[Openswan Users] NAT Problem?

Miguel Ángel Domínguez Durán mdominguez at cherrytel.com
Wed Mar 9 12:00:46 CET 2005


Hello again,
I've changed the configuration in the server and the client following your 
recomendations and it seems like the NAT problem is resolved! Thanks
But know, it seems like another different problem has arised, something 
related with a malformed payload packet.
Here is the ipsec.conf in the VPN server:

version 2.0

config setup
        interfaces=%defaultroute
        nat_traversal=yes
        plutodebug=all
        virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16

conn windows
        auto=add
        authby=rsasig
        left=%any
        leftid="C=ES, S=MALAGA, L=MALAGA, O=CHERRYTEL COMUNICACIONES S.L., 
O=INTERNET, CN=CHERRYTEL COMUNICACIONES S.L., E=soporte at cherrytel.com"
        leftrsasigkey=%cert
        right=213.9.234.19
        rightsubnet=213.9.234.0/24
        rightnexthop=213.9.234.1
        rightcert=vpncherry.cherrytel.com.pem
        pfs=yes
        keyingtries=0

#Disable Opportunistic Encryption
include /etc/ipsec.d/examples/no_oe.conf

The ipsec.conf in the Windows roadwarrior machine is:
conn windows
        left=%any
        right=213.9.234.19
        rightsubnet=213.9.234.0/24
        rightca="C=ES, ST=MALAGA, L=MALAGA, O=CHERRYTEL COMUNICACIONES S.L., 
OU=INTERNET, CN=S, E=soporte at cherrytel.com"
        network=auto
        auto=start
        pfs=yes

The log at /var/secure is:
Mar  9 11:40:12 vpn ipsec__plutorun: Starting Pluto subsystem...
Mar  9 11:40:13 vpn pluto[2086]: Starting Pluto (Openswan Version 2.3.0 
X.509-1.5.4 PLUTO_USES_KEYRR)
Mar  9 11:40:13 vpn pluto[2086]: Setting port floating to on
Mar  9 11:40:13 vpn pluto[2086]: port floating activate 1/1
Mar  9 11:40:13 vpn pluto[2086]:   including NAT-Traversal patch (Version 
0.6c)
Mar  9 11:40:13 vpn pluto[2086]: ike_alg_register_enc(): Activating 
OAKLEY_AES_CBC: Ok (ret=0)
Mar  9 11:40:13 vpn pluto[2086]: starting up 1 cryptographic helpers
Mar  9 11:40:13 vpn pluto[2086]: started helper pid=2133 (fd:6)
Mar  9 11:40:13 vpn pluto[2086]: Using Linux 2.6 IPsec interface code
Mar  9 11:40:14 vpn pluto[2086]: Changing to directory 
'/etc/ipsec.d/cacerts'
Mar  9 11:40:14 vpn pluto[2086]:   loaded CA cert file 'cacert.pem' (1334 
bytes)
Mar  9 11:40:14 vpn pluto[2086]: Could not change to directory 
'/etc/ipsec.d/aacerts'
Mar  9 11:40:14 vpn pluto[2086]: Could not change to directory 
'/etc/ipsec.d/ocspcerts'
Mar  9 11:40:14 vpn pluto[2086]: Changing to directory '/etc/ipsec.d/crls'
Mar  9 11:40:14 vpn pluto[2086]:   loaded crl file 'crl.pem' (536 bytes)
Mar  9 11:40:14 vpn pluto[2086]:   loaded host cert file 
'/etc/ipsec.d/certs/vpncert.pem' (3605 bytes)
Mar  9 11:40:14 vpn pluto[2086]:   loaded host cert file 
'/etc/ipsec.d/certs/windowsxp.pem' (3557 bytes)
Mar  9 11:40:14 vpn pluto[2086]: added connection description "windows"
Mar  9 11:40:14 vpn pluto[2086]: listening for IKE messages
Mar  9 11:40:14 vpn pluto[2086]: adding interface eth1/eth1 10.9.200.10
Mar  9 11:40:14 vpn pluto[2086]: adding interface eth1/eth1 10.9.200.10:4500
Mar  9 11:40:14 vpn pluto[2086]: adding interface eth0/eth0 213.9.234.19
Mar  9 11:40:14 vpn pluto[2086]: adding interface eth0/eth0 
213.9.234.19:4500
Mar  9 11:40:14 vpn pluto[2086]: adding interface lo/lo 127.0.0.1
Mar  9 11:40:14 vpn pluto[2086]: adding interface lo/lo 127.0.0.1:4500
Mar  9 11:40:14 vpn pluto[2086]: adding interface lo/lo ::1
Mar  9 11:40:14 vpn pluto[2086]: loading secrets from "/etc/ipsec.secrets"
Mar  9 11:40:14 vpn pluto[2086]:   loaded private key file 
'/etc/ipsec.d/private/vpnkey.pem' (1643 bytes)
Mar  9 11:41:36 vpn pluto[2086]: packet from 213.9.234.24:500: ignoring 
Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
Mar  9 11:41:36 vpn pluto[2086]: packet from 213.9.234.24:500: ignoring 
Vendor ID payload [FRAGMENTATION]
Mar  9 11:41:36 vpn pluto[2086]: packet from 213.9.234.24:500: received 
Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
Mar  9 11:41:36 vpn pluto[2086]: packet from 213.9.234.24:500: ignoring 
Vendor ID payload [Vid-Initial-Contact]
Mar  9 11:41:36 vpn pluto[2086]: "windows"[1] 213.9.234.24 #1: responding to 
Main Mode from unknown peer 213.9.234.24
Mar  9 11:41:36 vpn pluto[2086]: "windows"[1] 213.9.234.24 #1: transition 
from state STATE_MAIN_R0 to state STATE_MAIN_R1
Mar  9 11:41:36 vpn pluto[2086]: "windows"[1] 213.9.234.24 #1: 
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
Mar  9 11:41:36 vpn pluto[2086]: "windows"[1] 213.9.234.24 #1: transition 
from state STATE_MAIN_R1 to state STATE_MAIN_R2
Mar  9 11:41:36 vpn pluto[2086]: "windows"[1] 213.9.234.24 #1: next payload 
type of ISAKMP Hash Payload has an unknown value: 232
Mar  9 11:41:36 vpn pluto[2086]: "windows"[1] 213.9.234.24 #1: malformed 
payload in packet
Mar  9 11:41:36 vpn pluto[2086]: "windows"[1] 213.9.234.24 #1: sending 
notification PAYLOAD_MALFORMED to 213.9.234.24:500
Mar  9 11:42:46 vpn pluto[2086]: "windows"[1] 213.9.234.24 #1: max number of 
retransmissions (2) reached STATE_MAIN_R2
Mar  9 11:42:46 vpn pluto[2086]: "windows"[1] 213.9.234.24: deleting 
connection "windows" instance with peer 213.9.234.24 {isakmp=#0/ipsec=#0}

