[Openswan Users] newbie with 1st setup question

Gary Stainburn gary at ringways.co.uk
Thu May 14 14:23:38 EDT 2009


Evening all,  I'm new to this list and new to IPSEC and Openswan, so if this 
is a FAQ I appologise.

I've followed the instructions on the wiki to install Openswan, and to 
configure an IPSEC connection between groucho and harpo (both Fedora 9).

When I start up the connection, the output in the session window looks okay, 
but the log files on both machines show problems, and I cannot get traffic to 
pass down the VPN.

If someone could point out the error of my ways I'd appreciate it.

Gary

[console]

[root at groucho ~]# ipsec auto --up leeds-to-rmg                                                                                                             
104 "leeds-to-rmg" #6: STATE_MAIN_I1: initiate
010 "leeds-to-rmg" #6: STATE_MAIN_I1: retransmission; will wait 20s for 
response
003 "leeds-to-rmg" #6: received Vendor ID payload [Openswan (this version) 
2.6.19 ]
003 "leeds-to-rmg" #6: received Vendor ID payload [Dead Peer Detection]
003 "leeds-to-rmg" #6: received Vendor ID payload [RFC 3947] method set to=109
106 "leeds-to-rmg" #6: STATE_MAIN_I2: sent MI2, expecting MR2
010 "leeds-to-rmg" #6: STATE_MAIN_I2: retransmission; will wait 20s for 
response
003 "leeds-to-rmg" #6: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): i 
am NATed
108 "leeds-to-rmg" #6: STATE_MAIN_I3: sent MI3, expecting MR3
003 "leeds-to-rmg" #6: received Vendor ID payload [CAN-IKEv2]
004 "leeds-to-rmg" #6: STATE_MAIN_I4: ISAKMP SA established 
{auth=OAKLEY_RSA_SIG cipher=aes_128 prf=oakley_sha group=modp2048}
117 "leeds-to-rmg" #7: STATE_QUICK_I1: initiate
004 "leeds-to-rmg" #7: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel 
mode {ESP=>0xec8073f0 <0x7c1258f6 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none 
DPD=none}
[root at groucho ~]# ping 10.1.1.115
PING 10.1.1.115 (10.1.1.115) 56(84) bytes of data.
^C
--- 10.1.1.115 ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 4254ms

[root at groucho ~]#


[/var/log/ipsec on groucho]

[root at groucho ~]# tail -f /var/log/ipsec
May 14 18:50:44 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: initiating Main 
Mode
May 14 18:50:54 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: received Vendor 
ID payload [Openswan (this version) 2.6.19 ]
May 14 18:50:54 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: received Vendor 
ID payload [Dead Peer Detection]
May 14 18:50:54 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: received Vendor 
ID payload [RFC 3947] method set to=109
May 14 18:50:54 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: enabling 
possible NAT-traversal with method 4
May 14 18:50:54 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: discarding 
packet received during asynchronous work (DNS or crypto) in STATE_MAIN_I1
May 14 18:50:54 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: transition from 
state STATE_MAIN_I1 to state STATE_MAIN_I2
May 14 18:50:54 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: STATE_MAIN_I2: 
sent MI2, expecting MR2
May 14 18:51:04 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: NAT-Traversal: 
Result using RFC 3947 (NAT-Traversal): i am NATed
May 14 18:51:04 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: transition from 
state STATE_MAIN_I2 to state STATE_MAIN_I3
May 14 18:51:04 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: STATE_MAIN_I3: 
sent MI3, expecting MR3
May 14 18:51:04 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: received Vendor 
ID payload [CAN-IKEv2]
May 14 18:51:04 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: Main mode peer 
ID is ID_FQDN: '@harpo.ringways.co.uk'
May 14 18:51:04 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: transition from 
state STATE_MAIN_I3 to state STATE_MAIN_I4
May 14 18:51:04 s_sys at groucho pluto[2598]: "leeds-to-rmg" #6: STATE_MAIN_I4: 
ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=aes_128 prf=oakley_sha 
group=modp2048}
May 14 18:51:04 s_sys at groucho pluto[2598]: "leeds-to-rmg" #7: initiating Quick 
Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW {using isakmp#6 msgid:c4a84f9a 
proposal=defaults pfsgroup=OAKLEY_GROUP_MODP2048}
May 14 18:51:04 s_sys at groucho pluto[2598]: "leeds-to-rmg" #7: transition from 
state STATE_QUICK_I1 to state STATE_QUICK_I2
May 14 18:51:04 s_sys at groucho pluto[2598]: "leeds-to-rmg" #7: STATE_QUICK_I2: 
sent QI2, IPsec SA established tunnel mode {ESP=>0xec8073f0 <0x7c1258f6 
xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}
May 14 18:51:14 s_sys at groucho pluto[2598]: packet from 77.86.27.2:500: phase 1 
message is part of an unknown exchange

