[Openswan Users] traffic only works when right subnet pings left subnet
Roland RoLaNd
r_o_l_a_n_d at hotmail.com
Tue Aug 5 09:37:02 EDT 2014
i have a tunnel set between my pc and a cisco ASA
the goal is :
- my pc which is natted behind a public ip to access the LAN side of the ASA router. (two ips)
here is my config:
type=tunnel
authby=secret
left=%defaultroute
leftid=$MY_public_IP
leftsubnet=10.0.0.2/32
right=$ASA_IP
rightsubnets={192.168.1.153/32 192.168.70.15/32}
esp=3des-sha1
keyexchange=ike
ike=3des-sha1
salifetime=3600s
ikelifetime=86400s
pfs=no
auto=start
dpdaction=restart
When i execute the following
ipsec auto --down remote_asa
000 initiating all conns with alias='remote_asa'
104 "remote_asa/0x2" #7: STATE_MAIN_I1: initiate
003 "remote_asa/0x2" #7: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
003 "remote_asa/0x2" #7: ignoring Vendor ID payload [FRAGMENTATION c0000000]
106 "remote_asa/0x2" #7: STATE_MAIN_I2: sent MI2, expecting MR2
003 "remote_asa/0x2" #7: received Vendor ID payload [Cisco-Unity]
003 "remote_asa/0x2" #7: received Vendor ID payload [XAUTH]
003 "remote_asa/0x2" #7: ignoring unknown Vendor ID payload [754e113a4c933790c1299eedcb]
003 "remote_asa/0x2" #7: ignoring Vendor ID payload [Cisco VPN 3000 Series]
003 "remote_asa/0x2" #7: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: i am NATed
108 "remote_asa/0x2" #7: STATE_MAIN_I3: sent MI3, expecting MR3
003 "remote_asa/0x2" #7: received Vendor ID payload [Dead Peer Detection]
004 "remote_asa/0x2" #7: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1024}
117 "remote_asa/0x1" #8: STATE_QUICK_I1: initiate
117 "remote_asa/0x2" #9: STATE_QUICK_I1: initiate
010 "remote_asa/0x2" #9: STATE_QUICK_I1: retransmission; will wait 20s for response
010 "remote_asa/0x1" #8: STATE_QUICK_I1: retransmission; will wait 20s for response
010 "remote_asa/0x1" #8: STATE_QUICK_I1: retransmission; will wait 40s for response
010 "remote_asa/0x2" #9: STATE_QUICK_I1: retransmission; will wait 40s for response
031 "remote_asa/0x2" #9: max number of retransmissions (2) reached STATE_QUICK_I1
000 "remote_asa/0x2" #9: starting keying attempt 2 of an unlimited number, but releasing whack
031 "remote_asa/0x1" #8: max number of retransmissions (2) reached STATE_QUICK_I1. No acceptable response to our first Quick Mode message: perhaps peer likes no proposal
000 "remote_asa/0x1" #8: starting keying attempt 2 of an unlimited number, but releasing whack
i cannot ping any of the 192.168.* IPs unless the remote LAN pings my left subnet
when they stop, i lose the ability to reach them again.
The remote cisco admin has set the type of tunnel to L2L
Any hint on what is going on ?
More information about the Users
mailing list