[Openswan Users] Linux (debian lenny) client to Checkpoint Firewall NGx R65 using certificates - secureclient ok, openswan ko - PAYLOAD_MALFORMED
Luca Arzeni
l.arzeni at gmail.com
Wed May 12 13:07:50 EDT 2010
Hi Ondrej,
just to be sure, I've set up a CentOS machine with vmware player, and tried
a connection using exactly the same configuration that you used (Openswan
IPsec U2.6.21/K2.6.18-164.el5), but I had no luck... same failure that I
received under Lenny...
May 12 19:02:25 fwcentos pluto[3807]: "openswan-checkpoint" #2: transition
from state STATE_MAIN_I1 to state STATE_MAIN_I2
May 12 19:02:25 fwcentos pluto[3807]: "openswan-checkpoint" #2:
STATE_MAIN_I2: sent MI2, expecting MR2
May 12 19:02:25 fwcentos pluto[3807]: "openswan-checkpoint" #2: received 1
malformed payload notifies
I don't know what else could be the cause of the problems...
Your, faithfully (and desperately), Luca
On Wed, May 12, 2010 at 11:14 AM, Ondrej Valousek <webserv at s3group.cz>wrote:
> Hi Luca,
>
> You definitely need to enable pluto to send more debugging messages.
> This way we do not even know what is it trying to do.
> Also, at this IKE stage is the kernel version not relevant as the VPN
> negotiation is fully in charge of pluto.
>
> Ondrej
>
>
> On 11.05.2010 17:36, Luca Arzeni wrote:
>
> Thanks Ondrej,
> you are right, I've read so many articles that I was confused.
> Anyway, from your article I understand that:
> You are using openswan 2.6.21 on a linux kernel 2.6.18, with netkey.
>
> I'm on a Debian lenny with kernel 2.6.26-2-amd64. I was using the
> debian-provided openswan 2.4.12 using netkey.
>
> My kernel is newer than the Centos that you've used. I downloaded the
> latest openswan (2.6.25) and tested with it.
>
> Problem is still here. Do you have any other hint? I wouldn't like to
> install Centos to open this vpn...
>
> May 11 16:33:20 gadara pluto[19323]: "openswan-checkpoint" #1: initiating
> Main Mode
> May 11 16:33:20 gadara pluto[19323]: "openswan-checkpoint" #1: received
> Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
> May 11 16:33:20 gadara pluto[19323]: "openswan-checkpoint" #1: enabling
> possible NAT-traversal with method draft-ietf-ipsec-nat-t-ike-05
> May 11 16:33:20 gadara pluto[19323]: "openswan-checkpoint" #1: transition
> from state STATE_MAIN_I1 to state STATE_MAIN_I2
> May 11 16:33:20 gadara pluto[19323]: "openswan-checkpoint" #1:
> STATE_MAIN_I2: sent MI2, expecting MR2
> May 11 16:33:20 gadara pluto[19323]: "openswan-checkpoint" #1: received 1
> malformed payload notifies
> May 11 16:34:10 gadara pluto[19323]: shutting down
>
> Thanks, Luca
>
>
> On Tue, May 11, 2010 at 1:20 PM, Ondrej Valousek <webserv at s3group.cz>wrote:
>
>> Hi Luca,
>>
>> Make sure you read the article carefully - it contains answers to all your
>> questions :-)
>> I have made this article as it was the way which worked for me.
>>
>> Ondrej
>>
>>
>>
>> On 11.05.2010 12:26, Luca Arzeni wrote:
>>
>>> Thanks Ondrej,
>>> I've already followed that howto, but it fails. It refers to openswan in
>>> the header, but in the logs you can see that it's really a freeswan.
>>>
>>> Can you confirm that you are using openswan?
>>> What are your openswan and kernel version?
>>> Are you using netkey or klips for nat traversal?
>>>
>>> My guess is that this could be a netkey issue...
>>> Thanks, Luca
>>>
>>> On Tue, May 11, 2010 at 8:36 AM, Ondrej Valousek <webserv at s3group.cz<mailto:
>>> webserv at s3group.cz>> wrote:
>>>
>>> It works fine for me.
