Hello,
I´m using ASL 3.2 and configuring VPN with CP-FW1 4.1 and I have the problem "incorrect or missing nexthop setting".
Log File:
000 interface ipsec0/eth1 200.XXX.XXX.134
000
000 algorithm ESP encrypt: id=3, name=ESP_3DES
000 algorithm ESP encrypt: id=6, name=ESP_CAST
000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH
000 algorithm ESP encrypt: id=12, name=ESP_AES
000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1
000
000 "HTC_1": 172.20.0.0/16===200.xxx.xxx.134---200.xxx.xxx.169...200.xxx.xxx.130===172.17.0.0/16
000 "HTC_1": ike_life: 7800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "HTC_1": policy: PSK+ENCRYPT+TUNNEL+DISABLEARRIVALCHECK; interface: eth1; unrouted
000 "HTC_1": newest ISAKMP SA: #1; newest IPsec SA: #0; eroute owner: #0
000 "HTC_1": ESP algorithms wanted: 3/000-1/000, 3/000-2/000,
000 "HTC_1": ESP algorithms loaded: 3/168-1/128, 3/168-2/160,
000
000 #9: "HTC_1" STATE_QUICK_I1 (sent QI1, expecting QR1); EVENT_RETRANSMIT in 16s
000 #1: "HTC_1" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 6463s; newest ISAKMP
Jun 13 11:58:42 host Pluto[12833]: | executing prepare-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='prepare-client' PLUTO_CONNECTION='HTC_1' PLUTO_NEXT_HOP='200.XXX.XXX.169' PLUTO_INTERFACE='ipsec0' PLUTO_ME='200.XXX.XXX.134' PLUTO_MY_ID='200.XXX.XXX.134' PLUTO_MY_CLIENT='172.20.0.0/16' PLUTO_MY_CLIENT_NET='172.20.0.0' PLUTO_MY_CLIENT_MASK='255.255.0.0' PLUTO_PEER='200.XXX.XXX.130' PLUTO_PEER_ID='200.XXX.XXX.130' PLUTO_PEER_CLIENT='172.17.0.0/16' PLUTO_PEER_CLIENT_NET='172.17.0.0' PLUTO_PEER_CLIENT_MASK='255.255.0.0' ipsec _updown
Jun 13 11:58:43 host Pluto[12833]: | executing route-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='route-client' PLUTO_CONNECTION='HTC_1' PLUTO_NEXT_HOP='200.XXX.XXX.169' PLUTO_INTERFACE='ipsec0' PLUTO_ME='200.XXX.XXX.134' PLUTO_MY_ID='200.XXX.XXX.134' PLUTO_MY_CLIENT='172.20.0.0/16' PLUTO_MY_CLIENT_NET='172.20.0.0' PLUTO_MY_CLIENT_MASK='255.255.0.0' PLUTO_PEER='200.XXX.XXX.130' PLUTO_PEER_ID='200.XXX.XXX.130' PLUTO_PEER_CLIENT='172.17.0.0/16' PLUTO_PEER_CLIENT_NET='172.17.0.0' PLUTO_PEER_CLIENT_MASK='255.255.0.0' ipsec _updown
Jun 13 11:58:43 host Pluto[12833]: "HTC_1": route-client output: SIOCADDRT: Network is unreachable
Jun 13 11:58:43 host Pluto[12833]: "HTC_1": route-client output: /usr/local/lib/ipsec/_updown: `route add -net 172.17.0.0 netmask 255.255.0.0 dev ipsec0 gw 200.XXX.XXX.169' failed
Jun 13 11:58:43 host Pluto[12833]: "HTC_1": route-client output: /usr/local/lib/ipsec/_updown: (incorrect or missing nexthop setting??)
Jun 13 11:58:43 host Pluto[12833]: "HTC_1": route-client command exited with status 7
Jun 13 11:58:43 host Pluto[12833]: | executing down-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='down-client' PLUTO_CONNECTION='HTC_1' PLUTO_NEXT_HOP='200.XXX.XXX.169' PLUTO_INTERFACE='ipsec0' PLUTO_ME='200.XXX.XXX.134' PLUTO_MY_ID='200.XXX.XXX.134' PLUTO_MY_CLIENT='172.20.0.0/16' PLUTO_MY_CLIENT_NET='172.20.0.0' PLUTO_MY_CLIENT_MASK='255.255.0.0' PLUTO_PEER='200.XXX.XXX.130' PLUTO_PEER_ID='200.XXX.XXX.130' PLUTO_PEER_CLIENT='172.17.0.0/16' PLUTO_PEER_CLIENT_NET='172.17.0.0' PLUTO_PEER_CLIENT_MASK='255.255.0.0' ipsec _updown
Jun 13 11:58:43 host Pluto[12833]: | delete eroute 172.20.0.0/16 -> 172.17.0.0/16 => %trap
Jun 13 11:58:43 host Pluto[12833]: | finish_pfkey_msg: SADB_X_DELFLOW message 6 for flow %trap
Any idea to solve that??
Tks
Walter
This thread was automatically locked due to age.