[Openswan Users] Error: "initial Main Mode message received on 192.168.23.23:500 but no connection has been authorized"
BUI18
lbui18 at yahoo.com
Mon Apr 7 21:14:39 EDT 2008
Hi Jacco -
Here's an update. I opened up both port 500 and 4500 on the DIR-130 and on the other end's router. Now it looks like I get established but can't ping.
Here's "ipsec auto --status":
000 "DIR130-JON": 192.168.23.0/24===192.168.23.23---66.27.a.b...66.27.f.g===192.168.99.0/24; prospective erouted; eroute owner: #0
000 "DIR130-JON": srcip=unset; dstip=unset; srcup=ipsec _updown; dstup=ipsec _updown;
000 "DIR130-JON": ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "DIR130-JON": policy: PSK+ENCRYPT+TUNNEL+PFS+UP; prio: 24,24; interface: eth0;
000 "DIR130-JON": newest ISAKMP SA: #10; newest IPsec SA: #0;
000 "DIR130-JON": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024
000
000 #7: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28266s; lastdpd=-1s(seq in:0 out:0)
000 #4: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28055s; lastdpd=-1s(seq in:0 out:0)
000 #8: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28336s; lastdpd=-1s(seq in:0 out:0)
000 #3: "DIR130-JON":500 STATE_MAIN_I1 (sent MI1, expecting MR1); EVENT_RETRANSMIT in 35s; nodpd
000 #3: pending Phase 2 for "DIR130-JON" replacing #0
000 #9: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28407s; lastdpd=-1s(seq in:0 out:0)
000 #10: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28477s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0)
000 #2: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 27985s; lastdpd=-1s(seq in:0 out:0)
000 #6: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28196s; lastdpd=-1s(seq in:0 out:0)
000 #5: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28125s; lastdpd=-1s(seq in:0 out:0)
000
Not sure about line with #3. It looks like it still tries on port 500.
Here's an excerpt in auth.log:
Apr 7 17:55:31 localhost pluto[17646]: packet from 66.27.f.g:500: received Vendor ID payload [RFC 3947] method set to=109
Apr 7 17:55:31 localhost pluto[17646]: packet from 66.27.f.g:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109
Apr 7 17:55:31 localhost pluto[17646]: packet from 66.27.f.g:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109
Apr 7 17:55:31 localhost pluto[17646]: packet from 66.27.f.g:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
Apr 7 17:55:31 localhost pluto[17646]: packet from 66.f.g.46:500: received Vendor ID payload [Dead Peer Detection]
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: responding to Main Mode
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: STATE_MAIN_R1: sent MR1, expecting MI2
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: STATE_MAIN_I2: sent MI2, expecting MR2
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: NAT-Traversal: Result using 3: i am NATed
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: STATE_MAIN_R2: sent MR2, expecting MI3
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: I did not send a certificate because I do not have one.
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: NAT-Traversal: Result using 3: i am NATed
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: Main mode peer ID is ID_IPV4_ADDR: '66.27.113.46'
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: I did not send a certificate because I do not have one.
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Apr 7 17:55:31 localhost pluto[17646]: | NAT-T: new mapping 66.27.f.g:500/4500)
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: ignoring informational payload, type INVALID_ID_INFORMATION
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: received and ignored informational message
Apr 7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: Informational Exchange message must be encrypted
Apr 7 17:55:41 localhost pluto[17646]: "DIR130-JON" #2: retransmitting in response to duplicate packet; already STATE_MAIN_R3
Apr 7 17:55:41 localhost pluto[17646]: "DIR130-JON" #1: discarding duplicate packet; already STATE_MAIN_I3
Apr 7 17:55:41 localhost pluto[17646]: "DIR130-JON" #2: Informational Exchange message must be encrypted
Apr 7 17:55:41 localhost pluto[17646]: "DIR130-JON" #1: ignoring informational payload, type INVALID_ID_INFORMATION
Apr 7 17:55:41 localhost pluto[17646]: "DIR130-JON" #1: received and ignored informational message
Apr 7 17:56:01 localhost pluto[17646]: "DIR130-JON" #1: discarding duplicate packet; already STATE_MAIN_I3
Apr 7 17:56:01 localhost pluto[17646]: "DIR130-JON" #2: retransmitting in response to duplicate packet; already STATE_MAIN_R3
Apr 7 17:56:01 localhost pluto[17646]: "DIR130-JON" #1: ignoring informational payload, type INVALID_ID_INFORMATION
Apr 7 17:56:01 localhost pluto[17646]: "DIR130-JON" #1: received and ignored informational message
Apr 7 17:56:01 localhost pluto[17646]: "DIR130-JON" #2: Informational Exchange message must be encrypted
Apr 7 17:56:41 localhost pluto[17646]: "DIR130-JON" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message
Apr 7 17:56:41 localhost pluto[17646]: "DIR130-JON" #1: starting keying attempt 2 of an unlimited number
Apr 7 17:56:41 localhost pluto[17646]: "DIR130-JON" #3: initiating Main Mode to replace #1
and this repeats.
Let me know if you have an idea of where I might look next for to get this working. I really appreciate all the help you have provided.
----- Original Message ----
From: Jacco de Leeuw <jacco2 at dds.nl>
To: users at openswan.org
Sent: Monday, April 7, 2008 3:32:38 PM
Subject: Re: [Openswan Users] Error: "initial Main Mode message received on 192.168.23.23:500 but no connection has been authorized"
BUI18 wrote:
> conn DIR130-JON
> left=192.168.23.23
> leftsubnet=192.168.23.0/24
> leftnexthop=66.27.a.b
How about this:
leftnexthop=192.168.23.1
> Apr 7 14:23:02 localhost pluto[19788]: "DIR130-JON": route-client
> output: /usr/lib/ipsec/_updown: doroute `ip route add 192.168.99.0/24
> via 66.27.a.b dev eth0 ' failed (RTNETLINK answers: Network is unreachable)
Jacco
--
Jacco de Leeuw mailto:jacco2 at dds.nl
Zaandam, The Netherlands http://www.jacco2.dds.nl
_______________________________________________
Users at openswan.org
http://lists.openswan.org/mailman/listinfo/users
Building and Integrating Virtual Private Networks with Openswan:
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155
____________________________________________________________________________________
You rock. That's why Blockbuster's offering you one month of Blockbuster Total Access, No Cost.
http://tc.deals.yahoo.com/tc/blockbuster/text5.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.openswan.org/pipermail/users/attachments/20080407/9c51839e/attachment.html
More information about the Users
mailing list