[7.080] No warning when creating 2+ "Respond only" PSK remote IPsec GWs [CONFIRMED]

After upgrade to 7.080 i am not able to establish a new vpn between 7.080 an 7.011.

on 7.011 Site i got following erreors:


2007:11:20-01:01:00 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #25: enabling possible NAT-traversal with method 3

2007:11:20-01:01:00 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #25: NAT-Traversal: Result using RFC 3947: no NAT detected

2007:11:20-01:01:00 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #25: next payload type of ISAKMP Hash Payload has an unknown value: 218

2007:11:20-01:01:00 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #25: malformed payload in packet

2007:11:20-01:01:10 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #25: discarding duplicate packet; already STATE_MAIN_I3

2007:11:20-01:01:10 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #25: next payload type of ISAKMP Hash Payload has an unknown value: 43

2007:11:20-01:01:10 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #25: malformed payload in packet

2007:11:20-01:01:30 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #25: discarding duplicate packet; already STATE_MAIN_I3

2007:11:20-01:01:30 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #25: next payload type of ISAKMP Hash Payload has an unknown value: 228

2007:11:20-01:01:30 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #25: malformed payload in packet

2007:11:20-01:02:10 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #25: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message

2007:11:20-01:02:10 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #25: starting keying attempt 26 of an unlimited number

2007:11:20-01:02:10 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #26: initiating Main Mode to replace #25

2007:11:20-01:02:10 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #26: ignoring Vendor ID payload [strongSwan 2.7.3]

2007:11:20-01:02:10 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #26: ignoring Vendor ID payload [XAUTH]

2007:11:20-01:02:10 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #26: received Vendor ID payload [Dead Peer Detection]

2007:11:20-01:02:10 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #26: received Vendor ID payload [RFC 3947]

2007:11:20-01:02:10 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #26: enabling possible NAT-traversal with method 3

2007:11:20-01:02:10 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #26: NAT-Traversal: Result using RFC 3947: no NAT detected

2007:11:20-01:02:10 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #26: next payload type of ISAKMP Hash Payload has an unknown value: 170

2007:11:20-01:02:10 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #26: malformed payload in packet

2007:11:20-01:02:20 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #26: next payload type of ISAKMP Hash Payload has an unknown value: 205

2007:11:20-01:02:20 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #26: malformed payload in packet

2007:11:20-01:02:20 (none) pluto[8155]: "S_REF_JBGKyMnTGL_0" #26: discarding duplicate packet; already STATE_MAIN_I3

on 7.080 site i got


2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: responding to Main Mode from unknown peer 84.44.223.91

2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used

2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2159: max number of retransmissions (2) reached STATE_MAIN_R2

2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: NAT-Traversal: Result using RFC 3947: no NAT detected

2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used

2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: next payload type of ISAKMP Identification Payload has an unknown value: 253

2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet

2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: sending encrypted notification PAYLOAD_MALFORMED to 84.44.223.91:500

2007:11:20-01:07:01 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: next payload type of ISAKMP Identification Payload has an unknown value: 253

2007:11:20-01:07:01 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet

2007:11:20-01:07:01 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: sending encrypted notification PAYLOAD_MALFORMED to 84.44.223.91:500

Site2Site VPNs against other 7.011 sites createt BEFORE upgrade to 7.075 work nice.

I testet this from asg220 with 7.080 against one asg110 with 7.011 and another asl 7.011

Gregor Kemter

Parents

0 ReD-MaN over 17 years ago

I think I see your problem on the beta box. You must have two connections to the remote host, using different keys. Each remote host can only have one unique Preshared key.

multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: next payload type of ISAKMP Identification Payload has an unknown value: 253
2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: sending encrypted notification PAYLOAD_MALFORMED to 84.44.223.91:500
2007:11:20-01:07:01 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: next payload type of ISAKMP Identification Payload has an unknown value: 253
2007:11:20-01:07:01 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 ReD-MaN over 17 years ago

I think I see your problem on the beta box. You must have two connections to the remote host, using different keys. Each remote host can only have one unique Preshared key.

multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: next payload type of ISAKMP Identification Payload has an unknown value: 253
2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: sending encrypted notification PAYLOAD_MALFORMED to 84.44.223.91:500
2007:11:20-01:07:01 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: next payload type of ISAKMP Identification Payload has an unknown value: 253
2007:11:20-01:07:01 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 gkemter over 17 years ago in reply to ReD-MaN

i recreated this connection already 4 times (on both sides).
But no success.

Gregor Kemter
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 d12fk over 17 years ago in reply to ReD-MaN

2007:11:20-01:06:51 (none) pluto[3727]: "S_REF_jTDmmaLAVe_0"[17] 84.44.223.91 #2160: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used

You might have two "Respond only" remote IPsec gateways with different PSKs defined. Please check your configuration. Either change one of them to "Initiate connection" or use another authentication type. Another - somewhat bad - workaround would be to use the same PSK for both.

Having two PSK respond only gateways is impossible conceptually. However, ASG should warn you about this. We'll do something about that in a future version of ASG.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gkemter over 17 years ago in reply to d12fk

I have 1 respond only und 1 initate connection Remotegateway.
The PSKs i checked 3 times,

On my asg i have 6 working VPNs with PSK. (all created pre 7.075)

Gregor Kemter
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 d12fk over 17 years ago in reply to gkemter

Could you please post the contents of ipsec.conf and ipsec.secrets (obfuscate the secrets) from /var/chroot-ipsec/etc/ on the 7.080 after you defined the non working new connection.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gkemter over 17 years ago in reply to d12fk

Having two PSK respond only gateways is impossible conceptually. However, ASG should warn you about this.

You are right, ASG should warn me about using 2 respond only gateways. [:)]
After change the new vpn to initiate, it work.

Gregor Kemter
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

[7.080] No warning when creating 2+ "Respond only" PSK remote IPsec GWs [CONFIRMED]

Submitted a Tech Support Case lately from the Support Portal?