[Openswan Users] Windows Xp client to openswan

Thu Mar 16 17:15:28 CET 2006

Hello,

I am new in linux and Openswan and committed to learn Linux a lot and help a
lot.  :)

I wrote here about my problem earlier regarding IPSec VPN connection using
x509 certificates between a linux machine kernel 2.6.13  Openswan 2.4.0, and
a Windows XP Pro SP2 client. Since then, I have enabled the oakley logging
in the Windows machine and found where the log files are in linux machine. I
want to give more details on my test environment at work so that someone can
have a better understanding of my problem.

Our work place has 192.168.1.0/24 subnet for office use and I have another
LAN for test purposes within this office network. My test LAN has
10.10.10.0/24 subnet and has a connection to the 192.168.1.0/24 office
network through a router gateway.  In my test LAN, I have a Linux machine
(Suse 10.0) kernel 2.6.13. This linux machine is also a DHCP server for the
test LAN.

By following Nate Carlson's instruction, I also installed Certificate
Authority (CA)  in the Linux Machine and created x509 certificates for the
Linux machine and Windows client, transffered the certificates to
appropriate places and  to the Windows XP client. And then  I installed
Openswan 2.4.0 into the Linux machine, opened UDP 500 port in it's firewall.
I also opened UDP 500 port on my router gateway machine as well.

--  By using

#ipsec verify

command I get this from Linux Machine

Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path
  [OK]
Linux Openswan U2.4.0rc5/K2.6.13-15-smp (netkey)
Checking for IPsec support in kernel
[OK]
Checking for RSA private key (/etc/ipsec.secrets)                  [OK]

Checking that pluto is running
[OK]
Two or more interfaces found, checking IP forwarding             [OK]
Checking NAT and MASQUERADEing                                 [OK]
Checking for 'ip' command
[OK]
Checking for 'iptables' command
[OK]
Checking for 'curl' command for CRL fetching                        [OK]
Checking for 'setkey' command for NETKEY IPsec stack support            [OK]
Opportunistic Encryption Support
[Disabled]

so everything seems OK here.

--  IPSec service is running well at the Windows Machine.

--  I am using lsipsectool.exe at the Windows Machine. When I try to
establish a VPN connection between the Windows client and LInux Machine, the
connection has not been able to established.

-- HERE IS THE LOG FILE FROM lsipsectool

16:51:13: Starting Tunnel

16:51:13: IKE Encryption: 3des

IKE Integrity: md5

Remote Gateway Address: 192.168.1.55

Remote Monitor Address: 10.10.10.10

Remote Network: 10.10.10.0/255.255.255.0

Local Address: 192.168.1.68

Local Network: 192.168.1.68/255.255.255.255

16:51:17: 15 Consecutive Unsuccessfull ECHO REQUEST [ Waiting 5 Secs ]...

16:51:22: 30 Consecutive Unsuccessfull ECHO REQUEST [ Waiting 5 Secs ]...

16:51:27: 45 Consecutive Unsuccessfull ECHO REQUEST [ Waiting 5 Secs ]...

16:51:28: Stoping Tunnel

-- HERE IS THE LOG FILE FROM oakley.log

3-16: 16:51:16:875:958 Acquire from driver: op=00000008 src=192.168.1.68.0dst=
10.10.10.10.0 proto = 0, SrcMask=255.255.255.255, DstMask=255.255.255.0,
Tunnel 1, TunnelEndpt=192.168.1.55 Inbound TunnelEndpt=192.168.1.68
 3-16: 16:51:16:968:4b4 Filter to match: Src 192.168.1.55 Dst 192.168.1.68
 3-16: 16:51:17:31:4b4 MM PolicyName: 3
 3-16: 16:51:17:31:4b4 MMPolicy dwFlags 2 SoftSAExpireTime 3500
 3-16: 16:51:17:31:4b4 MMOffer[0] LifetimeSec 3500 QMLimit 0 DHGroup 2
 3-16: 16:51:17:46:4b4 MMOffer[0] Encrypt: Triple DES CBC Hash: SHA
 3-16: 16:51:17:78:4b4 Auth[0]:RSA Sig C=CA, S=Ontario, L=Toronto,
O=Springboard Retail Networks Inc., CN=OzgUN,
E=ozgun at springboardnetworks.com AuthFlags 0
 3-16: 16:51:17:78:4b4 QM PolicyName: x4
{07b607f8-6ab7-44b4-b990-cb9cde8ffac8} dwFlags 1
 3-16: 16:51:17:78:4b4 QMOffer[0] LifetimeKBytes 0 LifetimeSec 0
 3-16: 16:51:17:78:4b4 QMOffer[0] dwFlags 0 dwPFSGroup -2147483648
 3-16: 16:51:17:78:4b4  Algo[0] Operation: ESP Algo: Triple DES CBC HMAC:
MD5
 3-16: 16:51:17:78:4b4 Starting Negotiation: src = 192.168.1.68.0500, dst =
192.168.1.55.0500, proto = 00, context = 00000008, ProxySrc =
192.168.1.68.0000, ProxyDst = 10.10.10.0.0000 SrcMask =
255.255.255.255DstMask =
255.255.255.0
 3-16: 16:51:17:78:4b4 constructing ISAKMP Header
 3-16: 16:51:17:78:4b4 constructing SA (ISAKMP)
 3-16: 16:51:17:78:4b4 Constructing Vendor MS NT5 ISAKMPOAKLEY
 3-16: 16:51:17:93:4b4 Constructing Vendor FRAGMENTATION
 3-16: 16:51:17:93:4b4 Constructing Vendor draft-ietf-ipsec-nat-t-ike-02
 3-16: 16:51:17:93:4b4 Constructing Vendor Vid-Initial-Contact
 3-16: 16:51:17:109:4b4
 3-16: 16:51:17:109:4b4 Sending: SA = 0x00100670 to 192.168.1.55:Type 2.500
 3-16: 16:51:17:109:4b4 ISAKMP Header: (V1.0), len = 168
 3-16: 16:51:17:109:4b4   I-COOKIE 43bb6858fc51edbb
 3-16: 16:51:17:109:4b4   R-COOKIE 0000000000000000
 3-16: 16:51:17:109:4b4   exchange: Oakley Main Mode
 3-16: 16:51:17:109:4b4   flags: 0
 3-16: 16:51:17:109:4b4   next payload: SA
 3-16: 16:51:17:109:4b4   message ID: 00000000
 3-16: 16:51:17:109:4b4 Ports S:f401 D:f401
 3-16: 16:51:17:125:4b4
 3-16: 16:51:17:125:4b4 Receive: (get) SA = 0x00100670 from 192.168.1.55.500
 3-16: 16:51:17:125:4b4 ISAKMP Header: (V1.0), len = 140
 3-16: 16:51:17:125:4b4   I-COOKIE 43bb6858fc51edbb
 3-16: 16:51:17:125:4b4   R-COOKIE 40e15c4e47162b21
 3-16: 16:51:17:125:4b4   exchange: Oakley Main Mode
 3-16: 16:51:17:125:4b4   flags: 0
 3-16: 16:51:17:125:4b4   next payload: SA
 3-16: 16:51:17:125:4b4   message ID: 00000000
 3-16: 16:51:17:125:4b4 processing payload SA
 3-16: 16:51:17:125:4b4 Received Phase 1 Transform 1
 3-16: 16:51:17:125:4b4      Encryption Alg Triple DES CBC(5)
 3-16: 16:51:17:125:4b4      Hash Alg SHA(2)
 3-16: 16:51:17:125:4b4      Oakley Group 2
 3-16: 16:51:17:125:4b4      Auth Method RSA Signature with Certificates(3)
 3-16: 16:51:17:125:4b4      Life type in Seconds
 3-16: 16:51:17:125:4b4      Life duration of 3500
 3-16: 16:51:17:125:4b4 Phase 1 SA accepted: transform=1
 3-16: 16:51:17:125:4b4 SA - Oakley proposal accepted
 3-16: 16:51:17:125:4b4 processing payload VENDOR ID
 3-16: 16:51:17:125:4b4 processing payload VENDOR ID
 3-16: 16:51:17:125:4b4 processing payload VENDOR ID
 3-16: 16:51:17:125:4b4 Received VendorId draft-ietf-ipsec-nat-t-ike-02
 3-16: 16:51:17:125:4b4 ClearFragList
 3-16: 16:51:17:125:4b4 constructing ISAKMP Header
 3-16: 16:51:17:140:4b4 constructing KE
 3-16: 16:51:17:140:4b4 constructing NONCE (ISAKMP)
 3-16: 16:51:17:140:4b4 Constructing NatDisc
 3-16: 16:51:17:140:4b4
 3-16: 16:51:17:140:4b4 Sending: SA = 0x00100670 to 192.168.1.55:Type 2.500
 3-16: 16:51:17:140:4b4 ISAKMP Header: (V1.0), len = 232
 3-16: 16:51:17:140:4b4   I-COOKIE 43bb6858fc51edbb
 3-16: 16:51:17:140:4b4   R-COOKIE 40e15c4e47162b21
 3-16: 16:51:17:140:4b4   exchange: Oakley Main Mode
 3-16: 16:51:17:140:4b4   flags: 0
 3-16: 16:51:17:140:4b4   next payload: KE
 3-16: 16:51:17:140:4b4   message ID: 00000000
 3-16: 16:51:17:140:4b4 Ports S:f401 D:f401
 3-16: 16:51:17:187:4b4
 3-16: 16:51:17:187:4b4 Receive: (get) SA = 0x00100670 from 192.168.1.55.500
 3-16: 16:51:17:187:4b4 ISAKMP Header: (V1.0), len = 228
 3-16: 16:51:17:187:4b4   I-COOKIE 43bb6858fc51edbb
 3-16: 16:51:17:203:4b4   R-COOKIE 40e15c4e47162b21
 3-16: 16:51:17:203:4b4   exchange: Oakley Main Mode
 3-16: 16:51:17:203:4b4   flags: 0
 3-16: 16:51:17:203:4b4   next payload: KE
 3-16: 16:51:17:203:4b4   message ID: 00000000
 3-16: 16:51:17:203:4b4 processing payload KE
 3-16: 16:51:17:203:4b4 processing payload NONCE
 3-16: 16:51:17:203:4b4 processing payload NATDISC
 3-16: 16:51:17:203:4b4 Processing NatHash
 3-16: 16:51:17:203:4b4 Nat hash 6b64b2dab3aedfb978ffda8a177a6764
 3-16: 16:51:17:203:4b4 a1723a34
 3-16: 16:51:17:203:4b4 SA StateMask2 f
 3-16: 16:51:17:203:4b4 processing payload NATDISC
 3-16: 16:51:17:203:4b4 Processing NatHash
 3-16: 16:51:17:203:4b4 Nat hash 00a452b48caabe70ba770ab72766a69c
 3-16: 16:51:17:203:4b4 9baa34dc
 3-16: 16:51:17:203:4b4 SA StateMask2 4f
 3-16: 16:51:17:203:4b4 ClearFragList
 3-16: 16:51:17:203:4b4 Peer behind NAT
 3-16: 16:51:17:203:4b4 Floated Ports Orig Me:f401 Peer:f401
 3-16: 16:51:17:203:4b4 Floated Ports Me:9411 Peer:9411
 3-16: 16:51:17:203:4b4 constructing ISAKMP Header
 3-16: 16:51:17:203:4b4 constructing ID
 3-16: 16:51:17:203:4b4 Received no valid CRPs.  Using all configured
 3-16: 16:51:17:203:4b4 Looking for IPSec only cert
 3-16: 16:51:17:250:4b4 Cert Trustes.  0 100
 3-16: 16:51:17:250:4b4 Cert SHA Thumbprint 9f120fd256be49e28c1df547aef9a125
 3-16: 16:51:17:250:4b4 6ebef09e
 3-16: 16:51:17:250:4b4 CertFindExtenstion failed with 0
 3-16: 16:51:17:390:4b4 Entered CRL check
 3-16: 16:51:17:421:4b4 Left CRL check
 3-16: 16:51:17:421:4b4 Cert SHA Thumbprint 9f120fd256be49e28c1df547aef9a125
 3-16: 16:51:17:421:4b4 6ebef09e
 3-16: 16:51:17:421:4b4 SubjectName: C=CA, S=Ontario, O=Springboard Retail
Networks Inc., CN=laptop, E=laptop at springboardnetworks.com
 3-16: 16:51:17:421:4b4 Cert Serialnumber 02
 3-16: 16:51:17:421:4b4 Cert SHA Thumbprint 9f120fd256be49e28c1df547aef9a125
 3-16: 16:51:17:421:4b4 6ebef09e
 3-16: 16:51:17:421:4b4 SubjectName: C=CA, S=Ontario, L=Toronto,
O=Springboard Retail Networks Inc., CN=OzgUN,
E=ozgun at springboardnetworks.com
 3-16: 16:51:17:421:4b4 Cert Serialnumber 7ce887a3f0e91dc800
 3-16: 16:51:17:421:4b4 Cert SHA Thumbprint f248c0125dda62bb3fa6c304e1784f8f
 3-16: 16:51:17:421:4b4 0225315f
 3-16: 16:51:17:421:4b4 Not storing My cert chain in SA.
 3-16: 16:51:17:421:4b4 MM ID Type 9
 3-16: 16:51:17:421:4b4 MM ID 30818a310b3009060355040613024341
 3-16: 16:51:17:421:4b4 3110300e060355040813074f6e746172
 3-16: 16:51:17:421:4b4 696f31293027060355040a1320537072
 3-16: 16:51:17:421:4b4 696e67626f6172642052657461696c20
 3-16: 16:51:17:421:4b4 4e6574776f726b7320496e632e310f30
 3-16: 16:51:17:421:4b4 0d060355040313066c6170746f70312d
 3-16: 16:51:17:421:4b4 302b06092a864886f70d010901161e6c
 3-16: 16:51:17:421:4b4 6170746f7040737072696e67626f6172
 3-16: 16:51:17:421:4b4 646e6574776f726b732e636f6d
 3-16: 16:51:17:421:4b4 constructing CERT
 3-16: 16:51:17:437:4b4 Construct SIG
 3-16: 16:51:17:437:4b4 Constructing Cert Request
 3-16: 16:51:17:437:4b4 C=CA, S=Ontario, L=Toronto, O=Springboard Retail
Networks Inc., CN=OzgUN, E=ozgun at springboardnetworks.com
 3-16: 16:51:17:437:4b4
 3-16: 16:51:17:437:4b4 Sending: SA = 0x00100670 to 192.168.1.55:Type 2.4500
 3-16: 16:51:17:437:4b4 ISAKMP Header: (V1.0), len = 1452
 3-16: 16:51:17:437:4b4   I-COOKIE 43bb6858fc51edbb
 3-16: 16:51:17:437:4b4   R-COOKIE 40e15c4e47162b21
 3-16: 16:51:17:437:4b4   exchange: Oakley Main Mode
 3-16: 16:51:17:437:4b4   flags: 1 ( encrypted )
 3-16: 16:51:17:437:4b4   next payload: ID
 3-16: 16:51:17:437:4b4   message ID: 00000000
 3-16: 16:51:17:437:4b4 Ports S:9411 D:9411
 3-16: 16:51:18:500:e5c retransmit: sa = 00100670 centry 00000000 , count =
1
 3-16: 16:51:18:500:e5c