[/var/log/ipsec on harpo]

[root at harpo ~]# tail -f /var/log/ipsec 
May 14 18:44:59 s_sys at harpo pluto[30054]: packet from 91.85.127.194:52855: 
received Vendor ID payload [Openswan (this version) 2.6.19 ]
May 14 18:44:59 s_sys at harpo pluto[30054]: packet from 91.85.127.194:52855: 
received Vendor ID payload [Dead Peer Detection]            
May 14 18:44:59 s_sys at harpo pluto[30054]: packet from 91.85.127.194:52855: 
received Vendor ID payload [RFC 3947] method set to=109     
May 14 18:44:59 s_sys at harpo pluto[30054]: packet from 91.85.127.194:52855: 
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but 
already using method 109                                                                                                                                              
May 14 18:44:59 s_sys at harpo pluto[30054]: packet from 91.85.127.194:52855: 
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but 
already using method 109                                                                                                                                            
May 14 18:44:59 s_sys at harpo pluto[30054]: packet from 91.85.127.194:52855: 
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but 
already using method 109                                                                                                                                              
May 14 18:44:59 s_sys at harpo pluto[30054]: "leeds-to-rmg" #4: responding to 
Main Mode                                                                         
May 14 18:44:59 s_sys at harpo pluto[30054]: "leeds-to-rmg" #4: transition from 
state STATE_MAIN_R0 to state STATE_MAIN_R1                                      
May 14 18:44:59 s_sys at harpo pluto[30054]: "leeds-to-rmg" #4: STATE_MAIN_R1: 
sent MR1, expecting MI2                                                          
May 14 18:45:09 s_sys at harpo pluto[30054]: packet from 91.85.127.194:52855: 
received Vendor ID payload [Openswan (this version) 2.6.19 ]                      
May 14 18:45:09 s_sys at harpo pluto[30054]: packet from 91.85.127.194:52855: 
received Vendor ID payload [Dead Peer Detection]                                  
May 14 18:45:09 s_sys at harpo pluto[30054]: packet from 91.85.127.194:52855: 
received Vendor ID payload [RFC 3947] method set to=109                           
May 14 18:45:09 s_sys at harpo pluto[30054]: packet from 91.85.127.194:52855: 
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but 
already using method 109                                                                                                                                              
May 14 18:45:09 s_sys at harpo pluto[30054]: packet from 91.85.127.194:52855: 
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but 
already using method 109                                                                                                                                            
May 14 18:45:09 s_sys at harpo pluto[30054]: packet from 91.85.127.194:52855: 
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but 
already using method 109                                                                                                                                              
May 14 18:45:09 s_sys at harpo pluto[30054]: "leeds-to-rmg" #5: responding to 