Hope you can throw some light into this.
Thank you very much.

UN CORDIAL SALUDO

Miguel Ángel Domínguez Durán.
Departamento Técnico.
Cherrytel Comunicaciones, S.L.
mdominguez at cherrytel.com
http://www.cherrytel.com/
Tlf. 902 115 673
Fax 952218170
----- Original Message ----- 
From: "Paul Wouters" <paul at xelerance.com>
To: "Miguel Ángel Domínguez Durán" <mdominguez at cherrytel.com>
Cc: <users at openswan.org>
Sent: Tuesday, March 08, 2005 1:47 PM
Subject: Re: [Openswan Users] NAT Problem?


> On Tue, 8 Mar 2005, Miguel Ángel Domínguez Durán wrote:
>
>>       nat_traversal=yes
>
> you might want virtual_private= ?
>
>> conn windows
>>       auto=add
>>       auth=rsasig
>>       left=213.9.x.x
>>       leftcert=vpncert.pem
>>       leftid="C=ES, ST=MALAGA, L=MALAGA, O=CHERRYTEL COMUNICACIONES S.L.,
>> CN=vpn"
>>       right=%any
>>       rightcert=windowsxp.pem
>>       rightid="C=ES, ST=MALAGA, L=MALAGA, O=Prueba, CN=prueba"
>>       pfs=yes
>>       keyingtries=0
>
> this is a tunnel to 1 IP only, since there is no leftsubnet.
>
>> The ipsec.conf in the windows machine contains the following:
>> conn windows
>>       left=%any
>>       leftid="C=ES, ST=MALAGA, L=MALAGA, O=Prueba, CN=prueba"
>>       right=213.9.x.x
>>       rightsubnet=*
>
> this implies the server should have leftsubnet=0.0.0.0/0
>
> If you want ALL traffic to go to the server, use the leftsubnet line.
> If you don't, remove the rightsubnet line.
> If you meant to connect top just some ip network at the server, use that
> as right/leftsubnet and exlude it from NAT in virtual_private.
>
> Paul 



More information about the Users mailing list