Hi all,
i am trying to connect ASL 4.006 with Cisco PIX (V 6.1.. i was told).
On one side i can read in the board of members, who seem to connect to PIX without problems,
others have a problem with the ' wrong ' RFC implementation in PIX.
It seems that i have the same problem.
Maybe one of the successfull guys could post me a running config (ASL and PIX) ???
Or give me any other hint how to solve the problem ???
Any help would be appreciated.
Regards,
Karsten
IPSec connection
===========================
Endpoint definition
Local endpoint: a.b.c.d
Remote Endpoint: w.x.y.z
Subnet definition
Local subnet: Intranet
Remote subnet: Extranet
Authetication of remote station:
PSK
=====
IPSec policy
Key exchange IKE
ISAKMP (IKE) settings
IKE mode Main Mode
Enc.alg. 3DES-CBC
Authetication alg. MD5 160bit
IKE DH Group DH Group 2 (MODP1024)
SA lifetime (secs) 7800
IPSec settings
IPSec mode Tunnel
IPSec protocol ESP
Enc. alg. 3DES
Enf. alg. Off
Authetication alg. MD5 160bit
SA lifetime (secs) 3600
PFS No PFS
Compression Off
Aug 20 18:18:57 (none) pluto[31562]: Starting Pluto (FreeS/WAN Version super-freeswan-1.99_kb1)
Aug 20 18:18:57 (none) pluto[31562]: including X.509 patch (Version 0.9.15)
Aug 20 18:18:57 (none) pluto[31562]: including NAT-Traversal patch (Version 0.5a) [disabled]
Aug 20 18:18:57 (none) pluto[31562]: ike_alg_register_enc: Activating OAKLEY_AES_CBC: Ok (ret=0)
Aug 20 18:18:57 (none) pluto[31562]: ike_alg_register_enc: Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0)
Aug 20 18:18:57 (none) pluto[31562]: ike_alg_register_enc: Activating OAKLEY_CAST_CBC: Ok (ret=0)
Aug 20 18:18:57 (none) pluto[31562]: ike_alg_register_enc: Activating OAKLEY_SERPENT_CBC: Ok (ret=0)
Aug 20 18:18:57 (none) pluto[31562]: ike_alg_register_hash: Activating OAKLEY_SHA2_256: Ok (ret=0)
Aug 20 18:18:57 (none) pluto[31562]: ike_alg_register_hash: Activating OAKLEY_SHA2_512: Ok (ret=0)
Aug 20 18:18:57 (none) pluto[31562]: ike_alg_register_enc: Activating OAKLEY_TWOFISH_CBC: Ok (ret=0)
Aug 20 18:18:57 (none) pluto[31562]: ike_alg_register_enc: Activating OAKLEY_SSH_PRIVATE_65289: Ok (ret=0)
Aug 20 18:18:57 (none) pluto[31562]: Changing to directory '/etc/ipsec.d/cacerts'
Aug 20 18:18:57 (none) pluto[31562]: loaded cacert file 'xxx.pem' (1062 bytes)
Aug 20 18:18:57 (none) pluto[31562]: Changing to directory '/etc/ipsec.d/crls'
Aug 20 18:18:57 (none) pluto[31562]: Warning: empty directory
Aug 20 18:18:57 (none) pluto[31562]: loaded my default X.509 cert file '/etc/x509cert.der' (921 bytes)
Aug 20 18:18:57 (none) pluto[31562]: ADNS process exited with status 1
Aug 20 18:18:57 (none) pluto[31562]: listening for IKE messages
Aug 20 18:18:57 (none) pluto[31562]: adding interface ipsec0/eth1 a.b.c.18
Aug 20 18:18:57 (none) pluto[31562]: loading secrets from "/etc/ipsec.secrets"
Aug 20 18:18:57 (none) pluto[31562]: | from whack: got --esp=aes128-md5
Aug 20 18:18:57 (none) pluto[31562]: | from whack: got --ike=aes128-md5-modp1024
Aug 20 18:18:57 (none) pluto[31562]: added connection description "VPN_Connection_1"
Aug 20 18:18:57 (none) pluto[31562]: "VPN_Connection_1" #1: initiating Main Mode
Aug 20 18:18:57 (none) pluto[31562]: ERROR: "VPN_Connection_1" #1: sendto on eth1 to w.x.y.2:500 failed in main_outI1. Errno 1: Operation not permitted
Aug 20 18:19:08 (none) pluto[31562]: "VPN_Connection_1" #1: ignoring Vendor ID payload [XAUTH]
Aug 20 18:19:08 (none) pluto[31562]: "VPN_Connection_1" #1: ignoring Vendor ID payload [Dead Peer Detection]
Aug 20 18:19:08 (none) pluto[31562]: "VPN_Connection_1" #1: ignoring Vendor ID payload [Cisco-Unity]
Aug 20 18:19:08 (none) pluto[31562]: "VPN_Connection_1" #1: ignoring Vendor ID payload [ec142267106c78ef...]
