[Openswan Users] Getting there....

[Chris Thomas]

OK, I changed my Linksys box to 1024 bit and I now have this:

 

Mar 13 16:01:48 gatekeeper pluto[11850]: packet from (remote site
IP):500: ignoring unknown Vendor ID payload [4f4540454371496d7a684644]

Mar 13 16:01:48 gatekeeper pluto[11850]: packet from (remote site
IP):500: received Vendor ID payload [Dead Peer Detection]

Mar 13 16:01:48 gatekeeper pluto[11850]: packet from (remote site
IP):500: received Vendor ID payload [RFC 3947] meth=110, but port
floating is off

Mar 13 16:01:48 gatekeeper pluto[11850]: packet from (remote site
IP):500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
meth=108, but port floating is off

Mar 13 16:01:48 gatekeeper pluto[11850]: packet from (remote site
IP):500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
meth=107, but port floating is off

Mar 13 16:01:48 gatekeeper pluto[11850]: packet from (remote site
IP):500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]

Mar 13 16:01:48 gatekeeper pluto[11850]: "pax_square"[5] (remote site
IP) #9: responding to Main Mode from unknown peer (remote site IP)

Mar 13 16:01:48 gatekeeper pluto[11850]: "pax_square"[5] (remote site
IP) #9: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1

Mar 13 16:01:48 gatekeeper pluto[11850]: "pax_square"[5] (remote site
IP) #9: STATE_MAIN_R1: sent MR1, expecting MI2

Mar 13 16:02:28 gatekeeper pluto[11850]: "pax_square"[5] (remote site
IP) #7: max number of retransmissions (2) reached STATE_MAIN_R1

 

Thanks

-Chris

 

 

From: Peter McGill [mailto:petermcgill at goco.net] 
Sent: Thursday, March 13, 2008 3:50 PM
To: Chris Thomas; users at openswan.org
Subject: RE: [Openswan Users] Getting there....

 

There is a mismatch in your options, specifically your DH/modp Group.

Diffie-Hellman (DH) Group needs to match openswan's ike=*-modp????

I'm guessing that your linksys is sending Diffie-Hellmen (DH) Group 1
(768-bit).

Openswan will not allow this because it's too weak of security.

If you have ike=3des-md5-modp1024 or ike=aes-sha1-modp1024 as I
suggested,

then change your linksys to use Group 2 (1024-bit) to match it.

 

Peter McGill

 

	 

	
________________________________


	From: users-bounces at openswan.org
[mailto:users-bounces at openswan.org] On Behalf Of Chris Thomas
	Sent: March 13, 2008 3:40 PM
	To: users at openswan.org
	Subject: [Openswan Users] Getting there....

	Hello again, everyone.  I have configured my Linksys box to
connect to my Ubuntu server running OpenSwan, but when I attempt to
initiate the connection, my logs on the server at HQ get full of this
stuff:

	 

	 

	Mar 13 15:31:54 gatekeeper pluto[11850]: packet from (remote
site external IP):500: ignoring unknown Vendor ID payload
[4f4540454371496d7a684644]

	Mar 13 15:31:54 gatekeeper pluto[11850]: packet from (remote
site external IP):500: received Vendor ID payload [Dead Peer Detection]

	Mar 13 15:31:54 gatekeeper pluto[11850]: packet from (remote
site external IP):500: received Vendor ID payload [RFC 3947] meth=110,
but port floating is off

	Mar 13 15:31:54 gatekeeper pluto[11850]: packet from (remote
site external IP):500: received Vendor ID payload
[draft-ietf-ipsec-nat-t-ike-03] meth=108, but port floating is off

	Mar 13 15:31:54 gatekeeper pluto[11850]: packet from (remote
site external IP):500: received Vendor ID payload
[draft-ietf-ipsec-nat-t-ike-02] meth=107, but port floating is off

	Mar 13 15:31:54 gatekeeper pluto[11850]: packet from (remote
site external IP):500: ignoring Vendor ID payload
[draft-ietf-ipsec-nat-t-ike-00]

	Mar 13 15:31:54 gatekeeper pluto[11850]: "pax_square"[1] (remote
site external IP) #1: responding to Main Mode from unknown peer (remote
site external IP)

	Mar 13 15:31:54 gatekeeper pluto[11850]: "pax_square"[1] (remote
site external IP) #1: only OAKLEY_GROUP_MODP1024 and
OAKLEY_GROUP_MODP1536 supported.  Attribute OAKLEY_GROUP_DESCRIPTION

	Mar 13 15:31:54 gatekeeper pluto[11850]: "pax_square"[1] (remote
site external IP) #1: no acceptable Oakley Transform

	Mar 13 15:31:54 gatekeeper pluto[11850]: "pax_square"[1] (remote
site external IP) #1: sending notification NO_PROPOSAL_CHOSEN to (remote
site external IP):500

	Mar 13 15:31:54 gatekeeper pluto[11850]: "pax_square"[1] (remote
site external IP): deleting connection "pax_square" instance with peer
(remote site external IP) {isakmp=#0/ipsec=#0}

	 

	I am assuming that it has something to do with the Preshared key
that I am using, but I am not too sure how to go about fixing it.  I do
not want to be a nuisance, but can anyone give me a (another) push in
the right direction?  

	 

	I appreciate your patience.

	-Chris

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.openswan.org/pipermail/users/attachments/20080313/d2a85648/attachment.html