Hi guys! I have some problem about IPsec site-to-site VPN between 2 locations. And my error logs giving these datas: 2017-05-18 11:27:15 IPsec FAILED - EST-P1: Malformed paylod in packet. Verify preshared secrets at both the ends 17858 2017-05-18 11:27:15 IPsec SUCCESSFUL - EST-P1: System did not accept any proposal received. Need to reconfigure the connection on either of the ends 17854 2017-05-18 11:26:45 IPsec SUCCESSFUL - packet from REMOTEIP :500: NAT-T: Remote Server is behind NAT device 17876 2017-05-18 11:26:45 IPsec SUCCESSFUL - "NVI_IPsec-1" SA-MGT: Initiating rekeying of connection's main mode SA 31 17884 2017-05-18 11:26:45 IPsec FAILED - NVI_IPsec-1 EST-P1: Max number of retransmission 2 reached. No response to first encrypted message 17857 2017-05-18 11:26:05 IPsec FAILED - EST-P1: Malformed paylod in packet. Verify preshared secrets at both the ends 17858 2017-05-18 11:26:05 IPsec SUCCESSFUL - EST-P1: System did not accept any proposal received. Need to reconfigure the connection on either of the ends 17854 2017-05-18 11:25:34 IPsec SUCCESSFUL - packet from REMOTEIP :500: NAT-T: Remote Server is behind NAT device 17876 2017-05-18 11:25:34 IPsec SUCCESSFUL - "NVI_IPsec-1" SA-MGT: Initiating rekeying of connection's main mode SA 30 17884 2017-05-18 11:25:34 IPsec SUCCESSFUL - "NVI_IPsec-1" SA-MGT: Phase1 SA is being re-keyed 17886 2017-05-18 11:25:14 IPsec FAILED - EST-P1: Malformed paylod in packet. Verify preshared secrets at both the ends 17858 Do you have an idea? An another question about IPsec. How can I change IPSEC Protocol to ESP? Ali Erdem Sunar

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPsec Connection Problem: EST-P1: Malformed paylod in packet. Verify preshared secrets at both the ends

Hi guys!

I have some problem about IPsec site-to-site VPN between 2 locations. And my error logs giving these datas:

2017-05-18 11:27:15	IPsec	FAILED	-	EST-P1: Malformed paylod in packet. Verify preshared secrets at both the ends	17858
2017-05-18 11:27:15	IPsec	SUCCESSFUL	-	EST-P1: System did not accept any proposal received. Need to reconfigure the connection on either of the ends	17854
2017-05-18 11:26:45	IPsec	SUCCESSFUL	-	packet from REMOTEIP:500: NAT-T: Remote Server is behind NAT device	17876
2017-05-18 11:26:45	IPsec	SUCCESSFUL	-	"NVI_IPsec-1" SA-MGT: Initiating rekeying of connection's main mode SA 31	17884
2017-05-18 11:26:45	IPsec	FAILED	-	NVI_IPsec-1 EST-P1: Max number of retransmission 2 reached. No response to first encrypted message	17857
2017-05-18 11:26:05	IPsec	FAILED	-	EST-P1: Malformed paylod in packet. Verify preshared secrets at both the ends	17858
2017-05-18 11:26:05	IPsec	SUCCESSFUL	-	EST-P1: System did not accept any proposal received. Need to reconfigure the connection on either of the ends	17854
2017-05-18 11:25:34	IPsec	SUCCESSFUL	-	packet from REMOTEIP:500: NAT-T: Remote Server is behind NAT device	17876
2017-05-18 11:25:34	IPsec	SUCCESSFUL	-	"NVI_IPsec-1" SA-MGT: Initiating rekeying of connection's main mode SA 30	17884
2017-05-18 11:25:34	IPsec	SUCCESSFUL	-	"NVI_IPsec-1" SA-MGT: Phase1 SA is being re-keyed	17886
2017-05-18 11:25:14	IPsec	FAILED	-	EST-P1: Malformed paylod in packet. Verify preshared secrets at both the ends	17858

Do you have an idea? An another question about IPsec. How can I change IPSEC Protocol to ESP?

Ali Erdem Sunar

This thread was automatically locked due to age.

Parents

0 lferrara over 8 years ago

Ali,

do you have 2 Sophos XG? If not, which is the other Firewall which you are trying to connect to.

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 Ali Erdem Sunar over 8 years ago in reply to lferrara

No Ferrara,

I have 1 Sophos XG. Other side has another firewall (They don't give any information for security policies of government, but I think they have FortiFW).

Thanks...
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Ali Erdem Sunar over 8 years ago in reply to lferrara

No Ferrara,

I have 1 Sophos XG. Other side has another firewall (They don't give any information for security policies of government, but I think they have FortiFW).

Thanks...
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 lferrara over 8 years ago in reply to Ali Erdem Sunar

Ok Ali.

Have a look at this solution:

https://community.sophos.com/products/xg-firewall/f/vpn/74679/xg-210-to-fortigate-100c---ipsec-tunnel-up-i-am-unable-to-pass-traffic-across-tunnel/289317#289317

If it does not work,

please share the S2S configuration.

Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 Ali Erdem Sunar over 8 years ago in reply to lferrara

Ferrara,

I found otherside's FW! It's Cisco! Below the details:

IPsec Details:

Name: XYZ_IPsec
Connection Type: Site-to-Site
Policy: XYZ Policy (I created customly)
Action on VPN Restart: Respond Only
Authentication Type: Preshared Key
Local: PORT-2-WAN-IP
Remote: REMOTEIP
Local Subnet: project.local (192.168.23.0/24)
NATed LAN: Same as Local LAN address
Remote Allow NAT Traversal: Disabled
Remote LAN Network: center.local (172.23.0.0/16)

XYZ IPSec Policy Details:
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 8 years ago in reply to Ali Erdem Sunar
Ali:

check the preshared key

check that you are able to resolve the public DNS name

check that both ends are using the same Phase 1 and 2

You can try to enable Debug on VPN using this KB:

https://community.sophos.com/kb/en-us/122822

Let us know
Cancel
Vote Up 0 Vote Down

Cancel
0 Fernando Durso over 8 years ago in reply to Ali Erdem Sunar

You have to check if all policies options match each other, and also check the local and remote IDs in both sides....

When I have the "payload" problems here it was or the policies or the IDs....
Cancel
Vote Up 0 Vote Down

Cancel