This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos with azure

hi everybody, am trying to configure my sophos utm 9.2 with azure, trying to connect with the vpn, somebody have an script, or an step-by-step to do it?

thanks alot community

This thread was automatically locked due to age.

0 BAlfson over 10 years ago

Hi, Marlon, and welcome to the User BB!

I don't remember if anyone gave a step-by-step, but there are some tricks. Try a google on site:astaro.org azure and you will find previous discussions here.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 marlonrivera over 10 years ago in reply to BAlfson

thanks bob i hope find something [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 t14u over 10 years ago in reply to marlonrivera

1. Configure AZURE S2S network as static gatway (dynamic will not work, as UTM does not support IKEv2) and get public IP of AZURE GW (you will need your static IP to configure the Azure side)
2. Create a Remote GW in UTM: S2S VPN -> IPSEC -> Remote GW
3. Create a new IPSecConnection in S2S VPN -> IPSEC -> Connections (Chose your created GW in 2. and AES-256 as Policy, maybe you have to adjust the parameters of AES-256 Policy). Check Automatic FW Rules and Tunnel, makes live easier. uncheck strict routing
4. Also create NAT rule if reauired (Azure to internal)
5. and Firewall rules (if not set automatic)
6. have fun ;-) and send screenshots of your config it it does not work...

M.
Cancel
Vote Up 0 Vote Down

Cancel

0 ThomasLichtenstern1 over 8 years ago in reply to t14u

Sorry for warming this up.

I created a s2s to Azure. Connection is established.

Ping to a Server in the Azure network is working.

Also from the Azure Site to my local network.

But RDP or SMB (\\server-ip\share) doesn work.

Any Ideas what it can be?

Thanks

Thomas

here is the log from the Azure side:

Comments	Details
	QM-LIFETIME-TYPE: 1
	QM-LIFETIME-SEC: 3600
	QM-ESP-INTEGRITY: HMAC-SHA1-96 (2)
	QM-KEY-LENGTH: 256
On-prem device sent invalid payload.	IkeProcessQMSA failed with HRESULT 0x80073613(ERROR_IPSEC_IKE_INVALID_PAYLOAD)
On-prem device sent invalid payload.	IkeHandlePayloadQMSA failed with HRESULT 0x80073613(ERROR_IPSEC_IKE_INVALID_PAYLOAD)
On-prem device sent invalid payload.	IkeProcessPayloadQM failed with HRESULT 0x80073613(ERROR_IPSEC_IKE_INVALID_PAYLOAD)
On-prem device sent invalid payload.	IkeProcessPayloadGroup failed with HRESULT 0x80073613(ERROR_IPSEC_IKE_INVALID_PAYLOAD)
On-prem device sent invalid payload.	IkeProcessPayloadsInPacket failed with HRESULT 0x80073613(ERROR_IPSEC_IKE_INVALID_PAYLOAD)
On-prem device sent invalid payload.	IkeHandleOakQMPacket failed with HRESULT 0x80073613(ERROR_IPSEC_IKE_INVALID_PAYLOAD)
On-prem device sent invalid payload.	IkeHandleOakQMPacketDispatch failed with HRESULT 0x80073613(ERROR_IPSEC_IKE_INVALID_PAYLOAD)
On-prem device sent invalid payload.	QM done. Cleaning up qmSa 0000001AEF43BC00. Error 13843(ERROR_IPSEC_IKE_INVALID_PAYLOAD)
On-prem is the QM initiator.	IKE diagnostic event:, Failure type: IKE/Authip Quick Mode Failure, Failure error code:0x00003613, Invalid payload received, , Failure point: Local, Keying module type: Ike, QM State: State corresponding to first roundtrip, QM SA role: Responder, Mode: Transport Mode

0 BAlfson over 8 years ago in reply to ThomasLichtenstern1

Thomas, you might ask about that Azure report on the appropriate Microsoft site, too.

