Hi Peter,<div><br></div><div>I appreciate your support. Now am able to get it working but there seem to be another issue. Pluto constantly crashes and restarts with an infinite loop. Below is the log which goes on in this format.</div>
<div><br></div><div><div>###############################################################################################</div><div>Feb 12 18:33:13 box1 ipsec_setup: Starting Openswan IPsec U2.6.37/K2.6.18-194.17.1.el5...</div>
<div>Feb 12 18:33:13 box1 ipsec_setup: Using NETKEY(XFRM) stack</div><div>Feb 12 18:33:14 box1 ipsec_setup: multiple ip addresses, using 1.2.3.4 on eth0</div><div>Feb 12 18:33:14 box1 ipsec_setup: ...Openswan IPsec started</div>
<div>Feb 12 18:33:14 box1 pluto: adjusting ipsec.d to /etc/ipsec.d</div><div>Feb 12 18:33:14 box1 ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d</div><div>Feb 12 18:33:14 box1 ipsec__plutorun: 002 added connection description "VPN_CLIENT"</div>
<div>Feb 12 18:33:14 box1 ipsec__plutorun: 104 "VPN_CLIENT" #1: STATE_MAIN_I1: initiate</div><div>Feb 12 18:33:15 box1 kernel: pluto[22765]: <b>segfault</b> at 0000000000000288 rip 0000000000435a11 rsp 00007fff3a5314a0 error 4</div>
<div>Feb 12 18:33:15 box1 ipsec__plutorun: /usr/local/lib/ipsec/_plutorun: line 246: 22765 <b>Segmentation fault </b> /usr/local/libexec/ipsec/pluto --nofork --secretsfile /etc/ipsec.secrets --ipsecdir /etc/ipsec.d --perpeerlog --use-netkey --uniqueids --nat_traversal --nhelpers 0</div>
<div><b>Feb 12 18:33:15 box1 ipsec__plutorun: !pluto failure!: exited with error status 139 (signal 11)</b></div><div>Feb 12 18:33:15 box1 ipsec__plutorun: restarting IPsec after pause...</div><div>Feb 12 18:33:25 box1 ipsec_setup: Stopping Openswan IPsec...</div>
<div>Feb 12 18:33:25 box1 ipsec_setup: Removing orphaned /var/run/pluto/pluto.pid:</div><div>Feb 12 18:33:25 box1 kernel: NET: Unregistered protocol family 15</div><div>Feb 12 18:33:25 box1 ipsec_setup: ...Openswan IPsec stopped</div>
<div>Feb 12 18:33:25 box1 kernel: NET: Registered protocol family 15</div><div>Feb 12 18:33:25 box1 ipsec_setup: Starting Openswan IPsec U2.6.37/K2.6.18-194.17.1.el5...</div><div>Feb 12 18:33:25 box1 ipsec_setup: Using NETKEY(XFRM) stack</div>
<div>Feb 12 18:33:26 box1 ipsec_setup: multiple ip addresses, using 1.2.3.4 on eth0</div><div>Feb 12 18:33:26 box1 ipsec_setup: ...Openswan IPsec started</div><div>Feb 12 18:33:26 box1 pluto: adjusting ipsec.d to /etc/ipsec.d</div>
<div>Feb 12 18:33:26 box1 ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d</div><div>Feb 12 18:33:26 box1 ipsec__plutorun: 002 added connection description "VPN_CLIENT"</div><div>Feb 12 18:33:26 box1 ipsec__plutorun: 104 "VPN_CLIENT" #1: STATE_MAIN_I1: initiate</div>
<div>Feb 12 18:33:27 box1 kernel: pluto[23114]: segfault at 0000000000000288 rip 0000000000435a11 rsp 00007fff4f7c88c0 error 4</div><div>Feb 12 18:33:27 box1 ipsec__plutorun: /usr/local/lib/ipsec/_plutorun: line 246: 23114 Segmentation fault /usr/local/libexec/ipsec/pluto --nofork --secretsfile /etc/ipsec.secrets --ipsecdir /etc/ipsec.d --perpeerlog --use-netkey --uniqueids --nat_traversal --nhelpers 0</div>
<div>Feb 12 18:33:27 box1 ipsec__plutorun: !pluto failure!: exited with error status 139 (signal 11)</div><div>Feb 12 18:33:27 box1 ipsec__plutorun: restarting IPsec after pause...</div><div>Feb 12 18:33:37 box1 ipsec_setup: Stopping Openswan IPsec...</div>
<div>Feb 12 18:33:37 box1 ipsec_setup: Removing orphaned /var/run/pluto/pluto.pid:</div><div>Feb 12 18:33:38 box1 kernel: NET: Unregistered protocol family 15</div><div>Feb 12 18:33:38 box1 ipsec_setup: ...Openswan IPsec stopped</div>
<div>Feb 12 18:33:38 box1 kernel: NET: Registered protocol family 15</div><div>###############################################################################################</div></div><div><br><br><div class="gmail_quote">
On Wed, Feb 1, 2012 at 3:46 PM, Peter McGill <span dir="ltr"><<a href="mailto:petermcgill@goco.net">petermcgill@goco.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-CA" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">You’re getting </span>NO_PROPOSAL_CHOSEN<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">, which means your openswan and cisco configs don’t match, check your encryption algs and subnets match on both ends.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Here’s my working Openswan/Cisco config for example:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Note: Cisco doesn’t support RSA without certificates so I used PSK, as you have also done.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Note: All indents in openswan should be a single tab not multiple spaces, multiple spaces can cause problems.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Openswan ipsec.conf:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">version 2.0<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">config setup<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> protostack=netkey<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> oe=no<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> nhelpers=0<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">conn stmarys-london # you can put all parameters in single conn definition, I used multiple with also= to make changing multiple connection easier.