Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 1 subscriber
  • Views 859 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

cisco to asl

ojrad
Hi,

I try using cisco router as VPN client in NET to NET connection. I use router cisco 831 for  internet connection. I use NAT to hide clients behind router. When I try to establish VPN connection on ASL side I receive this message:

protocol/port in Phase 1 ID Payload must be 0/0 or 17/500 but are 17/0 

Thanks
   


This thread was automatically locked due to age.
  • 0
    The Cisco appears to have a buggy IPSec implementation:

    RFC 2407, section 4.6.2 states :

      During Phase 1 negotiations, the ID port and protocol fields MUST be
      set to zero or to UDP port 500.  If an implementation receives any
      other values, this MUST be treated as an error and the security
      association setup MUST be aborted.

    So the Cisco is proposing UDP port 0, which according to the RFC is invalid.

    Open a TAC call with Cisco...
      
  • 0 in reply to Ken Bantoft
    Hi,

     Is it possible that this behavior is connected with NAT?
     
    It seems that others have the same problems connectiong  cisco routers 800 series with Frees/wan. It is posible to resolve the problem patching the fress/wan so that accepts 17/0 connections. 

    Can we expect this patch in Astaro (I know it is not valid)?

                                                                        Ojrad
        
Cookie Information Banner