[Openswan Users] Roadwarrior conection problems.

Paul Wouters paul at xelerance.com
Wed Oct 4 16:47:57 EDT 2006


On Wed, 4 Oct 2006, Fabio Ferreira wrote:

- Disable plutodebug, restart openswan and try again. Show us that log

Can you give us the specifics of the other end. Is it a netscreen?

Paul


> Date: Wed, 4 Oct 2006 17:18:07 -0300
> From: Fabio Ferreira <fabio.ferreira at markway.com.br>
> To: users at openswan.org
> Subject: [Openswan Users] Roadwarrior conection problems.
>
> Dear,
>
> I had some problems to start my roadwarrior. Someone can help me?
>
> ########################################################################
> ###################################################
>
> Log from /var/log/secure:
>
> Oct  4 17:07:36 frwmarkway pluto[8192]: | next event EVENT_RETRANSMIT in
> 0 seconds for #30
> Oct  4 17:07:36 frwmarkway pluto[8192]: |
> Oct  4 17:07:36 frwmarkway pluto[8192]: | *time to handle event
> Oct  4 17:07:36 frwmarkway pluto[8192]: | handling event
> EVENT_RETRANSMIT
> Oct  4 17:07:36 frwmarkway pluto[8192]: | event after this is
> EVENT_RETRANSMIT in 8 seconds
> Oct  4 17:07:36 frwmarkway pluto[8192]: | processing connection
> roadwarrior_jackson[10] 201.5.12.122
> Oct  4 17:07:36 frwmarkway pluto[8192]: | handling event
> EVENT_RETRANSMIT for 201.5.12.122 "roadwarrior_jackson" #30
> Oct  4 17:07:36 frwmarkway pluto[8192]: | sending 140 bytes for
> EVENT_RETRANSMIT through eth0:500 to 201.5.12.122:500:
> Oct  4 17:07:36 frwmarkway pluto[8192]: |   01 f3 1b 59  9e b6 8f 3b  cf
> e6 f1 78  b0 65 4e b8
> Oct  4 17:07:36 frwmarkway pluto[8192]: |   01 10 02 00  00 00 00 00  00
> 00 00 8c  0d 00 00 38
> Oct  4 17:07:36 frwmarkway pluto[8192]: |   00 00 00 01  00 00 00 01  00
> 00 00 2c  01 01 00 01
> Oct  4 17:07:36 frwmarkway pluto[8192]: |   00 00 00 24  01 01 00 00  80
> 01 00 05  80 02 00 02
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   80 04 00 02  80 03 00 03  80
> 0b 00 01  00 0c 00 04
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   00 00 70 80  0d 00 00 10  4f
> 45 7a 7d  46 46 46 66
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   67 72 5f 65  0d 00 00 14  af
> ca d7 13  68 a1 f1 c9
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   6b 86 96 fc  77 57 01 00  00
> 00 00 14  90 cb 80 91
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   3e bb 69 6e  08 63 81 b5  ec
> 42 7b 1f
> Oct  4 17:07:37 frwmarkway pluto[8192]: | inserting event
> EVENT_RETRANSMIT, timeout in 20 seconds for #30
> Oct  4 17:07:37 frwmarkway pluto[8192]: | next event EVENT_RETRANSMIT in
> 7 seconds for #28
> Oct  4 17:07:37 frwmarkway pluto[8192]: |
> Oct  4 17:07:37 frwmarkway pluto[8192]: | *received 84 bytes from
> 201.5.12.122:500 on eth0 (port=500)
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   01 f3 1b 59  9e b6 8f 3b  e1
> 3d e2 a3  88 18 30 27
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   08 10 05 01  8c ad f1 4a  00
> 00 00 54  68 87 b4 78
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   3c fc e3 0f  15 25 62 c0  60
> c7 00 73  aa a6 e0 a8
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   33 aa f3 1d  c4 33 7f 7f  a3
> 25 6c e2  06 8f 5d 9e
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   fd 3a 47 e6  cc a6 6e 13  42
> 80 34 64  c1 6d 80 ca
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   01 25 f5 a6
> Oct  4 17:07:37 frwmarkway pluto[8192]: | **parse ISAKMP Message:
> Oct  4 17:07:37 frwmarkway pluto[8192]: |    initiator cookie:
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   01 f3 1b 59  9e b6 8f 3b
> Oct  4 17:07:37 frwmarkway pluto[8192]: |    responder cookie:
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   e1 3d e2 a3  88 18 30 27