First, confirm that you're not using Azure "Dynamic" as the UTM's IPsec won't work with that. If you're not, then try #1 in Rulz to eliminate the simple things. If you have no luck with that, be sure debug is not active and show us 50-to-100 lines from the IPsec Live Log when you attempt this.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

0 ThomasLichtenstern1 over 8 years ago in reply to BAlfson

Hi, attached in my first post was the report from the Azure site.

And here is the IPSEC log. (xx by me)

I figured out the http from azure site to local network is working....

Fullscreen sophos_log.txt Download

2016:10:26-00:03:33 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #1: received Delete SA payload: replace IPSEC State #2 in 10 seconds
2016:10:26-00:03:43 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #3: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP to replace #2 {using isakmp#1}
2016:10:26-00:03:43 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #3: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2016:10:26-00:03:43 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #3: sent QI2, IPsec SA established {ESP=>0x14c963ba <0x2066751a}
2016:10:26-00:03:43 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #3: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2016:10:26-00:03:43 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #3: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_HASH)
2016:10:26-00:03:43 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #3: sending encrypted notification INVALID_PAYLOAD_TYPE to 52.166.xx.xx:500
2016:10:26-00:08:44 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #1: received Delete SA payload: replace IPSEC State #3 in 10 seconds
2016:10:26-00:08:54 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #4: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP to replace #3 {using isakmp#1}
2016:10:26-00:08:54 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #4: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2016:10:26-00:08:54 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #4: sent QI2, IPsec SA established {ESP=>0x3b9fdc08 <0xf8db0475}
2016:10:26-00:08:54 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #4: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2016:10:26-00:08:54 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #4: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_HASH)
2016:10:26-00:08:54 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #4: sending encrypted notification INVALID_PAYLOAD_TYPE to 52.166.xx.xx:500
2016:10:26-00:13:55 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #1: received Delete SA payload: replace IPSEC State #4 in 10 seconds
2016:10:26-00:14:01 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #5: responding to Quick Mode
2016:10:26-00:14:01 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #5: IPsec SA established {ESP=>0x98704d16 <0x1d63bb01}
2016:10:26-00:15:18 astaro pluto[25138]: forgetting secrets
2016:10:26-00:15:18 astaro pluto[25138]: loading secrets from "/etc/ipsec.secrets"
2016:10:26-00:15:18 astaro pluto[25138]:   loaded PSK secret for 178.26.xx.xx 52.166.xx.xx 
2016:10:26-00:15:18 astaro pluto[25138]: listening for IKE messages
2016:10:26-00:15:18 astaro pluto[25138]: forgetting secrets
2016:10:26-00:15:18 astaro pluto[25138]: loading secrets from "/etc/ipsec.secrets"
2016:10:26-00:15:18 astaro pluto[25138]:   loaded PSK secret for 178.26.xx.xx 52.166.xx.xx 
2016:10:26-00:15:18 astaro pluto[25138]: loading ca certificates from '/etc/ipsec.d/cacerts'
2016:10:26-00:15:18 astaro pluto[25138]:   loaded ca certificate from '/etc/ipsec.d/cacerts/REF_CaSigVpnSigniCa.pem'
2016:10:26-00:15:18 astaro pluto[25138]: loading aa certificates from '/etc/ipsec.d/aacerts'
2016:10:26-00:15:18 astaro pluto[25138]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
2016:10:26-00:15:18 astaro pluto[25138]: loading attribute certificates from '/etc/ipsec.d/acerts'
2016:10:26-00:15:18 astaro pluto[25138]: Changing to directory '/etc/ipsec.d/crls'
2016:10:26-00:15:18 astaro ipsec_starter[25132]: no default route - cannot cope with %defaultroute!!!
2016:10:26-00:15:18 astaro pluto[25138]: "S_REF_IpsSitAzure_0": deleting connection
2016:10:26-00:15:18 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #5: deleting state (STATE_QUICK_R2)
2016:10:26-00:15:18 astaro pluto[25138]: id="2204" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN down" variant="ipsec" connection="REF_IpsSitAzure" address="178.26.xx.xx" local_net="10.0.0.0/8" remote_net="172.17.0.0/16"
2016:10:26-00:15:18 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #1: deleting state (STATE_MAIN_I4)
2016:10:26-00:15:19 astaro pluto[25138]: added connection description "S_REF_IpsSitAzure_0"
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #6: initiating Main Mode
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #6: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000009]
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #6: ignoring Vendor ID payload [RFC 3947]
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #6: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #6: ignoring Vendor ID payload [FRAGMENTATION]