Main Mode                                                                         
May 14 18:45:09 s_sys at harpo pluto[30054]: "leeds-to-rmg" #5: transition from 
state STATE_MAIN_R0 to state STATE_MAIN_R1                                      
May 14 18:45:09 s_sys at harpo pluto[30054]: "leeds-to-rmg" #5: STATE_MAIN_R1: 
sent MR1, expecting MI2
May 14 18:45:09 s_sys at harpo pluto[30054]: "leeds-to-rmg" #5: NAT-Traversal: 
Result using RFC 3947 (NAT-Traversal): peer is NATed
May 14 18:45:09 s_sys at harpo pluto[30054]: "leeds-to-rmg" #5: transition from 
state STATE_MAIN_R1 to state STATE_MAIN_R2
May 14 18:45:09 s_sys at harpo pluto[30054]: "leeds-to-rmg" #5: STATE_MAIN_R2: 
sent MR2, expecting MI3
May 14 18:45:19 s_sys at harpo pluto[30054]: "leeds-to-rmg" #5: discarding 
duplicate packet; already STATE_MAIN_R2
May 14 18:45:19 s_sys at harpo pluto[30054]: "leeds-to-rmg" #5: Main mode peer ID 
is ID_FQDN: '@groucho.ringways.co.uk'
May 14 18:45:19 s_sys at harpo pluto[30054]: "leeds-to-rmg" #5: transition from 
state STATE_MAIN_R2 to state STATE_MAIN_R3
May 14 18:45:19 s_sys at harpo pluto[30054]: "leeds-to-rmg" #5: new NAT mapping 
for #5, was 91.85.127.194:52855, now 91.85.127.194:52892
May 14 18:45:19 s_sys at harpo pluto[30054]: "leeds-to-rmg" #5: STATE_MAIN_R3: 
sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=aes_128 
prf=oakley_sha group=modp2048}
May 14 18:45:19 s_sys at harpo pluto[30054]: "leeds-to-rmg" #5: the peer 
proposed: 10.1.0.0/16:0/0 -> 10.6.0.0/16:0/0
May 14 18:45:19 s_sys at harpo pluto[30054]: "leeds-to-rmg" #6: responding to 
Quick Mode proposal {msgid:c4a84f9a}
May 14 18:45:19 s_sys at harpo pluto[30054]: "leeds-to-rmg" #6:     us: 
10.1.0.0/16===77.86.27.2<77.86.27.2>[@harpo.ringways.co.uk,+S=C]---77.86.27.1
May 14 18:45:19 s_sys at harpo pluto[30054]: "leeds-to-rmg" #6:   them: 
77.86.27.1---91.85.127.194<91.85.127.194>[@groucho.ringways.co.uk,
+S=C]===10.6.0.0/16
May 14 18:45:19 s_sys at harpo pluto[30054]: "leeds-to-rmg" #6: transition from 
state STATE_QUICK_R0 to state STATE_QUICK_R1
May 14 18:45:19 s_sys at harpo pluto[30054]: "leeds-to-rmg" #6: STATE_QUICK_R1: 
sent QR1, inbound IPsec SA installed, expecting QI2
May 14 18:45:19 s_sys at harpo pluto[30054]: "leeds-to-rmg" #6: transition from 
state STATE_QUICK_R1 to state STATE_QUICK_R2
May 14 18:45:19 s_sys at harpo pluto[30054]: "leeds-to-rmg" #6: STATE_QUICK_R2: 
IPsec SA established tunnel mode {ESP=>0x7c1258f6 <0xec8073f0 
xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=91.85.127.194:52892 DPD=none}
May 14 18:46:09 s_sys at harpo pluto[30054]: "leeds-to-rmg" #4: max number of 
retransmissions (2) reached STATE_MAIN_R1


[/etc/ipsec.d/leeds-to-rmg.conf]

[root at harpo ~]# more /etc/ipsec.d/leeds-to-rmg.conf
conn leeds-to-rmg
    left=77.86.27.2
    leftid=@harpo.ringways.co.uk
    leftsubnet=10.1.0.0/16
    leftnexthop=%defaultroute
    leftrsasigkey=[cut]
    rightnexthop=%defaultroute
    right=91.85.127.194
    rightsubnet=10.6.0.0/16
    rightid=@groucho.ringways.co.uk
    rightrsasigkey=[cut]
    auto=start
[root at harpo ~]#

-- 
Gary Stainburn
 
This email does not contain private or confidential material as it
may be snooped on by interested government parties for unknown
and undisclosed purposes - Regulation of Investigatory Powers Act, 2000     


More information about the Users mailing list