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> also=goco<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> also=london<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> leftsubnet=<a href="http://172.21.0.0/20" target="_blank">172.21.0.0/20</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> also=stmarys<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> rightsubnet=<a href="http://172.21.1.0/24" target="_blank">172.21.1.0/24</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> auto=start<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">conn london<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> left=207.x.y.18<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> leftsourceip=172.21.3.65<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> leftrsasigkey=0sAQ… # you can ignore this line it’s there to connect to other openswan sites, it’s ignored by stmarys cisco connection.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">conn stmarys<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> right=207.x.y.245<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> authby=secret<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">conn goco<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> ike=aes128-sha1;modp2048 # I also have a lower model cisco switch conn which uses modp1536, since it doesn’t support modp2048.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> phase2=esp<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> phase2alg=aes128-sha1;modp2048<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> ikev2=no<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> dpddelay=30<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> dpdtimeout=120<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> dpdaction=restart<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Openswan ipsec.secrets:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">207.x.y.18 207.x.y.245 : PSK "TG…"<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Cisco config:<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">version 15.1 # for reference<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">!<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">crypto isakmp policy 10<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> encr aes<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> authentication pre-share<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> group 14<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> lifetime 3600<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">crypto isakmp key TG… address 207.x.y.18 no-xauth<u></u><u></u></span></p><p class="MsoNormal"><span lang="FR" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">crypto isakmp aggressive-mode disable<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="FR" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">!<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">crypto ipsec transform-set aesset esp-aes esp-sha-hmac<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">!<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">crypto map static-map 15 ipsec-isakmp<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> set peer 207.x.y.18<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> set security-association lifetime seconds 28800<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> set transform-set aesset<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> set pfs group14<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> match address 133<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">!<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">interface Dialer0<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> description $FW_OUTSIDE$<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> ip address negotiated<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> ip access-group 104 in<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> crypto map static-map<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">!<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">access-list 104 permit udp any host 207.x.y.245 eq isakmp<u></u><u></u></span></p><p class="MsoNormal">
<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">access-list 104 permit esp any host 207.x.y.245<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">access-list 104 permit udp host 207.x.y.18 host 207.x.y.245 eq non500-isakmp<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">access-list 104 permit ip host 207.x.y.18 host 207.x.y.245<u></u><u></u></span></p><p class="MsoNormal">
<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">access-list 133 permit ip 172.21.1.0 0.0.0.255 172.21.0.0 0.0.15.255<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Peter McGill<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Systems Analyst and Administrator<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Gra Ham Energy Limited<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0cm 0cm 0cm"><p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:users-bounces@lists.openswan.org" target="_blank">users-bounces@lists.openswan.org</a> [mailto:<a href="mailto:users-bounces@lists.openswan.org" target="_blank">users-bounces@lists.openswan.org</a>] <b>On Behalf Of </b>Sam<br>
<b>Sent:</b> February-01-12 5:21 AM<br><b>To:</b> <a href="mailto:users@openswan.org" target="_blank">users@openswan.org</a>; <a href="mailto:users@lists.openswan.org" target="_blank">users@lists.openswan.org</a><br><b>Subject:</b> [Openswan Users] Max number of retransmissions (2) reached STATE_QUICK_I1. No acceptable response to our first Quick Mode message: perhaps peer likes no proposal<u></u><u></u></span></p>