>>> Try this:
>>>
>>> https://gsoc.xelerance.com/projects/openswan/wiki/Connecting_to_the_CheckPoint_VPN-1_NG65_firewall
>>>
>>> Ondrej
>>>
>>> On 10.05.2010 17:22, Luca Arzeni wrote:
>>> > Hi there,
>>> > I'm trying to connect a debian lenny client (Linux 2.6.26-2-amd64 #1
>>> > SMP x86_64 GNU/Linux) to a Checkpoint Firewall 1 (NGx R65).
>>> > I'm using openswan 2.4.12 (debian lenny revision is openswan
>>> > 2.4.12+dfsg-1.3+lenny2)
>>> > I'm using netkey internal kernel NAT-T, not klips.
>>> >
>>> > I can connect using the proprietary checkpoint client application
>>> > (SecureRemote) without problems.
>>> > SecureRemote works fine under Windows XP and I was able to setup a
>>> > connection also from a RedHat73 box using SecureRemote for linux, so
>>> > the issue is not in the devices between my client and the firewall.
>>> >
>>> > I followed various how to, but in the and I'm stuck at this point:
>>> >
>>> > May 10 16:49:14 gadara pluto[9253]: | p15 state object #1 found, in
>>> > STATE_MAIN_I2
>>> > May 10 16:49:14 gadara pluto[9253]: | processing connection
>>> checkpoint-vpn
>>> > May 10 16:49:14 gadara pluto[9253]: | processing informational
>>> > PAYLOAD_MALFORMED (16)
>>> > May 10 16:49:14 gadara pluto[9253]: "checkpoint-vpn" #1: received 1
>>> > malformed payload notifies
>>> > May 10 16:49:14 gadara pluto[9253]: | complete state transition with
>>> > STF_IGNORE
>>> > May 10 16:49:14 gadara pluto[9253]: | next event EVENT_RETRANSMIT in
>>> > 10 seconds for #1
>>> >
>>> > Is there anyone successfull connecting a Checkpoint R65 to an
>>> openswan
>>> > client?
>>> > Connection data and log follows... any hint will be appreciated!
>>> >
>>> > Thanks, Luca
>>> >
>>> > ############################
>>> > ### this is the /etc/ipsec.conf ###
>>> > # basic configuration
>>> > config setup
>>> > plutodebug=control
>>> > nat_traversal=yes
>>> >
>>> > conn checkpoint-vpn
>>> > # left is my lenny client
>>> > left=%defaultroute
>>> > leftcert=/etc/ipsec.d/certs/client-cert.pem
>>> > leftrsasigkey=%cert
>>> > # right is the checkpoint firewall
>>> > right=checkpoint-fw
>>> > rightsubnet=192.168.255.0/24 <http://192.168.255.0/24>
>>> <http://192.168.255.0/24>
>>> > rightcert=/etc/ipsec.d/certs/checkpoint-cert.pem
>>> > rightrsasigkey=%cert
>>> > auto=start
>>> >
>>> > #Disable Opportunistic Encryption
>>> > include /etc/ipsec.d/examples/no_oe.conf
>>> >
>>> > #################################
>>> > ### this is the /var/log/syslog output ###
>>> > May 10 16:49:13 gadara ipsec_setup: NETKEY on eth0
>>> > 192.168.144.162/255.255.255.0
>>> <http://192.168.144.162/255.255.255.0>
>>> <http://192.168.144.162/255.255.255.0>
>>> > broadcast 192.168.144.255
>>> > May 10 16:49:13 gadara ipsec_setup: ...Openswan IPsec started
>>> > May 10 16:49:13 gadara ipsec_setup: Starting Openswan IPsec
>>> > U2.4.12/K2.6.26-2-amd64...