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #6: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #6: ignoring Vendor ID payload [IKE CGA version 1]
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #6: Peer ID is ID_IPV4_ADDR: '52.166.xx.xx'
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #6: ISAKMP SA established
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #7: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#6}
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #7: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2016:10:26-00:15:19 astaro pluto[25138]: id="2203" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN up" variant="ipsec" connection="REF_IpsSitAzure" address="178.26.xx.xx" local_net="10.0.0.0/8" remote_net="172.17.0.0/16"
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #7: sent QI2, IPsec SA established {ESP=>0xa5634952 <0x31fb70be}
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #7: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #7: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_HASH)
2016:10:26-00:15:19 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #7: sending encrypted notification INVALID_PAYLOAD_TYPE to 52.166.xx.xx:500
2016:10:26-00:32:26 astaro pluto[25138]: shutting down
2016:10:26-00:32:26 astaro pluto[25138]: forgetting secrets
2016:10:26-00:32:26 astaro pluto[25138]: "S_REF_IpsSitAzure_0": deleting connection
2016:10:26-00:32:26 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #7: deleting state (STATE_QUICK_I2)
2016:10:26-00:32:26 astaro pluto[25138]: id="2204" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN down" variant="ipsec" connection="REF_IpsSitAzure" address="178.26.xx.xx" local_net="10.0.0.0/8" remote_net="172.17.0.0/16"
2016:10:26-00:32:26 astaro pluto[25138]: "S_REF_IpsSitAzure_0" #6: deleting state (STATE_MAIN_I4)
2016:10:26-00:32:26 astaro pluto[25138]: shutting down interface lo/lo ::1
2016:10:26-00:32:26 astaro pluto[25138]: shutting down interface lo/lo 127.0.0.1
2016:10:26-00:32:26 astaro pluto[25138]: shutting down interface eth0/eth0 10.1.1.1
2016:10:26-00:32:26 astaro pluto[25138]: shutting down interface eth1/eth1 192.168.179.29
2016:10:26-00:32:26 astaro pluto[25138]: shutting down interface eth2/eth2 192.168.0.13
2016:10:26-00:32:26 astaro pluto[25138]: shutting down interface eth3/eth3 178.26.xx.xx
2016:10:26-00:32:26 astaro pluto[25138]: shutting down interface wlan0/wlan0 172.16.28.1
2016:10:26-00:32:26 astaro ipsec_starter[25132]: pluto stopped after 60 ms
2016:10:26-00:32:26 astaro ipsec_starter[25132]: ipsec starter stopped
2016:10:26-00:45:08 astaro ipsec_starter[32161]: Starting strongSwan 4.4.1git20100610 IPsec [starter]...
2016:10:26-00:45:08 astaro ipsec_starter[32161]: no default route - cannot cope with %defaultroute!!!
2016:10:26-00:45:08 astaro pluto[32173]: Starting IKEv1 pluto daemon (strongSwan 4.4.1git20100610) THREADS VENDORID CISCO_QUIRKS
2016:10:26-00:45:08 astaro pluto[32173]: loaded plugins: curl ldap aes des blowfish serpent twofish sha1 sha2 md5 random x509 pubkey pkcs1 pgp dnskey pem sqlite hmac gmp xauth attr attr-sql resolve 
2016:10:26-00:45:08 astaro pluto[32173]:   including NAT-Traversal patch (Version 0.6c) [disabled]
2016:10:26-00:45:08 astaro pluto[32173]: Using Linux 2.6 IPsec interface code
2016:10:26-00:45:08 astaro ipsec_starter[32167]: pluto (32173) started after 20 ms
2016:10:26-00:45:08 astaro pluto[32173]: loading ca certificates from '/etc/ipsec.d/cacerts'
2016:10:26-00:45:08 astaro pluto[32173]:   loaded ca certificate from '/etc/ipsec.d/cacerts/REF_CaSigVpnSigniCa.pem'
2016:10:26-00:45:08 astaro pluto[32173]: loading aa certificates from '/etc/ipsec.d/aacerts'
2016:10:26-00:45:08 astaro pluto[32173]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
2016:10:26-00:45:08 astaro pluto[32173]: Changing to directory '/etc/ipsec.d/crls'
2016:10:26-00:45:08 astaro pluto[32173]: loading attribute certificates from '/etc/ipsec.d/acerts'
2016:10:26-00:45:08 astaro pluto[32173]: adding interface wlan0/wlan0 172.16.28.1:500
2016:10:26-00:45:08 astaro pluto[32173]: adding interface eth3/eth3 178.26.xx.xx:500
2016:10:26-00:45:08 astaro pluto[32173]: adding interface eth2/eth2 192.168.0.13:500
2016:10:26-00:45:08 astaro pluto[32173]: adding interface eth1/eth1 192.168.179.29:500
2016:10:26-00:45:08 astaro pluto[32173]: adding interface eth0/eth0 10.1.1.1:500
2016:10:26-00:45:08 astaro pluto[32173]: adding interface lo/lo 127.0.0.1:500
2016:10:26-00:45:08 astaro pluto[32173]: adding interface lo/lo ::1:500
2016:10:26-00:45:08 astaro pluto[32173]: loading secrets from "/etc/ipsec.secrets"
2016:10:26-00:45:08 astaro pluto[32173]:   loaded PSK secret for 178.26.xx.xx 52.166.xx.xx 
2016:10:26-00:45:08 astaro pluto[32173]: listening for IKE messages
2016:10:26-00:45:08 astaro pluto[32173]: added connection description "S_REF_IpsSitAzure_0"
2016:10:26-00:45:08 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #1: initiating Main Mode
2016:10:26-00:45:08 astaro pluto[32173]: ERROR: "S_REF_IpsSitAzure_0" #1: sendto on eth3 to 52.166.xx.xx:500 failed in main_outI1. Errno 1: Operation not permitted
2016:10:26-00:45:19 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #1: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000009]
