VPN

Please help someone!!!

000 #7: "TELE2__WSO-VPN_1" STATE_MAIN_I1 (sent MI1, expecting MR1); EVENT_RETRANSMIT in 27s

LIVE LOG:
---------
loading secrets from "/etc/ipsec.secrets"
Feb  5 12:53:32 (none) pluto[657]:   could not open my default X.509 cert file '/etc/x509cert.der'
Feb  5 12:53:32 (none) pluto[657]: OpenPGP certificate file '/etc/pgpcert.pgp' not found
Feb  5 12:53:32 (none) pluto[657]: Changing to directory '/etc/ipsec.d/cacerts'
Feb  5 12:53:32 (none) pluto[657]:   Warning: empty directory
Feb  5 12:53:32 (none) pluto[657]: Changing to directory '/etc/ipsec.d/crls'
Feb  5 12:53:32 (none) pluto[657]:   Warning: empty directory
Feb  5 12:53:32 (none) pluto[657]: | from whack: got --esp=3des-sha1;modp1024
Feb  5 12:53:32 (none) pluto[657]: | from whack: got --ike=3des-sha-modp1536
Feb  5 12:53:32 (none) pluto[657]: added connection description "TELE2__WSO-VPN_1"
Feb  5 12:53:32 (none) pluto[657]: "TELE2__WSO-VPN_1" #7: initiating Main Mode
Feb  5 12:53:32 (none) pluto[657]: forgetting secrets
Feb  5 12:53:32 (none) pluto[657]: loading secrets from "/etc/ipsec.secrets"
Feb  5 12:53:32 (none) pluto[657]:   could not open my default X.509 cert file '/etc/x509cert.der'
Feb  5 12:53:32 (none) pluto[657]: OpenPGP certificate file '/etc/pgpcert.pgp' not found
Feb  5 12:53:32 (none) pluto[657]: Changing to directory '/etc/ipsec.d/cacerts'
Feb  5 12:53:32 (none) pluto[657]:   Warning: empty directory
Feb  5 12:53:32 (none) pluto[657]: Changing to directory '/etc/ipsec.d/crls'
Feb  5 12:53:32 (none) pluto[657]:   Warning: empty directory"

Parents

0 ECKEROTH over 22 years ago

ANYONE. Please urgent...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 ECKEROTH over 22 years ago

ANYONE. Please urgent...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 ECKEROTH over 22 years ago in reply to ECKEROTH

IKE debugging enabled:

