[Openswan Users] Openswan and Netopia in aggressive mode
Andy Van den Heede
andy.vandenheede at secuteam.com
Tue Sep 26 00:18:39 EDT 2006
Hello Openswan Users,
I am trying to configure openswan for a vpn with a Netopia router in
aggressive mode. I use aggressive mode (I know it is not so safe!),
because I have a lot of Netopia routers, and with a Netopia router it is
not possible to define a left id and right id in main mode (it will use
default the external address). All my Netopia routers have a dynamic ip
address. Also define a dyndns account is not possible on the Netopia.
When I use main mode with 1 Netopia router, the vpn is working perfect.
When I use more than 1 Netopia router, I can't build up the two tunnels.
In log files I have this:
Sep 24 09:48:22 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
Aggressive mode peer ID is ID_FQDN: '@netopia.ipsec'
Sep 24 09:48:22 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
responding to Aggressive Mode, state #1, connection "openswan" from
80.201.162.93
Sep 24 09:48:22 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
transition from state STATE_AGGR_R0 to state STATE_AGGR_R1
Sep 24 09:48:22 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
STATE_AGGR_R1: sent AR1, expecting AI2
Sep 24 09:48:22 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
packet rejected: should have been encrypted
Sep 24 09:48:22 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
sending notification INVALID_FLAGS to 80.201.162.93:500
Sep 24 09:48:22 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
next payload type of ISAKMP Hash Payload has an unknown value: 56
Sep 24 09:48:22 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
malformed payload in packet
Sep 24 09:48:22 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
sending notification PAYLOAD_MALFORMED to 80.201.162.93:500
Sep 24 09:48:24 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
Quick Mode message is unacceptable because it is for an incomplete
ISAKMP SA
Sep 24 09:48:24 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
sending notification PAYLOAD_MALFORMED to 80.201.162.93:500
Sep 24 09:48:40 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
Quick Mode message is unacceptable because it is for an incomplete
ISAKMP SA
Sep 24 09:48:40 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
sending notification PAYLOAD_MALFORMED to 80.201.162.93:500
Sep 24 09:48:55 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
Quick Mode message is unacceptable because it is for an incomplete
ISAKMP SA
Sep 24 09:48:55 axsweb pluto[30079]: "openswan"[1] 80.201.162.93 #1:
sending notification PAYLOAD_MALFORMED to 80.201.162.93:500
My ipsec.conf file looks like this:
conn openswan
left="62.166.214.114"
leftsubnet="192.168.123.0/255.255.255.0"
leftnexthop="62.166.214.113"
leftid="@openswan.ipsec"
right="0.0.0.0"
rightsubnet="10.0.0.0/255.255.255.0"
rightid="@netopia.ipsec"
auto="add"
authby="secret"
type="tunnel"
keyexchange="ike"
auth="esp"
pfs="no"
ike="3des-md5-modp1024"
ikelifetime="28800"
esp="3des-md5-96"
keylife="3600"
aggrmode="yes"
rekey="yes"
My ipsec.secrets:
@openswan.ipsec @netopia.ipsec: PSK "PreSharedKey"
Whe I only remove the aggrmode="yes" in my ipsec.conf file and also
change the settings on the Netopia from aggressive mode to main=mode,
the vpn tunnel builds up directly (this is the log file below):
Sep 24 09:58:21 axsweb pluto[32522]: "openswan"[1] 80.201.162.93 #1:
responding to Main Mode from unknown peer 80.201.162.93
Sep 24 09:58:21 axsweb pluto[32522]: "openswan"[1] 80.201.162.93 #1:
transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Sep 24 09:58:21 axsweb pluto[32522]: "openswan"[1] 80.201.162.93 #1:
STATE_MAIN_R1: sent MR1, expecting MI2
Sep 24 09:58:21 axsweb pluto[32522]: "openswan"[1] 80.201.162.93 #1:
ignoring unknown Vendor ID payload [3652d8cb0c2e66807ce8b6adf4a7a26c]
Sep 24 09:58:21 axsweb pluto[32522]: "openswan"[1] 80.201.162.93 #1:
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Sep 24 09:58:21 axsweb pluto[32522]: "openswan"[1] 80.201.162.93 #1:
STATE_MAIN_R2: sent MR2, expecting MI3
Sep 24 09:58:21 axsweb pluto[32522]: "openswan"[1] 80.201.162.93 #1:
Main mode peer ID is ID_IPV4_ADDR: '0.0.0.0'
Sep 24 09:58:21 axsweb pluto[32522]: "openswan"[1] 80.201.162.93 #1:
switched from "openswan" to "openswan"
Sep 24 09:58:21 axsweb pluto[32522]: "openswan"[2] 80.201.162.93 #1:
deleting connection "openswan" instance with peer 80.201.162.93
{isakmp=#0/ipsec=#0}
Sep 24 09:58:21 axsweb pluto[32522]: "openswan"[2] 80.201.162.93 #1: I
did not send a certificate because I do not have one.