2016:10:26-00:45:19 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #1: ignoring Vendor ID payload [RFC 3947]
2016:10:26-00:45:19 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #1: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2016:10:26-00:45:19 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #1: ignoring Vendor ID payload [FRAGMENTATION]
2016:10:26-00:45:19 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #1: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
2016:10:26-00:45:19 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #1: ignoring Vendor ID payload [IKE CGA version 1]
2016:10:26-00:45:19 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #1: Peer ID is ID_IPV4_ADDR: '52.166.xx.xx'
2016:10:26-00:45:19 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #1: ISAKMP SA established
2016:10:26-00:45:19 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#1}
2016:10:26-00:45:19 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #2: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2016:10:26-00:45:19 astaro pluto[32173]: id="2203" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN up" variant="ipsec" connection="REF_IpsSitAzure" address="178.26.xx.xx" local_net="10.0.0.0/8" remote_net="172.17.0.0/16"
2016:10:26-00:45:19 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #2: sent QI2, IPsec SA established {ESP=>0xcc70125e <0x3465681b}
2016:10:26-00:45:19 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #2: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2016:10:26-00:45:19 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #2: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_HASH)
2016:10:26-00:45:19 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #2: sending encrypted notification INVALID_PAYLOAD_TYPE to 52.166.xx.xx:500
2016:10:26-00:50:36 astaro pluto[32173]: forgetting secrets
2016:10:26-00:50:36 astaro pluto[32173]: loading secrets from "/etc/ipsec.secrets"
2016:10:26-00:50:36 astaro pluto[32173]:   loaded PSK secret for 178.26.xx.xx 52.166.xx.xx 
2016:10:26-00:50:36 astaro pluto[32173]: listening for IKE messages
2016:10:26-00:50:36 astaro pluto[32173]: forgetting secrets
2016:10:26-00:50:36 astaro pluto[32173]: loading secrets from "/etc/ipsec.secrets"
2016:10:26-00:50:36 astaro pluto[32173]:   loaded PSK secret for 178.26.xx.xx 52.166.xx.xx 
2016:10:26-00:50:36 astaro pluto[32173]: loading ca certificates from '/etc/ipsec.d/cacerts'
2016:10:26-00:50:36 astaro pluto[32173]:   loaded ca certificate from '/etc/ipsec.d/cacerts/REF_CaSigVpnSigniCa.pem'
2016:10:26-00:50:36 astaro pluto[32173]: loading aa certificates from '/etc/ipsec.d/aacerts'
2016:10:26-00:50:36 astaro pluto[32173]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
2016:10:26-00:50:36 astaro pluto[32173]: loading attribute certificates from '/etc/ipsec.d/acerts'
2016:10:26-00:50:36 astaro pluto[32173]: Changing to directory '/etc/ipsec.d/crls'
2016:10:26-00:50:36 astaro ipsec_starter[32167]: no default route - cannot cope with %defaultroute!!!
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0": deleting connection
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #2: deleting state (STATE_QUICK_I2)
2016:10:26-00:50:36 astaro pluto[32173]: id="2204" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN down" variant="ipsec" connection="REF_IpsSitAzure" address="178.26.xx.xx" local_net="10.0.0.0/8" remote_net="172.17.0.0/16"
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #1: deleting state (STATE_MAIN_I4)
2016:10:26-00:50:36 astaro pluto[32173]: added connection description "S_REF_IpsSitAzure_0"
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #3: initiating Main Mode
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #3: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000009]
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #3: ignoring Vendor ID payload [RFC 3947]
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #3: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #3: ignoring Vendor ID payload [FRAGMENTATION]
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #3: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #3: ignoring Vendor ID payload [IKE CGA version 1]
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #3: Peer ID is ID_IPV4_ADDR: '52.166.xx.xx'
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #3: ISAKMP SA established
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #4: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#3}
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #4: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2016:10:26-00:50:36 astaro pluto[32173]: id="2203" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN up" variant="ipsec" connection="REF_IpsSitAzure" address="178.26.xx.xx" local_net="10.0.0.0/8" remote_net="172.17.0.0/16"
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #4: sent QI2, IPsec SA established {ESP=>0x3408ba06 <0xe1b403a6}
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #4: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #4: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_HASH)
2016:10:26-00:50:36 astaro pluto[32173]: "S_REF_IpsSitAzure_0" #4: sending encrypted notification INVALID_PAYLOAD_TYPE to 52.166.xx.xx:500
0Tracker