</div><div><div class="h5"><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Hi,<u></u><u></u></p><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">I have successfully installed Openswan but there seem to an issue with the connection to the Cisco VPN. From the logs am seeing something like "<b>No acceptable response to our first Quick Mode message: perhaps peer likes no proposal</b>".<u></u><u></u></p>
</div><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">Below is the full log and my config. I will really appreciate your help.<u></u><u></u></p></div><div><div><p class="MsoNormal"><u></u> <u></u></p>
</div><div><p class="MsoNormal">###################### CONFIG #############################<u></u><u></u></p></div><div><p class="MsoNormal">config setup <u></u><u></u></p></div><div><p class="MsoNormal"> interfaces=%defaultroute<u></u><u></u></p>
</div><div><p class="MsoNormal"> plutoopts="--perpeerlog"<u></u><u></u></p></div><div><p class="MsoNormal"> protostack=netkey<u></u><u></u></p></div><div><p class="MsoNormal"><u></u> <u></u></p></div>
<div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">conn VPNCon<u></u><u></u></p></div><div><p class="MsoNormal"> type=tunnel<u></u><u></u></p></div><div><p class="MsoNormal"> authby=secret<u></u><u></u></p>
</div><div><p class="MsoNormal"> Ikelifetime=86400s<u></u><u></u></p></div><div><p class="MsoNormal"> phase2=esp<u></u><u></u></p></div><div><p class="MsoNormal"> Phase2alg=3des-md5;modp1536<u></u><u></u></p>
</div><div><p class="MsoNormal"> lifetime=3600s<u></u><u></u></p></div><div><p class="MsoNormal"> forceencaps=yes<u></u><u></u></p></div><div><p class="MsoNormal"> pfs=no<u></u><u></u></p></div><div><p class="MsoNormal">
keyexchange=ike<u></u><u></u></p></div><div><p class="MsoNormal"> left=1.2.3.4<u></u><u></u></p></div><div><p class="MsoNormal"> leftnexthop=%defaultroute<u></u><u></u></p></div><div><p class="MsoNormal">
right=5.6.7.8<u></u><u></u></p></div><div><p class="MsoNormal"> rightnexthop=%defaultroute<u></u><u></u></p></div><div><p class="MsoNormal"> rekey=yes<u></u><u></u></p></div><div><p class="MsoNormal">
remote_peer_type=cisco<u></u><u></u></p></div><div><p class="MsoNormal"> auto=start<u></u><u></u></p></div><div><p class="MsoNormal">###################################################<u></u><u></u></p></div>
<div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">###################### CONFIG #############################<u></u><u></u></p></div><div><p class="MsoNormal">
Feb 1 10:55:16 box1 ipsec__plutorun: Starting Pluto subsystem...<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: Starting Pluto (Openswan Version 2.6.37; Vendor ID OEu\134d\134jy\134\134ap) pid:12241<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: LEAK_DETECTIVE support [disabled]<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: OCF support for IKE [disabled]<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: SAref support [disabled]: Protocol not available<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: SAbind support [disabled]: Protocol not available<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: NSS support [disabled]<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: HAVE_STATSD notification support not compiled in<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: Setting NAT-Traversal port-4500 floating to on<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: port floating activation criteria nat_t=1/port_float=1<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: NAT-Traversal support [enabled]<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: using /dev/urandom as source of random entropy<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: starting up 1 cryptographic helpers<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12248]: using /dev/urandom as source of random entropy<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: started helper pid=12248 (fd:6)<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: Using Linux 2.6 IPsec interface code on 2.6.18-194.17.1.el5 (experimental code)<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: ike_alg_register_enc(): Activating aes_ccm_8: Ok (ret=0)<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: ike_alg_add(): ERROR: Algorithm already exists<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: ike_alg_register_enc(): Activating aes_ccm_12: FAILED (ret=-17)<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: ike_alg_add(): ERROR: Algorithm already exists<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: ike_alg_register_enc(): Activating aes_ccm_16: FAILED (ret=-17)<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: ike_alg_add(): ERROR: Algorithm already exists<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: ike_alg_register_enc(): Activating aes_gcm_8: FAILED (ret=-17)<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: ike_alg_add(): ERROR: Algorithm already exists<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: ike_alg_register_enc(): Activating aes_gcm_12: FAILED (ret=-17)<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: ike_alg_add(): ERROR: Algorithm already exists<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: ike_alg_register_enc(): Activating aes_gcm_16: FAILED (ret=-17)<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: Changed path to directory '/etc/ipsec.d/cacerts'<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: Changed path to directory '/etc/ipsec.d/aacerts'<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: Changed path to directory '/etc/ipsec.d/ocspcerts'<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: Changing to directory '/etc/ipsec.d/crls'<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: Warning: empty directory<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:16 box1 pluto[12241]: added connection description "VPNCon"<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: listening for IKE messages<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: adding interface eth0/eth0 1.2.3.4.5:500<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: adding interface eth0/eth0 1.2.3.4.5:4500<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: adding interface lo/lo <a href="http://127.0.0.1:500" target="_blank">127.0.0.1:500</a><u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: adding interface lo/lo <a href="http://127.0.0.1:4500" target="_blank">127.0.0.1:4500</a><u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: adding interface lo/lo ::1:500<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: loading secrets from "/etc/ipsec.secrets"<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: "VPNCon" #1: initiating Main Mode<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: "VPNCon" #1: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] method set to=108 <u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: "VPNCon" #1: enabling possible NAT-traversal with method draft-ietf-ipsec-nat-t-ike-05<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: "VPNCon" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: "VPNCon" #1: STATE_MAIN_I2: sent MI2, expecting MR2<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: "VPNCon" #1: received Vendor ID payload [Cisco-Unity]<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: "VPNCon" #1: received Vendor ID payload [Dead Peer Detection]<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: "VPNCon" #1: ignoring unknown Vendor ID payload [3c1f79790ca4ddd867fa2623b80ac34b]<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: "VPNCon" #1: received Vendor ID payload [XAUTH]<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: "VPNCon" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: both are NATed<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: "VPNCon" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:17 box1 pluto[12241]: "VPNCon" #1: STATE_MAIN_I3: sent MI3, expecting MR3<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:18 box1 pluto[12241]: | protocol/port in Phase 1 ID Payload is 17/0. accepted with port_floating NAT-T<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:18 box1 pluto[12241]: "VPNCon" #1: Main mode peer ID is ID_IPV4_ADDR: '5.6.7.8'<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:18 box1 pluto[12241]: "VPNCon" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:18 box1 pluto[12241]: "VPNCon" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1024}<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:18 box1 pluto[12241]: "VPNCon" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:6ca6f49a proposal=3DES(3)_192-MD5(1)_128 pfsgroup=no-pfs}<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:55:18 box1 pluto[12241]: "VPNCon" #1: ignoring informational payload, type NO_PROPOSAL_CHOSEN msgid=00000000<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:55:18 box1 pluto[12241]: "VPNCon" #1: received and ignored informational message<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:56:28 box1 pluto[12241]: "VPNCon" #2: max number of retransmissions (2) reached STATE_QUICK_I1. No acceptable response to our first Quick Mode message: perhaps peer likes no proposal<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:56:28 box1 pluto[12241]: "VPNCon" #2: starting keying attempt 2 of an unlimited number<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:56:28 box1 pluto[12241]: "VPNCon" #3: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK to replace #2 {using isakmp#1 msgid:91d29c32 proposal=3DES(3)_192-MD5(1)_128 pfsgroup=no-pfs}<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:56:28 box1 pluto[12241]: "VPNCon" #1: ignoring informational payload, type NO_PROPOSAL_CHOSEN msgid=00000000<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:56:28 box1 pluto[12241]: "VPNCon" #1: received and ignored informational message<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:57:38 box1 pluto[12241]: "VPNCon" #3: max number of retransmissions (2) reached STATE_QUICK_I1. No acceptable response to our first Quick Mode message: perhaps peer likes no proposal<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:57:38 box1 pluto[12241]: "VPNCon" #3: starting keying attempt 3 of an unlimited number<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:57:38 box1 pluto[12241]: "VPNCon" #4: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK to replace #3 {using isakmp#1 msgid:fd01f2eb proposal=3DES(3)_192-MD5(1)_128 pfsgroup=no-pfs}<u></u><u></u></p>
</div><div><p class="MsoNormal">Feb 1 10:57:38 box1 pluto[12241]: "VPNCon" #1: ignoring informational payload, type NO_PROPOSAL_CHOSEN msgid=00000000<u></u><u></u></p></div><div><p class="MsoNormal">Feb 1 10:57:38 box1 pluto[12241]: "VPNCon" #1: received and ignored informational message<u></u><u></u></p>
</div><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">###################################################<u></u><u></u></p></div></div><div><p class="MsoNormal"><u></u> <u></u></p></div></div>
</div></div></div></blockquote></div><br></div>