I am trying to get a net to net VPN set up between isakmpd in OpenBSD and ASL 5 and I am having some problems. The OpenBSD box is stating:
Default exchange_run: exchange_validate failed
Default dropped message from 172.16.107.2 port 500 due to notification type PAYLOAD_MALFORMED
And the output from ASL is:
000
000 "S_CFCU_-_HAFP_0": 10.0.1.0/24===172.16.107.2...172.16.107.19[C=US, ST=Indiana, L=West Lafayette, O=HAFP, OU=IT, CN=test1.org, E=root@test2.org]===10.0.3.0/24
000 "S_CFCU_-_HAFP_0": CAs: 'C=us, ST=Indiana, L=West Lafayette, O=CFCU, OU=IT, CN=gatekeeper, E=user@test.net'...'%any'
000 "S_CFCU_-_HAFP_0": ike_life: 3600s; ipsec_life: 600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "S_CFCU_-_HAFP_0": policy: RSASIG+ENCRYPT+TUNNEL+PFS; interface: eth1; unrouted
000 "S_CFCU_-_HAFP_0": newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0
000 "S_CFCU_-_HAFP_0": IKE algorithms wanted: 5_000-2-2, flags=-strict
000 "S_CFCU_-_HAFP_0": IKE algorithms found: 5_192-2_160-2,
000 "S_CFCU_-_HAFP_0": ESP algorithms wanted: 3_000-1, ; pfsgroup=2; flags=-strict
000 "S_CFCU_-_HAFP_0": ESP algorithms loaded: 3_168-1_128,
000
000 #2: "S_CFCU_-_HAFP_0" STATE_MAIN_I1 (sent MI1, expecting MR1); EVENT_RETRANSMIT in 30s
000
I will post the configs below...
This thread was automatically locked due to age.