 3-16: 16:51:18:500:e5c Sending: SA = 0x00100670 to 192.168.1.55:Type 2.4500
 3-16: 16:51:18:500:e5c ISAKMP Header: (V1.0), len = 1452
 3-16: 16:51:18:500:e5c   I-COOKIE 43bb6858fc51edbb
 3-16: 16:51:18:500:e5c   R-COOKIE 40e15c4e47162b21
 3-16: 16:51:18:500:e5c   exchange: Oakley Main Mode
 3-16: 16:51:18:500:e5c   flags: 1 ( encrypted )
 3-16: 16:51:18:500:e5c   next payload: ID
 3-16: 16:51:18:500:e5c   message ID: 00000000
 3-16: 16:51:18:500:e5c Ports S:9411 D:9411
 3-16: 16:51:20:500:e5c retransmit: sa = 00100670 centry 00000000 , count =
2
 3-16: 16:51:20:500:e5c
 3-16: 16:51:20:500:e5c Sending: SA = 0x00100670 to 192.168.1.55:Type 2.4500
 3-16: 16:51:20:500:e5c ISAKMP Header: (V1.0), len = 1452
 3-16: 16:51:20:500:e5c   I-COOKIE 43bb6858fc51edbb
 3-16: 16:51:20:500:e5c   R-COOKIE 40e15c4e47162b21
 3-16: 16:51:20:500:e5c   exchange: Oakley Main Mode
 3-16: 16:51:20:500:e5c   flags: 1 ( encrypted )
 3-16: 16:51:20:500:e5c   next payload: ID
 3-16: 16:51:20:500:e5c   message ID: 00000000
 3-16: 16:51:20:500:e5c Ports S:9411 D:9411
 3-16: 16:51:24:500:e5c retransmit: sa = 00100670 centry 00000000 , count =
3
 3-16: 16:51:24:500:e5c
 3-16: 16:51:24:500:e5c Sending: SA = 0x00100670 to 192.168.1.55:Type 2.4500
 3-16: 16:51:24:500:e5c ISAKMP Header: (V1.0), len = 1452
 3-16: 16:51:24:500:e5c   I-COOKIE 43bb6858fc51edbb
 3-16: 16:51:24:500:e5c   R-COOKIE 40e15c4e47162b21
 3-16: 16:51:24:500:e5c   exchange: Oakley Main Mode
 3-16: 16:51:24:500:e5c   flags: 1 ( encrypted )
 3-16: 16:51:24:500:e5c   next payload: ID
 3-16: 16:51:24:500:e5c   message ID: 00000000
 3-16: 16:51:24:500:e5c Ports S:9411 D:9411
 3-16: 16:51:27:187:4b4
 3-16: 16:51:27:187:4b4 Receive: (get) SA = 0x00100670 from 192.168.1.55.500
 3-16: 16:51:27:187:4b4 ISAKMP Header: (V1.0), len = 228
 3-16: 16:51:27:187:4b4   I-COOKIE 43bb6858fc51edbb
 3-16: 16:51:27:187:4b4   R-COOKIE 40e15c4e47162b21
 3-16: 16:51:27:187:4b4   exchange: Oakley Main Mode
 3-16: 16:51:27:187:4b4   flags: 0
 3-16: 16:51:27:187:4b4   next payload: KE
 3-16: 16:51:27:187:4b4   message ID: 00000000
 3-16: 16:51:27:187:4b4 received an unencrypted packet when crypto active
 3-16: 16:51:27:187:4b4 GetPacket failed 35ec
 3-16: 16:51:32:234:8cc isadb_schedule_kill_oldPolicy_sas:
09ac27ce-92bf-448c-acd93156372600a9 4
 3-16: 16:51:32:234:8cc isadb_schedule_kill_oldPolicy_sas:
7eb795d1-cfdf-4cb1-9d031df3be0cca58 4
 3-16: 16:51:32:234:8cc isadb_schedule_kill_oldPolicy_sas:
c1087638-95ed-4659-b8377676688f625d 3
 3-16: 16:51:32:234:8cc isadb_schedule_kill_oldPolicy_sas:
e82e86b6-2d2d-4e40-85735376ab40cbca 3
 3-16: 16:51:32:234:8cc isadb_schedule_kill_oldPolicy_sas:
4f69adbf-8118-4fcd-8eb6cc399740f924 1