0 BAlfson over 8 years ago in reply to ThomasLichtenstern1

Please reread my post above, Thomas, as it anticipated this exact result in the IPsec log.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 ThomasLichtenstern1 over 8 years ago in reply to BAlfson

Hi Bob,

so I checked

I am not using Azure "Dynamic" Gateway

f you're not, then try #1 in Rulz to eliminate the simple things. Done (already disables IPS and so on)

and debug is not active

I see this in Firewall log when I try to RDP a machine in Azure:

Default DROP TCP

10.1.1.2 : 61717

→

172.17.0.4 : 3389

[SYN] len=52 ttl=127 tos=0x00 srcmac=f0:de:f1:f9:45:fc dstmac=00:60:e0:63:45:36

So no Idea what to do next

Thomas
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 8 years ago in reply to ThomasLichtenstern1

Alone among the logs, the Firewall Live Log presents abbreviated information in a format easier to read quickly. Usually, you can't troubleshoot without looking at the corresponding line from the full Firewall log file. Please post the line corresponding to the one above.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 Dave1 over 7 years ago in reply to BAlfson

Sorry to bring a post back from the dead but we too have this same issue. Any idea's where this went with getting the IPSEC tunnel to work correctly from Sophos UTM to Azure?
Cancel
Vote Up 0 Vote Down

Cancel