> Oct  4 17:07:37 frwmarkway pluto[8192]: |    next payload type:
> ISAKMP_NEXT_HASH
> Oct  4 17:07:37 frwmarkway pluto[8192]: |    ISAKMP version: ISAKMP
> Version 1.0
> Oct  4 17:07:37 frwmarkway pluto[8192]: |    exchange type:
> ISAKMP_XCHG_INFO
> Oct  4 17:07:37 frwmarkway pluto[8192]: |    flags:
> ISAKMP_FLAG_ENCRYPTION
> Oct  4 17:07:37 frwmarkway pluto[8192]: |    message ID:  8c ad f1 4a
> Oct  4 17:07:37 frwmarkway pluto[8192]: |    length: 84
> Oct  4 17:07:37 frwmarkway pluto[8192]: |  processing packet with
> exchange type=ISAKMP_XCHG_INFO (5)
> Oct  4 17:07:37 frwmarkway pluto[8192]: | ICOOKIE:  01 f3 1b 59  9e b6
> 8f 3b
> Oct  4 17:07:37 frwmarkway pluto[8192]: | RCOOKIE:  e1 3d e2 a3  88 18
> 30 27
> Oct  4 17:07:37 frwmarkway pluto[8192]: | peer:  c9 05 0c 7a
> Oct  4 17:07:37 frwmarkway pluto[8192]: | state hash entry 16
> Oct  4 17:07:37 frwmarkway pluto[8192]: | peer and cookies match on #28,
> provided msgid 00000000 vs 00000000/00000000
> Oct  4 17:07:37 frwmarkway pluto[8192]: | p15 state object #28 found, in
> STATE_MAIN_R2
> Oct  4 17:07:37 frwmarkway pluto[8192]: | processing connection
> roadwarrior_jackson[10] 201.5.12.122
> Oct  4 17:07:37 frwmarkway pluto[8192]: | last Phase 1 IV:
> Oct  4 17:07:37 frwmarkway pluto[8192]: | current Phase 1 IV:  68 ff 94
> 78  1f a4 01 2f  67 ef 09 ce  29 a9 2b 22
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   1a c7 ac 15
> Oct  4 17:07:37 frwmarkway pluto[8192]: | computed Phase 2 IV:
> Oct  4 17:07:37 frwmarkway pluto[8192]: |   29 b1 df 8e  5a 39 ef 02  a4
> c4 8c 29  06 f1 3a b8
> Oct  4 17:07:38 frwmarkway pluto[8192]: |   f9 98 14 7d
> Oct  4 17:07:38 frwmarkway pluto[8192]: | received encrypted packet from
> 201.5.12.122:500
> Oct  4 17:07:38 frwmarkway pluto[8192]: | decrypting 56 bytes using
> algorithm OAKLEY_3DES_CBC
> Oct  4 17:07:38 frwmarkway pluto[8192]: | decrypted:
> Oct  4 17:07:38 frwmarkway pluto[8192]: |   0d de b3 df  d0 97 f3 47  be
> 69 41 18  df 8f 74 f9
> Oct  4 17:07:38 frwmarkway pluto[8192]: |   27 f6 0d b2  43 e9 e2 22  00
> 00 00 1c  00 00 00 01
> Oct  4 17:07:38 frwmarkway pluto[8192]: |   01 10 00 1c  01 f3 1b 59  9e
> b6 8f 3b  e1 3d e2 a3
> Oct  4 17:07:38 frwmarkway pluto[8192]: |   88 18 30 27  00 00 00 00
> Oct  4 17:07:38 frwmarkway pluto[8192]: | next IV:  c1 6d 80 ca  01 25
> f5 a6
> Oct  4 17:07:38 frwmarkway pluto[8192]: "roadwarrior_jackson"[10]
> 201.5.12.122 #28: byte 2 of ISAKMP Hash Payload must be zero, but is not
> Oct  4 17:07:38 frwmarkway pluto[8192]: "roadwarrior_jackson"[10]
> 201.5.12.122 #28: malformed payload in packet
> Oct  4 17:07:38 frwmarkway pluto[8192]: "roadwarrior_jackson"[10]
> 201.5.12.122 #28: sending notification PAYLOAD_MALFORMED to
> 201.5.12.122:500
> Oct  4 17:07:38 frwmarkway pluto[8192]: | **emit ISAKMP Message:
> Oct  4 17:07:38 frwmarkway pluto[8192]: |    initiator cookie:
> Oct  4 17:07:38 frwmarkway pluto[8192]: |   01 f3 1b 59  9e b6 8f 3b
> Oct  4 17:07:38 frwmarkway pluto[8192]: |    responder cookie:
> Oct  4 17:07:38 frwmarkway pluto[8192]: |   e1 3d e2 a3  88 18 30 27
> Oct  4 17:07:38 frwmarkway pluto[8192]: |    next payload type:
> ISAKMP_NEXT_N
> Oct  4 17:07:38 frwmarkway pluto[8192]: |    ISAKMP version: ISAKMP
> Version 1.0
> Oct  4 17:07:38 frwmarkway pluto[8192]: |    exchange type:
> ISAKMP_XCHG_INFO
> Oct  4 17:07:38 frwmarkway pluto[8192]: |    flags: none
> Oct  4 17:07:38 frwmarkway pluto[8192]: |    message ID:  fb 6c ec dc
> Oct  4 17:07:38 frwmarkway pluto[8192]: | ***emit ISAKMP Notification
> Payload:
> Oct  4 17:07:38 frwmarkway pluto[8192]: |    next payload type:
> ISAKMP_NEXT_NONE
> Oct  4 17:07:38 frwmarkway pluto[8192]: |    DOI: ISAKMP_DOI_IPSEC
> Oct  4 17:07:38 frwmarkway pluto[8192]: |    protocol ID: 1
> Oct  4 17:07:38 frwmarkway pluto[8192]: |    SPI size: 0
> Oct  4 17:07:38 frwmarkway pluto[8192]: |    Notify Message Type:
> PAYLOAD_MALFORMED
> Oct  4 17:07:38 frwmarkway pluto[8192]: | emitting length of ISAKMP
> Notification Payload: 12
> Oct  4 17:07:38 frwmarkway pluto[8192]: | emitting length of ISAKMP
> Message: 40
> Oct  4 17:07:38 frwmarkway pluto[8192]: | sending 40 bytes for
> notification packet through eth0:500 to 201.5.12.122:500:
> Oct  4 17:07:38 frwmarkway pluto[8192]: |   01 f3 1b 59  9e b6 8f 3b  e1
> 3d e2 a3  88 18 30 27
> Oct  4 17:07:38 frwmarkway pluto[8192]: |   0b 10 05 00  fb 6c ec dc  00
> 00 00 28  00 00 00 0c
> Oct  4 17:07:38 frwmarkway pluto[8192]: |   00 00 00 01  01 00 00 10
> Oct  4 17:07:38 frwmarkway pluto[8192]: | next event EVENT_RETRANSMIT in
> 6 seconds for #28
> Oct  4 17:07:44 frwmarkway pluto[8192]: |
> Oct  4 17:07:44 frwmarkway pluto[8192]: | *time to handle event
> Oct  4 17:07:44 frwmarkway pluto[8192]: | handling event
> EVENT_RETRANSMIT
> Oct  4 17:07:44 frwmarkway pluto[8192]: | event after this is
> EVENT_NAT_T_KEEPALIVE in 4 seconds
>
> ########################################################################
> ###################################################
>
> Ipsec whack --status
>
> 000 "roadwarrior_jackson": 192.168.1.0/24===200.150.147.244[C=BR, ST=RJ,
> L=RJ, O=markway, CN=jackson,
> E=jackson.schemes at markway.com.br]---200.150.147.241...%any; unrouted;
> eroute owner: #0
> 000 "roadwarrior_jackson":     srcip=unset; dstip=unset; srcup=ipsec
> _updown; dstup=ipsec _updown;
> 000 "roadwarrior_jackson":   CAs: 'C=BR, ST=RJ, O=markway, CN=CA,
> E=fabio.ferreira at markway.com.br'...'%any'
> 000 "roadwarrior_jackson":   ike_life: 3600s; ipsec_life: 28800s;
> rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 1
> 000 "roadwarrior_jackson":   policy: RSASIG+ENCRYPT+COMPRESS+TUNNEL+PFS;
> prio: 24,32; interface: eth0;
> 000 "roadwarrior_jackson":   newest ISAKMP SA: #0; newest IPsec SA: #0;
> 000 "roadwarrior_jackson"[11]: 192.168.1.0/24===200.150.147.244[C=BR,
> ST=RJ, L=RJ, O=markway, CN=jackson,
> E=jackson.schemes at markway.com.br]---200.150.147.241...201.5.12.122;
> unrouted; eroute owner: #0
> 000 "roadwarrior_jackson"[11]:     srcip=unset; dstip=unset; srcup=ipsec
> _updown; dstup=ipsec _updown;
> 000 "roadwarrior_jackson"[11]:   CAs: 'C=BR, ST=RJ, O=markway, CN=CA,
> E=fabio.ferreira at markway.com.br'...'%any'
> 000 "roadwarrior_jackson"[11]:   ike_life: 3600s; ipsec_life: 28800s;
> rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 1
> 000 "roadwarrior_jackson"[11]:   policy:
> RSASIG+ENCRYPT+COMPRESS+TUNNEL+PFS; prio: 24,32; interface: eth0;
> 000 "roadwarrior_jackson"[11]:   newest ISAKMP SA: #0; newest IPsec SA:
> #0;
> 000
> 000 #31: "roadwarrior_jackson"[11] 201.5.12.122:500 STATE_MAIN_R2 (sent
> MR2, expecting MI3); EVENT_RETRANSMIT in 32s; nodpd
> 000 #33: "roadwarrior_jackson"[11] 201.5.12.122:500 STATE_MAIN_R1 (sent
> MR1, expecting MI2); EVENT_RETRANSMIT in 24s; nodpd
> 000 #32: "roadwarrior_jackson"[11] 201.5.12.122:500 STATE_MAIN_R1 (sent
> MR1, expecting MI2); EVENT_RETRANSMIT in 21s; nodpd
>
> ########################################################################
> ###################################################
>
> Any ideas?
>
> Thanks,
>
> Fabio Ferreira
>
> _______________________________________________
> Users at openswan.org
> http://lists.openswan.org/mailman/listinfo/users
> Building and Integrating Virtual Private Networks with Openswan:
> http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155
>

-- 
Building and integrating Virtual Private Networks with Openswan:
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155


More information about the Users mailing list