Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSec VPN - no connection has been authorized with policy=PSK

Hi,

 

I'm using UTM 9 in VMware and recently setup IPSec VPN to connect to our Pronto Cloud. The connection works fine until i restarted the UTM then i get this error log below. Luckily I can restore from snapshot and it works fine. Can anyone suggest why the connection fails every time i restart the UTM and only work when i restore from snapshot. thanks in advance. 

 

2017:07:10-15:45:38 aucroysophosutm01 pluto[13520]: adding interface eth1/eth1 203.53.197.25:500
2017:07:10-15:45:38 aucroysophosutm01 pluto[13520]: adding interface eth1/eth1 203.53.197.25:4500
2017:07:10-15:45:38 aucroysophosutm01 pluto[13520]: adding interface eth0/eth0 192.168.0.17:500
2017:07:10-15:45:38 aucroysophosutm01 pluto[13520]: adding interface eth0/eth0 192.168.0.17:4500
2017:07:10-15:45:38 aucroysophosutm01 pluto[13520]: adding interface lo/lo 127.0.0.1:500
2017:07:10-15:45:38 aucroysophosutm01 pluto[13520]: adding interface lo/lo 127.0.0.1:4500
2017:07:10-15:45:38 aucroysophosutm01 pluto[13520]: adding interface lo/lo ::1:500
2017:07:10-15:45:38 aucroysophosutm01 pluto[13520]: loading secrets from "/etc/ipsec.secrets"
2017:07:10-15:45:38 aucroysophosutm01 pluto[13520]: loaded PSK secret for 203.53.197.25 202.160.105.122
2017:07:10-15:45:38 aucroysophosutm01 pluto[13520]: added connection description "S_HO-ProntoVPN"
2017:07:10-15:45:38 aucroysophosutm01 pluto[13520]: "S_HO-ProntoVPN" #1: initiating Main Mode
2017:07:10-15:46:14 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: received Vendor ID payload [strongSwan]
2017:07:10-15:46:14 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: ignoring Vendor ID payload [Cisco-Unity]
2017:07:10-15:46:14 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: received Vendor ID payload [XAUTH]
2017:07:10-15:46:14 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: received Vendor ID payload [Dead Peer Detection]
2017:07:10-15:46:14 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: received Vendor ID payload [RFC 3947]
2017:07:10-15:46:14 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
2017:07:10-15:46:14 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
2017:07:10-15:46:14 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2017:07:10-15:46:14 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
2017:07:10-15:46:14 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: initial Main Mode message received on 203.53.197.25:4500 but no connection has been authorized with policy=PSK
2017:07:10-15:46:54 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: received Vendor ID payload [strongSwan]
2017:07:10-15:46:54 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: ignoring Vendor ID payload [Cisco-Unity]
2017:07:10-15:46:54 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: received Vendor ID payload [XAUTH]
2017:07:10-15:46:54 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: received Vendor ID payload [Dead Peer Detection]
2017:07:10-15:46:54 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: received Vendor ID payload [RFC 3947]
2017:07:10-15:46:54 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
2017:07:10-15:46:54 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
2017:07:10-15:46:54 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2017:07:10-15:46:54 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
2017:07:10-15:46:54 aucroysophosutm01 pluto[13520]: packet from 202.160.105.122:4500: initial Main Mode message r



This thread was automatically locked due to age.
Parents
  • Hi, Nam, and welcome to the UTM Community!

    The most likely cause is that the other endpoint is behind a NAT.  If that is the case, the easiest is to create a new Remote Gateway in 'Respond only' using the same PSK.  Did that resolve your issue?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • Hi, Nam, and welcome to the UTM Community!

    The most likely cause is that the other endpoint is behind a NAT.  If that is the case, the easiest is to create a new Remote Gateway in 'Respond only' using the same PSK.  Did that resolve your issue?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data