT_RETRANSMIT through eth0 to 192.168.1.102:500:
Jan 24 15:05:12 explorer pluto[756]: | 79 cd 50 99 03 de 87 d3 32 50
57 e4 7f fa 16 74
Jan 24 15:05:12 explorer pluto[756]: | 01 10 02 00 00 00 00 00 00 00
00 68 0d 00 00 38
Jan 24 15:05:12 explorer pluto[756]: | 00 00 00 01 00 00 00 01 00 00
00 2c 01 01 00 01
Jan 24 15:05:12 explorer pluto[756]: | 00 00 00 24 01 01 00 00 80 01
00 05 80 02 00 02
Jan 24 15:05:12 explorer pluto[756]: | 80 04 00 02 80 03 00 03 80 0b
00 01 00 0c 00 04
Jan 24 15:05:12 explorer pluto[756]: | 00 00 70 80 00 00 00 14 af ca
d7 13
68 a1 f1 c9
Jan 24 15:05:12 explorer pluto[756]: | 6b 86 96 fc 77 57 01 00
Jan 24 15:05:12 explorer pluto[756]: | inserting event EVENT_RETRANSMIT,
timeout in 20 seconds for #2
Jan 24 15:05:12 explorer pluto[756]: | next event EVENT_RETRANSMIT in 3
seconds for #3
Jan 24 15:05:12 explorer pluto[756]: |
Jan 24 15:05:12 explorer pluto[756]: | *received 56 bytes from
192.168.1.102:500 on eth0
Jan 24 15:05:12 explorer pluto[756]: | 79 cd 50 99 03 de 87 d3 b1 29
99 01 fe 22 c8 62
Jan 24 15:05:12 explorer pluto[756]: | 0b 10 05 00 07 e7 58 ab 00 00
00 38 00 00 00 1c
Jan 24 15:05:12 explorer pluto[756]: | 00 00 00 01 01 10 00 04 79 cd
50 99 03 de 87 d3
Jan 24 15:05:12 explorer pluto[756]: | b1 29 99 01 fe 22 c8 62
Jan 24 15:05:12 explorer pluto[756]: | **parse ISAKMP Message:
Jan 24 15:05:12 explorer pluto[756]: | initiator cookie:
Jan 24 15:05:12 explorer pluto[756]: | 79 cd 50 99 03 de 87 d3
Jan 24 15:05:12 explorer pluto[756]: | responder cookie:
Jan 24 15:05:12 explorer pluto[756]: | b1 29 99 01 fe 22 c8 62
Jan 24 15:05:12 explorer pluto[756]: | next payload type:
ISAKMP_NEXT_N
Jan 24 15:05:12 explorer pluto[756]: | ISAKMP version: ISAKMP Version
1.0
Jan 24 15:05:12 explorer pluto[756]: | exchange type:
ISAKMP_XCHG_INFO
Jan 24 15:05:12 explorer pluto[756]: | flags: none
Jan 24 15:05:12 explorer pluto[756]: | message ID: 07 e7 58 ab
Jan 24 15:05:12 explorer pluto[756]: | length: 56
Jan 24 15:05:12 explorer pluto[756]: | ICOOKIE: 79 cd 50 99 03 de 87
d3
Jan 24 15:05:12 explorer pluto[756]: | RCOOKIE: b1 29 99 01 fe 22 c8
62
Jan 24 15:05:12 explorer pluto[756]: | peer: c0 a8 01 66
Jan 24 15:05:12 explorer pluto[756]: | state hash entry 13
Jan 24 15:05:12 explorer pluto[756]: | peer and cookies match on #3,
provided msgid 00000000 vs 00000000
Jan 24 15:05:12 explorer pluto[756]: | state object #3 found, in
STATE_MAIN_R1
Jan 24 15:05:12 explorer pluto[756]: | ***parse ISAKMP Notification
Payload:
Jan 24 15:05:13 explorer pluto[756]: | next payload type:
ISAKMP_NEXT_NONE
Jan 24 15:05:13 explorer pluto[756]: | length: 28
Jan 24 15:05:13 explorer pluto[756]: | DOI: ISAKMP_DOI_IPSEC
Jan 24 15:05:13 explorer pluto[756]: | protocol ID: 1
Jan 24 15:05:13 explorer pluto[756]: | SPI size: 16
Jan 24 15:05:13 explorer pluto[756]: | Notify Message Type:
INVALID_COOKIE
Jan 24 15:05:13 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #3:
ignoring informational payload, type INVALID_COOKIE
Jan 24 15:05:13 explorer pluto[756]: | info: 79 cd 50 99 03 de 87 d3
b1 29 99 01 fe 22 c8 62
Jan 24 15:05:13 explorer pluto[756]: "roadwarrior"[1] 192.168.1.102 #3:
received and ignored informational message
Jan 24 15:05:13 explorer pluto[756]: | complete state transition with
STF_IGNORE
Jan 24 15:05:13 explorer pluto[756]: | next event EVENT_RETRANSMIT in 2
seconds for #3
**********************end Pluto log****************************
and so forth.
And just for fun, here is:
% openssl x509 -in remote.pem -noout -subject
subject= /C=CA/ST=BC/L=Penticton/O=HMEXC/CN=remote
I think I've spent about 3 days now with no end in sight...
More information about the Users
mailing list