Sep 24 09:58:21 axsweb pluto[32522]: "openswan"[2] 80.201.162.93 #1:
transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Sep 24 09:58:21 axsweb pluto[32522]: "openswan"[2] 80.201.162.93 #1:
STATE_MAIN_R3: sent MR3, ISAKMP SA established
{auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5
group=modp1024}
Sep 24 09:58:22 axsweb pluto[32522]: "openswan"[2] 80.201.162.93 #2:
responding to Quick Mode {msgid:1b7445e5}
Sep 24 09:58:22 axsweb pluto[32522]: "openswan"[2] 80.201.162.93 #2:
transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
Sep 24 09:58:22 axsweb pluto[32522]: "openswan"[2] 80.201.162.93 #2:
STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
Sep 24 09:58:22 axsweb pluto[32522]: "openswan"[2] 80.201.162.93 #2:
transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
Sep 24 09:58:22 axsweb pluto[32522]: "openswan"[2] 80.201.162.93 #2:
STATE_QUICK_R2: IPsec SA established {ESP=>0x863d0c7a <0x50d8ba1b
xfrm=3DES_0-HMAC_MD5 NATD=none DPD=none}
If I run "ipsec auto --status" :
000 interface lo/lo 127.0.0.1
000 interface eth0/eth0 62.166.214.114
000 interface eth1/eth1 192.168.123.1
000 %myid = (none)
000 debug none
000
000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64,
keysizemax=64
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192,
keysizemax=192
000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8,
keysizemin=40, keysizemax=448
000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0,
keysizemax=0
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128,
keysizemax=256
000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5,
keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1,
keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256,
keysizemin=256, keysizemax=256
000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0,
keysizemax=0
000
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8,
keydeflen=192
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16,
keydeflen=128
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000
000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0}
trans={0,0,0} attrs={0,0,0}
000
000 "openswan":
192.168.123.0/24===62.166.214.114---62.166.214.113...%any===10.0.0.0/24;
unrouted; eroute owner: #0
000 "openswan": srcip=unset; dstip=unset; srcup=ipsec _updown;
dstup=ipsec _updown;
000 "openswan": ike_life: 3600s; ipsec_life: 28800s; rekey_margin:
540s; rekey_fuzz: 100%; keyingtries: 0
000 "openswan": policy: PSK+ENCRYPT+TUNNEL; prio: 24,24; interface:
eth0;
000 "openswan": newest ISAKMP SA: #0; newest IPsec SA: #0;
000 "openswan": ESP algorithms wanted: 3_000-1, flags=strict
000 "openswan": ESP algorithms loaded: 3_000-1, flags=strict
000 "openswan"[2]:
192.168.123.0/24===62.166.214.114---62.166.214.113...80.201.162.93[0.0.0
.0]===10.0.0.0/24; erouted; eroute owner: #2
000 "openswan"[2]: srcip=unset; dstip=unset; srcup=ipsec _updown;
dstup=ipsec _updown;
000 "openswan"[2]: ike_life: 3600s; ipsec_life: 28800s; rekey_margin:
540s; rekey_fuzz: 100%; keyingtries: 0
000 "openswan"[2]: policy: PSK+ENCRYPT+TUNNEL; prio: 24,24; interface:
eth0;
000 "openswan"[2]: newest ISAKMP SA: #1; newest IPsec SA: #2;
000 "openswan"[2]: IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024
000 "openswan"[2]: ESP algorithms wanted: 3_000-1, flags=strict
000 "openswan"[2]: ESP algorithms loaded: 3_000-1, flags=strict
000 "openswan"[2]: ESP algorithm newest: 3DES_0-HMAC_MD5;
pfsgroup=<N/A>
000
000 #2: "openswan"[2] 80.201.162.93:500 STATE_QUICK_R2 (IPsec SA
established); EVENT_SA_REPLACE in 3132s; newest IPSEC; eroute owner
000 #2: "openswan"[2] 80.201.162.93 esp.863d0c7a at 80.201.162.93
esp.50d8ba1b at 62.166.214.114 tun.0 at 80.201.162.93 tun.0 at 62.166.214.114
000 #1: "openswan"[2] 80.201.162.93:500 STATE_MAIN_R3 (sent MR3, ISAKMP
SA established); EVENT_SA_REPLACE in 3131s; newest ISAKMP; nodpd
Do I have to change something in the ipsec.conf I use aggressive mode?
Andy Van den Heede
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.openswan.org/pipermail/users/attachments/20060926/cf203abf/attachment-0001.html
More information about the Users
mailing list