[Openswan Users] Error: "initial Main Mode message received on 192.168.23.23:500 but no connection has been authorized"

BUI18 lbui18 at yahoo.com
Mon Apr 7 21:14:39 EDT 2008


Hi Jacco -

Here's an update.  I opened up both port 500 and 4500 on the DIR-130 and on the other end's router.  Now it looks like I get established but can't ping.

Here's "ipsec auto --status":

000 "DIR130-JON": 192.168.23.0/24===192.168.23.23---66.27.a.b...66.27.f.g===192.168.99.0/24; prospective erouted; eroute owner: #0
000 "DIR130-JON":     srcip=unset; dstip=unset; srcup=ipsec _updown; dstup=ipsec _updown;
000 "DIR130-JON":   ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "DIR130-JON":   policy: PSK+ENCRYPT+TUNNEL+PFS+UP; prio: 24,24; interface: eth0; 
000 "DIR130-JON":   newest ISAKMP SA: #10; newest IPsec SA: #0; 
000 "DIR130-JON":   IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024
000  
000 #7: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28266s; lastdpd=-1s(seq in:0 out:0)
000 #4: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28055s; lastdpd=-1s(seq in:0 out:0)
000 #8: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28336s; lastdpd=-1s(seq in:0 out:0)
000 #3: "DIR130-JON":500 STATE_MAIN_I1 (sent MI1, expecting MR1); EVENT_RETRANSMIT in 35s; nodpd
000 #3: pending Phase 2 for "DIR130-JON" replacing #0
000 #9: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28407s; lastdpd=-1s(seq in:0 out:0)
000 #10: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28477s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0)
000 #2: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 27985s; lastdpd=-1s(seq in:0 out:0)
000 #6: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28196s; lastdpd=-1s(seq in:0 out:0)
000 #5: "DIR130-JON":4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 28125s; lastdpd=-1s(seq in:0 out:0)
000

Not sure about line with #3.  It looks like it still tries on port 500.

Here's an excerpt in auth.log:

Apr  7 17:55:31 localhost pluto[17646]: packet from 66.27.f.g:500: received Vendor ID payload [RFC 3947] method set to=109 
Apr  7 17:55:31 localhost pluto[17646]: packet from 66.27.f.g:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109
Apr  7 17:55:31 localhost pluto[17646]: packet from 66.27.f.g:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109
Apr  7 17:55:31 localhost pluto[17646]: packet from 66.27.f.g:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
Apr  7 17:55:31 localhost pluto[17646]: packet from 66.f.g.46:500: received Vendor ID payload [Dead Peer Detection]
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: responding to Main Mode
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: STATE_MAIN_R1: sent MR1, expecting MI2
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: STATE_MAIN_I2: sent MI2, expecting MR2
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: NAT-Traversal: Result using 3: i am NATed
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: STATE_MAIN_R2: sent MR2, expecting MI3
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: I did not send a certificate because I do not have one.
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: NAT-Traversal: Result using 3: i am NATed
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: Main mode peer ID is ID_IPV4_ADDR: '66.27.113.46'
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: I did not send a certificate because I do not have one.
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Apr  7 17:55:31 localhost pluto[17646]: | NAT-T: new mapping 66.27.f.g:500/4500)
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: ignoring informational payload, type INVALID_ID_INFORMATION
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #1: received and ignored informational message
Apr  7 17:55:31 localhost pluto[17646]: "DIR130-JON" #2: Informational Exchange message must be encrypted
Apr  7 17:55:41 localhost pluto[17646]: "DIR130-JON" #2: retransmitting in response to duplicate packet; already STATE_MAIN_R3
Apr  7 17:55:41 localhost pluto[17646]: "DIR130-JON" #1: discarding duplicate packet; already STATE_MAIN_I3
Apr  7 17:55:41 localhost pluto[17646]: "DIR130-JON" #2: Informational Exchange message must be encrypted
Apr  7 17:55:41 localhost pluto[17646]: "DIR130-JON" #1: ignoring informational payload, type INVALID_ID_INFORMATION
Apr  7 17:55:41 localhost pluto[17646]: "DIR130-JON" #1: received and ignored informational message
Apr  7 17:56:01 localhost pluto[17646]: "DIR130-JON" #1: discarding duplicate packet; already STATE_MAIN_I3
Apr  7 17:56:01 localhost pluto[17646]: "DIR130-JON" #2: retransmitting in response to duplicate packet; already STATE_MAIN_R3
Apr  7 17:56:01 localhost pluto[17646]: "DIR130-JON" #1: ignoring informational payload, type INVALID_ID_INFORMATION
Apr  7 17:56:01 localhost pluto[17646]: "DIR130-JON" #1: received and ignored informational message
Apr  7 17:56:01 localhost pluto[17646]: "DIR130-JON" #2: Informational Exchange message must be encrypted
Apr  7 17:56:41 localhost pluto[17646]: "DIR130-JON" #1: max number of retransmissions (2) reached STATE_MAIN_I3.  Possible authentication failure: no acceptable response to our first encrypted message
Apr  7 17:56:41 localhost pluto[17646]: "DIR130-JON" #1: starting keying attempt 2 of an unlimited number
Apr  7 17:56:41 localhost pluto[17646]: "DIR130-JON" #3: initiating Main Mode to replace #1

and this repeats.

Let me know if you have an idea of where I might look next for to get this working.  I really appreciate all the help you have provided.



----- Original Message ----
From: Jacco de Leeuw <jacco2 at dds.nl>
To: users at openswan.org
Sent: Monday, April 7, 2008 3:32:38 PM
Subject: Re: [Openswan Users] Error: "initial Main Mode message received on 192.168.23.23:500 but no connection has been authorized"


BUI18 wrote:

> conn DIR130-JON
>        left=192.168.23.23
>        leftsubnet=192.168.23.0/24
>        leftnexthop=66.27.a.b

How about this:
leftnexthop=192.168.23.1

> Apr  7 14:23:02 localhost pluto[19788]: "DIR130-JON": route-client
> output: /usr/lib/ipsec/_updown: doroute `ip route add 192.168.99.0/24
> via 66.27.a.b dev eth0 ' failed (RTNETLINK answers: Network is unreachable)

Jacco
-- 
Jacco de Leeuw                        mailto:jacco2 at dds.nl
Zaandam, The Netherlands          http://www.jacco2.dds.nl
_______________________________________________
Users at openswan.org
http://lists.openswan.org/mailman/listinfo/users
Building and Integrating Virtual Private Networks with Openswan: 
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155


      ____________________________________________________________________________________
You rock. That's why Blockbuster's offering you one month of Blockbuster Total Access, No Cost.  
http://tc.deals.yahoo.com/tc/blockbuster/text5.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.openswan.org/pipermail/users/attachments/20080407/9c51839e/attachment.html 


More information about the Users mailing list