Feb  6 12:18:50 (none) pluto[21058]: |    DOI: ISAKMP_DOI_IPSEC
Feb  6 12:18:50 (none) pluto[21058]: |    IPsec DOI SIT: SIT_IDENTITY_ONLY
Feb  6 12:18:50 (none) pluto[21058]: |    ISAKMP version: ISAKMP Version 1.0
Feb  6 12:18:50 (none) pluto[21058]: |    SPI size: 0
Feb  6 12:18:50 (none) pluto[21058]: |    exchange type: ISAKMP_XCHG_IDPROT
Feb  6 12:18:50 (none) pluto[21058]: |    flags: none
Feb  6 12:18:50 (none) pluto[21058]: |    message ID:  00 00 00 00
Feb  6 12:18:50 (none) pluto[21058]: |    next payload type: ISAKMP_NEXT_NONE
Feb  6 12:18:50 (none) pluto[21058]: |    next payload type: ISAKMP_NEXT_NONE
Feb  6 12:18:50 (none) pluto[21058]: |    next payload type: ISAKMP_NEXT_NONE
Feb  6 12:18:50 (none) pluto[21058]: |    next payload type: ISAKMP_NEXT_SA
Feb  6 12:18:50 (none) pluto[21058]: |    number of transforms: 1
Feb  6 12:18:50 (none) pluto[21058]: |    proposal number: 0
Feb  6 12:18:50 (none) pluto[21058]: |    protocol ID: PROTO_ISAKMP
Feb  6 12:18:50 (none) pluto[21058]: |   00 00 00 00  00 00 00 00
Feb  6 12:18:50 (none) pluto[21058]: | *****emit ISAKMP Transform Payload (ISAKMP):
Feb  6 12:18:50 (none) pluto[21058]: | ****emit IPsec DOI SIT:
Feb  6 12:18:50 (none) pluto[21058]: | ****emit ISAKMP Proposal Payload:
Feb  6 12:18:50 (none) pluto[21058]: | ***emit ISAKMP Security Association Payload:
Feb  6 12:18:50 (none) pluto[21058]: | 5_000-2-5, flags=-strict
Feb  6 12:19:20 (none) pluto[21058]: |
Feb  6 12:19:20 (none) pluto[21058]: | *time to handle event
Feb  6 12:19:20 (none) pluto[21058]: | event after this is EVENT_SHUNT_SCAN in 90 seconds
Feb  6 12:19:20 (none) pluto[21058]: | handling event EVENT_RETRANSMIT for 130.228.29.114 "TELE2__WSO-VPN_1" #1
Feb  6 12:19:20 (none) pluto[21058]: | sending 80 bytes for EVENT_RETRANSMIT through eth0 to 130.228.29.114:500:
Feb  6 12:19:20 (none) pluto[21058]: |   aa ce 14 cf  bc ec 82 06  00 00 00 00  00 00 00 00
Feb  6 12:19:20 (none) pluto[21058]: |   01 10 02 00  00 00 00 00  00 00 00 50  00 00 00 34
Feb  6 12:19:20 (none) pluto[21058]: |   00 00 00 01  00 00 00 01  00 00 00 28  00 01 00 01
Feb  6 12:19:20 (none) pluto[21058]: |   00 00 00 20  00 01 00 00  80 0b 00 01  80 0c 1e 78
Feb  6 12:19:20 (none) pluto[21058]: |   80 01 00 05  80 02 00 02  80 03 00 01  80 04 00 05
Feb  6 12:19:20 (none) pluto[21058]: | inserting event EVENT_RETRANSMIT, timeout in 40 seconds for #1
Feb  6 12:19:20 (none) pluto[21058]: | next e
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ReD-MaN over 22 years ago in reply to ECKEROTH

How about giving some more info? What kind of devices are you trying to connect to? Give us some config information.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ECKEROTH over 22 years ago in reply to ReD-MaN

Other end is a FIREWALL-1 v.4.1
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ClausP over 22 years ago in reply to ECKEROTH

http://www.freeswan.org/freeswan_snaps/CURRENT-SNAP/doc/interop.html#checkpoint

[ QUOTE ]

- first check the pdf on the checkpoint page if you have not already.
(mentioned in here freeswan-1.91/doc/HowTo.html#checkpoint)
http://support.checkpoint.com/kb/docs/public/firewall1/4_1/pdf/fw-linuxvpn.pdf

- when using pre shared secrets it appears that the checkpoint limit is 20 characters (i have just characters nothing fancy like spaces or _ or anything) authby=secret

- don't use perfect forward secrecy pfs=no

- turn off aggressive mode on the checkpoint box

- be sure nat is turned off on the checkpoint box

- be sure your netfilter/iptables is logging rejected packets
so you can add rules there if need be

[/ QUOTE ]
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Marcel_01 over 22 years ago in reply to ClausP

there is no reply for the

"TELE2__WSO-VPN_1" #7: initiating Main Mode

correct? is this package arriving at the fw-1?
is there a dynamic part in this setup or are all IPs static?

/marcel
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ECKEROTH over 22 years ago in reply to Marcel_01

FW-1 admin says he don't se any packets [:(]
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Marcel_01 over 22 years ago in reply to ECKEROTH

once again: is there a dynamic part in this configuration? if no, can you see packages from the fw-1? try checking if both firewalls send their main-mode packets and why they don't reach each other...

/marcel
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ECKEROTH over 22 years ago in reply to Marcel_01

I can se traffic on udp 500 from the FW-1, but they say no traffic comes from my ASL. Don't know about dynamic rules, i'm only admin on the one side. How do i check for 'main-mod'e packets ?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ECKEROTH over 22 years ago in reply to ECKEROTH

I'm aparently not the only with this problem. Please read:
https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/38837
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Marcel_01 over 22 years ago in reply to ECKEROTH

answered there... hth

cheers
marcel
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel