[Openswan Users] Roadwarrior conection problems.
Paul Wouters
paul at xelerance.com
Wed Oct 4 16:47:57 EDT 2006
On Wed, 4 Oct 2006, Fabio Ferreira wrote:
- Disable plutodebug, restart openswan and try again. Show us that log
Can you give us the specifics of the other end. Is it a netscreen?
Paul
> Date: Wed, 4 Oct 2006 17:18:07 -0300
> From: Fabio Ferreira <fabio.ferreira at markway.com.br>
> To: users at openswan.org
> Subject: [Openswan Users] Roadwarrior conection problems.
>
> Dear,
>
> I had some problems to start my roadwarrior. Someone can help me?
>
> ########################################################################
> ###################################################
>
> Log from /var/log/secure:
>
> Oct 4 17:07:36 frwmarkway pluto[8192]: | next event EVENT_RETRANSMIT in
> 0 seconds for #30
> Oct 4 17:07:36 frwmarkway pluto[8192]: |
> Oct 4 17:07:36 frwmarkway pluto[8192]: | *time to handle event
> Oct 4 17:07:36 frwmarkway pluto[8192]: | handling event
> EVENT_RETRANSMIT
> Oct 4 17:07:36 frwmarkway pluto[8192]: | event after this is
> EVENT_RETRANSMIT in 8 seconds
> Oct 4 17:07:36 frwmarkway pluto[8192]: | processing connection
> roadwarrior_jackson[10] 201.5.12.122
> Oct 4 17:07:36 frwmarkway pluto[8192]: | handling event
> EVENT_RETRANSMIT for 201.5.12.122 "roadwarrior_jackson" #30
> Oct 4 17:07:36 frwmarkway pluto[8192]: | sending 140 bytes for
> EVENT_RETRANSMIT through eth0:500 to 201.5.12.122:500:
> Oct 4 17:07:36 frwmarkway pluto[8192]: | 01 f3 1b 59 9e b6 8f 3b cf
> e6 f1 78 b0 65 4e b8
> Oct 4 17:07:36 frwmarkway pluto[8192]: | 01 10 02 00 00 00 00 00 00
> 00 00 8c 0d 00 00 38
> Oct 4 17:07:36 frwmarkway pluto[8192]: | 00 00 00 01 00 00 00 01 00
> 00 00 2c 01 01 00 01
> Oct 4 17:07:36 frwmarkway pluto[8192]: | 00 00 00 24 01 01 00 00 80
> 01 00 05 80 02 00 02
> Oct 4 17:07:37 frwmarkway pluto[8192]: | 80 04 00 02 80 03 00 03 80
> 0b 00 01 00 0c 00 04
> Oct 4 17:07:37 frwmarkway pluto[8192]: | 00 00 70 80 0d 00 00 10 4f
> 45 7a 7d 46 46 46 66
> Oct 4 17:07:37 frwmarkway pluto[8192]: | 67 72 5f 65 0d 00 00 14 af
> ca d7 13 68 a1 f1 c9
> Oct 4 17:07:37 frwmarkway pluto[8192]: | 6b 86 96 fc 77 57 01 00 00
> 00 00 14 90 cb 80 91
> Oct 4 17:07:37 frwmarkway pluto[8192]: | 3e bb 69 6e 08 63 81 b5 ec
> 42 7b 1f
> Oct 4 17:07:37 frwmarkway pluto[8192]: | inserting event
> EVENT_RETRANSMIT, timeout in 20 seconds for #30
> Oct 4 17:07:37 frwmarkway pluto[8192]: | next event EVENT_RETRANSMIT in
> 7 seconds for #28
> Oct 4 17:07:37 frwmarkway pluto[8192]: |
> Oct 4 17:07:37 frwmarkway pluto[8192]: | *received 84 bytes from
> 201.5.12.122:500 on eth0 (port=500)
> Oct 4 17:07:37 frwmarkway pluto[8192]: | 01 f3 1b 59 9e b6 8f 3b e1
> 3d e2 a3 88 18 30 27
> Oct 4 17:07:37 frwmarkway pluto[8192]: | 08 10 05 01 8c ad f1 4a 00
> 00 00 54 68 87 b4 78
> Oct 4 17:07:37 frwmarkway pluto[8192]: | 3c fc e3 0f 15 25 62 c0 60
> c7 00 73 aa a6 e0 a8
> Oct 4 17:07:37 frwmarkway pluto[8192]: | 33 aa f3 1d c4 33 7f 7f a3
> 25 6c e2 06 8f 5d 9e
> Oct 4 17:07:37 frwmarkway pluto[8192]: | fd 3a 47 e6 cc a6 6e 13 42
> 80 34 64 c1 6d 80 ca
> Oct 4 17:07:37 frwmarkway pluto[8192]: | 01 25 f5 a6
> Oct 4 17:07:37 frwmarkway pluto[8192]: | **parse ISAKMP Message:
> Oct 4 17:07:37 frwmarkway pluto[8192]: | initiator cookie:
> Oct 4 17:07:37 frwmarkway pluto[8192]: | 01 f3 1b 59 9e b6 8f 3b
> Oct 4 17:07:37 frwmarkway pluto[8192]: | responder cookie:
> Oct 4 17:07:37 frwmarkway pluto[8192]: | e1 3d e2 a3 88 18 30 27
> Oct 4 17:07:37 frwmarkway pluto[8192]: | next payload type:
> ISAKMP_NEXT_HASH
> Oct 4 17:07:37 frwmarkway pluto[8192]: | ISAKMP version: ISAKMP
> Version 1.0
> Oct 4 17:07:37 frwmarkway pluto[8192]: | exchange type:
> ISAKMP_XCHG_INFO
> Oct 4 17:07:37 frwmarkway pluto[8192]: | flags:
> ISAKMP_FLAG_ENCRYPTION
> Oct 4 17:07:37 frwmarkway pluto[8192]: | message ID: 8c ad f1 4a
> Oct 4 17:07:37 frwmarkway pluto[8192]: | length: 84
> Oct 4 17:07:37 frwmarkway pluto[8192]: | processing packet with
> exchange type=ISAKMP_XCHG_INFO (5)
> Oct 4 17:07:37 frwmarkway pluto[8192]: | ICOOKIE: 01 f3 1b 59 9e b6
> 8f 3b
> Oct 4 17:07:37 frwmarkway pluto[8192]: | RCOOKIE: e1 3d e2 a3 88 18
> 30 27
> Oct 4 17:07:37 frwmarkway pluto[8192]: | peer: c9 05 0c 7a
> Oct 4 17:07:37 frwmarkway pluto[8192]: | state hash entry 16
> Oct 4 17:07:37 frwmarkway pluto[8192]: | peer and cookies match on #28,
> provided msgid 00000000 vs 00000000/00000000
> Oct 4 17:07:37 frwmarkway pluto[8192]: | p15 state object #28 found, in
> STATE_MAIN_R2
> Oct 4 17:07:37 frwmarkway pluto[8192]: | processing connection
> roadwarrior_jackson[10] 201.5.12.122
> Oct 4 17:07:37 frwmarkway pluto[8192]: | last Phase 1 IV:
> Oct 4 17:07:37 frwmarkway pluto[8192]: | current Phase 1 IV: 68 ff 94
> 78 1f a4 01 2f 67 ef 09 ce 29 a9 2b 22
> Oct 4 17:07:37 frwmarkway pluto[8192]: | 1a c7 ac 15
> Oct 4 17:07:37 frwmarkway pluto[8192]: | computed Phase 2 IV:
> Oct 4 17:07:37 frwmarkway pluto[8192]: | 29 b1 df 8e 5a 39 ef 02 a4
> c4 8c 29 06 f1 3a b8
> Oct 4 17:07:38 frwmarkway pluto[8192]: | f9 98 14 7d
> Oct 4 17:07:38 frwmarkway pluto[8192]: | received encrypted packet from
> 201.5.12.122:500
> Oct 4 17:07:38 frwmarkway pluto[8192]: | decrypting 56 bytes using
> algorithm OAKLEY_3DES_CBC
> Oct 4 17:07:38 frwmarkway pluto[8192]: | decrypted:
> Oct 4 17:07:38 frwmarkway pluto[8192]: | 0d de b3 df d0 97 f3 47 be
> 69 41 18 df 8f 74 f9
> Oct 4 17:07:38 frwmarkway pluto[8192]: | 27 f6 0d b2 43 e9 e2 22 00
> 00 00 1c 00 00 00 01
> Oct 4 17:07:38 frwmarkway pluto[8192]: | 01 10 00 1c 01 f3 1b 59 9e
> b6 8f 3b e1 3d e2 a3
> Oct 4 17:07:38 frwmarkway pluto[8192]: | 88 18 30 27 00 00 00 00
> Oct 4 17:07:38 frwmarkway pluto[8192]: | next IV: c1 6d 80 ca 01 25
> f5 a6
> Oct 4 17:07:38 frwmarkway pluto[8192]: "roadwarrior_jackson"[10]
> 201.5.12.122 #28: byte 2 of ISAKMP Hash Payload must be zero, but is not
> Oct 4 17:07:38 frwmarkway pluto[8192]: "roadwarrior_jackson"[10]
> 201.5.12.122 #28: malformed payload in packet
> Oct 4 17:07:38 frwmarkway pluto[8192]: "roadwarrior_jackson"[10]
> 201.5.12.122 #28: sending notification PAYLOAD_MALFORMED to
> 201.5.12.122:500
> Oct 4 17:07:38 frwmarkway pluto[8192]: | **emit ISAKMP Message:
> Oct 4 17:07:38 frwmarkway pluto[8192]: | initiator cookie:
> Oct 4 17:07:38 frwmarkway pluto[8192]: | 01 f3 1b 59 9e b6 8f 3b
> Oct 4 17:07:38 frwmarkway pluto[8192]: | responder cookie:
> Oct 4 17:07:38 frwmarkway pluto[8192]: | e1 3d e2 a3 88 18 30 27
> Oct 4 17:07:38 frwmarkway pluto[8192]: | next payload type:
> ISAKMP_NEXT_N
> Oct 4 17:07:38 frwmarkway pluto[8192]: | ISAKMP version: ISAKMP
> Version 1.0
> Oct 4 17:07:38 frwmarkway pluto[8192]: | exchange type:
> ISAKMP_XCHG_INFO
> Oct 4 17:07:38 frwmarkway pluto[8192]: | flags: none
> Oct 4 17:07:38 frwmarkway pluto[8192]: | message ID: fb 6c ec dc
> Oct 4 17:07:38 frwmarkway pluto[8192]: | ***emit ISAKMP Notification
> Payload:
> Oct 4 17:07:38 frwmarkway pluto[8192]: | next payload type:
> ISAKMP_NEXT_NONE
> Oct 4 17:07:38 frwmarkway pluto[8192]: | DOI: ISAKMP_DOI_IPSEC
> Oct 4 17:07:38 frwmarkway pluto[8192]: | protocol ID: 1
> Oct 4 17:07:38 frwmarkway pluto[8192]: | SPI size: 0
> Oct 4 17:07:38 frwmarkway pluto[8192]: | Notify Message Type:
> PAYLOAD_MALFORMED
> Oct 4 17:07:38 frwmarkway pluto[8192]: | emitting length of ISAKMP
> Notification Payload: 12
> Oct 4 17:07:38 frwmarkway pluto[8192]: | emitting length of ISAKMP
> Message: 40
> Oct 4 17:07:38 frwmarkway pluto[8192]: | sending 40 bytes for
> notification packet through eth0:500 to 201.5.12.122:500:
> Oct 4 17:07:38 frwmarkway pluto[8192]: | 01 f3 1b 59 9e b6 8f 3b e1
> 3d e2 a3 88 18 30 27
> Oct 4 17:07:38 frwmarkway pluto[8192]: | 0b 10 05 00 fb 6c ec dc 00
> 00 00 28 00 00 00 0c
> Oct 4 17:07:38 frwmarkway pluto[8192]: | 00 00 00 01 01 00 00 10
> Oct 4 17:07:38 frwmarkway pluto[8192]: | next event EVENT_RETRANSMIT in
> 6 seconds for #28
> Oct 4 17:07:44 frwmarkway pluto[8192]: |
> Oct 4 17:07:44 frwmarkway pluto[8192]: | *time to handle event
> Oct 4 17:07:44 frwmarkway pluto[8192]: | handling event
> EVENT_RETRANSMIT