 3-16: 16:51:32:234:8cc isadb_schedule_kill_oldPolicy_sas:
07b607f8-6ab7-44b4-b990cb9cde8ffac8 2
 3-16: 16:51:32:234:4b4 entered kill_old_policy_sas 4
 3-16: 16:51:32:234:4b4 SA Dead. sa:00100670 status:3619
 3-16: 16:51:32:234:4b4 isadb_set_status sa:00100670 centry:00000000 status
3619
 3-16: 16:51:32:296:e48 entered kill_old_policy_sas 4
 3-16: 16:51:32:343:4b4 Key Exchange Mode (Main Mode)
 3-16: 16:51:32:343:4b4 Source IP Address 192.168.1.68  Source IP Address
Mask 255.255.255.255  Destination IP Address 192.168.1.55  Destination IP
Address Mask 255.255.255.255  Protocol 0  Source Port 0  Destination Port 0
IKE Local Addr 192.168.1.68  IKE Peer Addr 192.168.1.55
 3-16: 16:51:32:343:4b4 Certificate based Identity.    Peer Subject   Peer
SHA Thumbprint 0000000000000000000000000000000000000000  Peer Issuing
Certificate Authority   Root Certificate Authority   My Subject C=CA,
S=Ontario, O=Springboard Retail Networks Inc., CN=laptop,
E=laptop at springboardnetworks.com  My SHA Thumbprint
9f120fd256be49e28c1df547aef9a1256ebef09e  Peer IP Address: 192.168.1.55
 3-16: 16:51:32:343:4b4 Me
 3-16: 16:51:32:343:4b4 New policy invalidated SAs formed with old policy
 3-16: 16:51:32:343:4b4 0x0 0x0
 3-16: 16:51:32:343:4b4 constructing ISAKMP Header
 3-16: 16:51:32:343:4b4 constructing HASH (null)
 3-16: 16:51:32:343:4b4 constructing DELETE. MM 00100670
 3-16: 16:51:32:343:4b4 constructing HASH (Notify/Delete)
 3-16: 16:51:32:343:4b4
 3-16: 16:51:32:343:4b4 Sending: SA = 0x00100670 to 192.168.1.55:Type 1.4500
 3-16: 16:51:32:343:4b4 ISAKMP Header: (V1.0), len = 84
 3-16: 16:51:32:343:4b4   I-COOKIE 43bb6858fc51edbb
 3-16: 16:51:32:343:4b4   R-COOKIE 40e15c4e47162b21
 3-16: 16:51:32:343:4b4   exchange: ISAKMP Informational Exchange
 3-16: 16:51:32:343:4b4   flags: 1 ( encrypted )
 3-16: 16:51:32:343:4b4   next payload: HASH
 3-16: 16:51:32:343:4b4   message ID: a209e9cd
 3-16: 16:51:32:343:4b4 Ports S:9411 D:9411
 3-16: 16:51:32:343:4b4 entered kill_old_policy_sas 3
 3-16: 16:51:32:343:4b4 entered kill_old_policy_sas 3
 3-16: 16:51:32:343:4b4 entered kill_old_policy_sas 1
 3-16: 16:51:32:343:4b4 entered kill_old_policy_sas 2
 3-16: 16:51:47:218:4b4
 3-16: 16:51:47:218:4b4 Receive: (get) SA = 0x00000000 from 192.168.1.55.500
 3-16: 16:51:47:218:4b4 ISAKMP Header: (V1.0), len = 228
 3-16: 16:51:47:218:4b4   I-COOKIE 43bb6858fc51edbb
 3-16: 16:51:47:218:4b4   R-COOKIE 40e15c4e47162b21
 3-16: 16:51:47:218:4b4   exchange: Oakley Main Mode
 3-16: 16:51:47:218:4b4   flags: 0
 3-16: 16:51:47:218:4b4   next payload: KE
 3-16: 16:51:47:218:4b4   message ID: 00000000
 3-16: 16:51:47:218:4b4 invalid cookie received
 3-16: 16:52:16:78:4b4 ClearFragList