Aug 20 18:19:08 (none) pluto[31562]: "VPN_Connection_1" #1: protocol/port in Phase 1 ID Payload must be 0/0 or 17/500 but are 17/0
Aug 20 18:19:08 (none) pluto[31562]: "VPN_Connection_1" #1: sending notification INVALID_ID_INFORMATION to w.x.y.2:500
Aug 20 18:19:08 (none) pluto[31562]: "VPN_Connection_1" #1: encrypted Informational Exchange message is invalid because it is for incomplete ISAKMP SA
Aug 20 18:19:14 (none) pluto[31562]: packet from w.x.y.2:6: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
Aug 20 18:19:14 (none) pluto[31562]: packet from w.x.y.2:6: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
Aug 20 18:19:14 (none) pluto[31562]: packet from w.x.y.2:6: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
Aug 20 18:19:14 (none) pluto[31562]: packet from w.x.y.2:6: initial Main Mode message received on a.b.c.18:500 but no connection has been authorized
Aug 20 18:19:54 (none) pluto[31562]: packet from w.x.y.2:6: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
Aug 20 18:19:54 (none) pluto[31562]: packet from w.x.y.2:6: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
Aug 20 18:19:54 (none) pluto[31562]: packet from w.x.y.2:6: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
Aug 20 18:19:54 (none) pluto[31562]: packet from w.x.y.2:6: initial Main Mode message received on a.b.c.18:500 but no connection has been authorized
Aug 20 18:20:18 (none) pluto[31562]: "VPN_Connection_1" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message
Aug 20 18:20:18 (none) pluto[31562]: "VPN_Connection_1" #1: starting keying attempt 2 of an unlimited number
Aug 20 18:20:18 (none) pluto[31562]: "VPN_Connection_1" #2: initiating Main Mode to replace #1
Aug 20 18:20:19 (none) pluto[31562]: "VPN_Connection_1" #2: ignoring Vendor ID payload [XAUTH]
Aug 20 18:20:19 (none) pluto[31562]: "VPN_Connection_1" #2: ignoring Vendor ID payload [Dead Peer Detection]
Aug 20 18:20:19 (none) pluto[31562]: "VPN_Connection_1" #2: ignoring Vendor ID payload [Cisco-Unity]
Aug 20 18:20:19 (none) pluto[31562]: "VPN_Connection_1" #2: ignoring Vendor ID payload [ec142267d1157e30...]
Aug 20 18:20:19 (none) pluto[31562]: "VPN_Connection_1" #2: protocol/port in Phase 1 ID Payload must be 0/0 or 17/500 but are 17/0
Aug 20 18:20:19 (none) pluto[31562]: "VPN_Connection_1" #2: sending notification INVALID_ID_INFORMATION to w.x.y.2:500
Aug 20 18:20:19 (none) pluto[31562]: "VPN_Connection_1" #2: encrypted Informational Exchange message is invalid because it is for incomplete ISAKMP SA
Aug 20 18:20:34 (none) pluto[31562]: packet from w.x.y.2:6: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
Aug 20 18:20:34 (none) pluto[31562]: packet from w.x.y.2:6: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
Aug 20 18:20:34 (none) pluto[31562]: packet from w.x.y.2:6: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
Aug 20 18:20:34 (none) pluto[31562]: packet from w.x.y.2:6: initial Main Mode message received on a.b.c.18:500 but no connection has been authorized
Aug 20 18:21:14 (none) pluto[31562]: packet from w.x.y.2:6: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
Aug 20 18:21:14 (none) pluto[31562]: packet from w.x.y.2:6: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
Aug 20 18:21:14 (none) pluto[31562]: packet from w.x.y.2:6: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
Aug 20 18:21:14 (none) pluto[31562]: packet from w.x.y.2:6: initial Main Mode message received on a.b.c.18:500 but no connection has been authorized
This thread was automatically locked due to age.