> Oct 4 17:07:44 frwmarkway pluto[8192]: | event after this is
> EVENT_NAT_T_KEEPALIVE in 4 seconds
>
> ########################################################################
> ###################################################
>
> Ipsec whack --status
>
> 000 "roadwarrior_jackson": 192.168.1.0/24===200.150.147.244[C=BR, ST=RJ,
> L=RJ, O=markway, CN=jackson,
> E=jackson.schemes at markway.com.br]---200.150.147.241...%any; unrouted;
> eroute owner: #0
> 000 "roadwarrior_jackson": srcip=unset; dstip=unset; srcup=ipsec
> _updown; dstup=ipsec _updown;
> 000 "roadwarrior_jackson": CAs: 'C=BR, ST=RJ, O=markway, CN=CA,
> E=fabio.ferreira at markway.com.br'...'%any'
> 000 "roadwarrior_jackson": ike_life: 3600s; ipsec_life: 28800s;
> rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 1
> 000 "roadwarrior_jackson": policy: RSASIG+ENCRYPT+COMPRESS+TUNNEL+PFS;
> prio: 24,32; interface: eth0;
> 000 "roadwarrior_jackson": newest ISAKMP SA: #0; newest IPsec SA: #0;
> 000 "roadwarrior_jackson"[11]: 192.168.1.0/24===200.150.147.244[C=BR,
> ST=RJ, L=RJ, O=markway, CN=jackson,
> E=jackson.schemes at markway.com.br]---200.150.147.241...201.5.12.122;
> unrouted; eroute owner: #0
> 000 "roadwarrior_jackson"[11]: srcip=unset; dstip=unset; srcup=ipsec
> _updown; dstup=ipsec _updown;
> 000 "roadwarrior_jackson"[11]: CAs: 'C=BR, ST=RJ, O=markway, CN=CA,
> E=fabio.ferreira at markway.com.br'...'%any'
> 000 "roadwarrior_jackson"[11]: ike_life: 3600s; ipsec_life: 28800s;
> rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 1
> 000 "roadwarrior_jackson"[11]: policy:
> RSASIG+ENCRYPT+COMPRESS+TUNNEL+PFS; prio: 24,32; interface: eth0;
> 000 "roadwarrior_jackson"[11]: newest ISAKMP SA: #0; newest IPsec SA:
> #0;
> 000
> 000 #31: "roadwarrior_jackson"[11] 201.5.12.122:500 STATE_MAIN_R2 (sent
> MR2, expecting MI3); EVENT_RETRANSMIT in 32s; nodpd
> 000 #33: "roadwarrior_jackson"[11] 201.5.12.122:500 STATE_MAIN_R1 (sent
> MR1, expecting MI2); EVENT_RETRANSMIT in 24s; nodpd
> 000 #32: "roadwarrior_jackson"[11] 201.5.12.122:500 STATE_MAIN_R1 (sent
> MR1, expecting MI2); EVENT_RETRANSMIT in 21s; nodpd
>
> ########################################################################
> ###################################################
>
> Any ideas?
>
> Thanks,
>
> Fabio Ferreira
>
> _______________________________________________
> Users at openswan.org
> http://lists.openswan.org/mailman/listinfo/users
> Building and Integrating Virtual Private Networks with Openswan:
> http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155
>
--
Building and integrating Virtual Private Networks with Openswan:
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155
More information about the Users
mailing list