--HERE IS THE LOG FILE FROM WINDOWS EVENT VIEWER

IKE security association negotiation failed.

Mode:

Key Exchange Mode (Main Mode)

Filter:

Source IP Address 192.168.1.68

Source IP Address Mask 255.255.255.255

Destination IP Address 192.168.1.55

Destination IP Address Mask 255.255.255.255

Protocol 0

Source Port 0

Destination Port 0

IKE Local Addr 192.168.1.68

IKE Peer Addr 192.168.1.55

Peer Identity:

Certificate based Identity.

Peer Subject

Peer SHA Thumbprint 0000000000000000000000000000000000000000

Peer Issuing Certificate Authority

Root Certificate Authority

My Subject C=CA, S=Ontario, O=Springboard Retail Networks Inc., CN=laptop,
E=laptop at springboardnetworks.com

My SHA Thumbprint 9f120fd256be49e28c1df547aef9a1256ebef09e

Peer IP Address: 192.168.1.55

Failure Point:

Me

Failure Reason:

New policy invalidated SAs formed with old policy

Extra Status:

0x0 0x0

--  AND HERE IS THE LOG FILE FROM /var/log/messages at the Linux Machine

Mar 16 16:51:33 linuxserver pluto[6114]: packet from 192.168.1.68:500:
ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
Mar 16 16:51:33 linuxserver pluto[6114]: packet from 192.168.1.68:500:
ignoring Vendor ID payload [FRAGMENTATION]
Mar 16 16:51:33 linuxserver pluto[6114]: packet from 192.168.1.68:500:
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set
to=106
Mar 16 16:51:33 linuxserver pluto[6114]: packet from 192.168.1.68:500:
ignoring Vendor ID payload [Vid-Initial-Contact]
Mar 16 16:51:33 linuxserver pluto[6114]: "roadwarrior"[13] 192.168.1.68 #16:
responding to Main Mode from unknown peer 192.168.1.68
Mar 16 16:51:33 linuxserver pluto[6114]: "roadwarrior"[13] 192.168.1.68 #16:
transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Mar 16 16:51:33 linuxserver pluto[6114]: "roadwarrior"[13] 192.168.1.68 #16:
STATE_MAIN_R1: sent MR1, expecting MI2
Mar 16 16:51:34 linuxserver pluto[6114]: "roadwarrior"[13] 192.168.1.68 #16:
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: i am NATed
Mar 16 16:51:34 linuxserver pluto[6114]: "roadwarrior"[13] 192.168.1.68 #16:
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Mar 16 16:51:34 linuxserver pluto[6114]: "roadwarrior"[13] 192.168.1.68 #16:
STATE_MAIN_R2: sent MR2, expecting MI3
Mar 16 16:52:44 linuxserver pluto[6114]: "roadwarrior"[13] 192.168.1.68 #16:
max number of retransmissions (2) reached STATE_MAIN_R2
Mar 16 16:52:44 linuxserver pluto[6114]: "roadwarrior"[13] 192.168.1.68:
deleting connection "roadwarrior" instance with peer
192.168.1.68{isakmp=#0/ipsec=#0}

Could you please tell me what i am missing to make this IPSec VPN connection
work?

Thank you very much in advance for your time and effort.

Can Akalin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.openswan.org/pipermail/users/attachments/20060316/a3267a56/attachment-0001.htm