>>> > May 10 16:49:14 gadara ipsec__plutorun: 104 "checkpoint-vpn" #1:
>>> > STATE_MAIN_I1: initiate
>>> > May 10 16:49:14 gadara ipsec__plutorun: ...could not start conn
>>> > "checkpoint-vpn"
>>> >
>>> > ###################################
>>> > ### this is the /var/log/auth.log output ###
>>> >
>>> > May 10 17:17:07 gadara pluto[9858]: "checkpoint-vpn" #3: transition
>>> > from state STATE_MAIN_I1 to state STATE_MAIN_I2
>>> > May 10 17:17:07 gadara pluto[9858]: | sending reply packet to
>>> > x.y.z.w:500 (from port=500)
>>> > May 10 17:17:07 gadara pluto[9858]: | sending 292 bytes for
>>> > STATE_MAIN_I1 through eth0:500 to x.y.z.w:500:
>>> > May 10 17:17:07 gadara pluto[9858]: | inserting event
>>> > EVENT_RETRANSMIT, timeout in 10 seconds for #3
>>> > May 10 17:17:07 gadara pluto[9858]: "checkpoint-vpn" #3:
>>> > STATE_MAIN_I2: sent MI2, expecting MR2
>>> > May 10 17:17:07 gadara pluto[9858]: | modecfg pull: noquirk
>>> > policy:push not-client
>>> > May 10 17:17:07 gadara pluto[9858]: | phase 1 is done, looking for
>>> > phase 1 to unpend
>>> > May 10 17:17:07 gadara pluto[9858]: | next event EVENT_RETRANSMIT in
>>> > 10 seconds for #3
>>> > May 10 17:17:07 gadara pluto[9858]: |
>>> > May 10 17:17:07 gadara pluto[9858]: | *received 40 bytes from
>>> > x.y.z.w:500 on eth0 (port=500)
>>> > May 10 17:17:07 gadara pluto[9858]: | processing packet with
>>> exchange
>>> > type=ISAKMP_XCHG_INFO (5)
>>> > May 10 17:17:07 gadara pluto[9858]: | ICOOKIE: 62 d9 1d c3 7c
>>> 2c b2 a9
>>> > May 10 17:17:07 gadara pluto[9858]: | RCOOKIE: fd 0b ef 4b 36
>>> d6 7d 9b
>>> > May 10 17:17:07 gadara pluto[9858]: | peer: x.y.z.w
>>> > May 10 17:17:07 gadara pluto[9858]: | state hash entry 29
>>> > May 10 17:17:07 gadara pluto[9858]: | peer and cookies match on #3,
>>> > provided msgid 00000000 vs 00000000/00000000
>>> > May 10 17:17:07 gadara pluto[9858]: | p15 state object #3 found, in
>>> > STATE_MAIN_I2
>>> > May 10 17:17:07 gadara pluto[9858]: | processing connection
>>> checkpoint-vpn
>>> > May 10 17:17:07 gadara pluto[9858]: | processing informational
>>> > PAYLOAD_MALFORMED (16)
>>> > May 10 17:17:07 gadara pluto[9858]: "checkpoint-vpn" #3: received 1
>>> > malformed payload notifies
>>> > May 10 17:17:07 gadara pluto[9858]: | complete state transition with
>>> > STF_IGNORE
>>> > May 10 17:17:07 gadara pluto[9858]: | next event EVENT_RETRANSMIT in
>>> > 10 seconds for #3
>>> >
>>> >
>>> > --
>>> > Luca Arzeni
>>> > Tel.: 339 8350298
>>> > mailto: l.arzeni at gmail.com <mailto:l.arzeni at gmail.com>
>>> <mailto:l.arzeni at gmail.com <mailto:l.arzeni at gmail.com>>
>>> >
>>> > === Start-of Internet E-mail Confidentiality Footer ===
>>> >
>>> > L'uso non autorizzato di questo messaggio o dei suoi allegati e'
>>> > vietato e potrebbe costituire reato.
>>> > Se ha ricevuto per errore questo messaggio, La prego di informarmi e
>>> > di distruggerlo immediatamente coi suoi allegati. Le dichiarazioni
>>> > contenute in questo messaggio o nei suoi allegati non impegnano Luca
>>> > Arzeni nei confronti del destinatario o di terzi. Luca Arzeni non si
>>> > assume alcuna responsabilita' per eventuali intercettazioni,
>>> modifiche
>>> > o danneggiamenti del presente messaggio.
>>> >
>>> >
>>> > _______________________________________________
>>> > Users at openswan.org <mailto:Users at openswan.org>
>>>
>>> > http://lists.openswan.org/mailman/listinfo/users
>>> > Building and Integrating Virtual Private Networks with Openswan:
>>> >
>>>
>>> http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155
>>> >
>>>
>>> _______________________________________________
>>> Users at openswan.org <mailto:Users at openswan.org>
>>>
>>> http://lists.openswan.org/mailman/listinfo/users
>>> Building and Integrating Virtual Private Networks with Openswan:
>>>
>>> http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155
>>>
>>>
>>>
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.openswan.org/pipermail/users/attachments/20100512/e706cb3a/attachment.html
More information about the Users
mailing list