Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 1 reply
  • Answers 1 answer
  • Subscribers 26 subscribers
  • Views 427 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XGS 126 (18.5.2 MR-2 Build 380) IPSec Connection from IPhone SE Version 15.3 (Cisco VPN Client)

Simon-Timothy Folaji

Hello Community,

i tried to connect my IPhone via IPSec Client with a XGS126 but i fail. I used this setup guide: https://vimeo.com/152186410

The relevant output of "tail -f /log/strongswan.log" is:

2022-03-11 08:29:07Z 05[NET] <367> received packet: from iphone_publicIP [500] to xgs_publicIP [500] (848 bytes)
2022-03-11 08:29:07Z 05[ENC] <367> parsed ID_PROT request 0 [ SA V V V V V V V V V V V V V V ]
2022-03-11 08:29:07Z 05[IKE] <367> received NAT-T (RFC 3947) vendor ID
2022-03-11 08:29:07Z 05[IKE] <367> received draft-ietf-ipsec-nat-t-ike vendor ID
2022-03-11 08:29:07Z 05[IKE] <367> received draft-ietf-ipsec-nat-t-ike-08 vendor ID
2022-03-11 08:29:07Z 05[IKE] <367> received draft-ietf-ipsec-nat-t-ike-07 vendor ID
2022-03-11 08:29:07Z 05[IKE] <367> received draft-ietf-ipsec-nat-t-ike-06 vendor ID
2022-03-11 08:29:07Z 05[IKE] <367> received draft-ietf-ipsec-nat-t-ike-05 vendor ID
2022-03-11 08:29:07Z 05[IKE] <367> received draft-ietf-ipsec-nat-t-ike-04 vendor ID
2022-03-11 08:29:07Z 05[IKE] <367> received draft-ietf-ipsec-nat-t-ike-03 vendor ID
2022-03-11 08:29:07Z 05[IKE] <367> received draft-ietf-ipsec-nat-t-ike-02 vendor ID
2022-03-11 08:29:07Z 05[IKE] <367> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
2022-03-11 08:29:07Z 05[IKE] <367> received XAuth vendor ID
2022-03-11 08:29:07Z 05[IKE] <367> received Cisco Unity vendor ID
2022-03-11 08:29:07Z 05[IKE] <367> received FRAGMENTATION vendor ID
2022-03-11 08:29:07Z 05[IKE] <367> received DPD vendor ID
2022-03-11 08:29:07Z 05[IKE] <367> iphone_publicIP is initiating a Main Mode IKE_SA
2022-03-11 08:29:07Z 05[ENC] <367> generating ID_PROT response 0 [ SA V V V V V ]
2022-03-11 08:29:07Z 05[NET] <367> sending packet: from xgs_publicIP [500] to iphone_publicIP [500] (180 bytes)
2022-03-11 08:29:07Z 20[NET] <367> received packet: from iphone_publicIP [500] to xgs_publicIP [500] (380 bytes)
2022-03-11 08:29:07Z 20[ENC] <367> parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
2022-03-11 08:29:07Z 20[IKE] <367> remote host is behind NAT
2022-03-11 08:29:07Z 20[ENC] <367> generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
2022-03-11 08:29:07Z 20[NET] <367> sending packet: from xgs_publicIP [500] to iphone_publicIP [500] (396 bytes)
2022-03-11 08:29:07Z 06[NET] <367> received packet: from iphone_publicIP [62189] to xgs_publicIP [4500] (108 bytes)
2022-03-11 08:29:07Z 06[ENC] <367> parsed ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
2022-03-11 08:29:07Z 06[CFG] <367> looking for XAuthInitPSK peer configs matching xgs_publicIP...iphone_publicIP [192.168.178.45]
2022-03-11 08:29:07Z 06[IKE] <367> no peer config found
2022-03-11 08:29:07Z 06[ENC] <367> generating INFORMATIONAL_V1 request 3661991374 [ HASH N(AUTH_FAILED) ]
2022-03-11 08:29:07Z 06[NET] <367> sending packet: from xgs_publicIP [4500] to iphone_publicIP [62189] (108 bytes)

What is going on here?

Thanks for clarifying.



This thread was automatically locked due to age.
  • 0

    Hello there,

    Thank you for contacting the Sophos Community.

    The only difference I can see between your log and mine is that the iPhone or router for some reason is sending a different port for the connection, not the 4500.

    2022-03-11 08:29:07Z 20[NET] <367> sending packet: from xgs_publicIP [500] to iphone_publicIP [500] (396 bytes)

    2022-03-11 08:29:07Z 06[NET] <367> received packet: from iphone_publicIP [62189] to xgs_publicIP [4500] (108 bytes)

    While mine it shows the correct one:

    2022-03-14 20:54:18Z 26[NET] <4170> sending packet: from 207.81.x.x[500] to 216.x.x.x[500] (180 bytes)
    2022-03-14 20:54:18Z 07[NET] <4170> received packet: from 216.x.x.x[500] to 207.81.x.x[500] (380 bytes)
    2022-03-14 20:54:18Z 07[ENC] <4170> parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
    2022-03-14 20:54:18Z 07[IKE] <4170> remote host is behind NAT
    2022-03-14 20:54:18Z 07[ENC] <4170> generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
    2022-03-14 20:54:18Z 07[NET] <4170> sending packet: from 207.81.x.x[500] to 216.x.x.x[500] (396 bytes)
    2022-03-14 20:54:18Z 31[NET] <4170> received packet: from 216.x.x.x[4500] to 207.81.x.x[4500] (108 bytes)
    2022-03-14 20:54:18Z 31[ENC] <4170> parsed ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
    2022-03-14 20:54:18Z 31[CFG] <4170> looking for XAuthInitPSK peer configs matching 207.81.x.x...216.232.x.x[10.10.10.44]
    2022-03-14 20:54:18Z 31[CFG] <4170> selected peer config "norouterid-1"

    That might be the issue here.

    Regards,