Hello,
I am testing a VPN connection between two Astaro Gateway. Gateway A with Office version 6.100. Gateway IT with office version 6.104. with Astaro version 6.104. I am using X509 certificates. Quite often the connection doesn't establish with the following error.
2006:02:17-13:21:07 (none) pluto[10841]: "S_A__IT_0" #994: ignoring unknown Vendor ID payload
2006:02:17-13:21:07 (none) pluto[10841]: "S_A__IT_0" #994: received Vendor ID payload [Dead Peer Detection]
2006:02:17-13:21:07 (none) pluto[10841]: "S_A__IT_0" #994: received Vendor ID payload [RFC 3947] method set to=109
2006:02:17-13:21:07 (none) pluto[10841]: "S_A__IT_0" #994: enabling possible NAT-traversal with method 3
2006:02:17-13:21:07 (none) pluto[10841]: "S_A__IT_0" #994: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
2006:02:17-13:21:08 (none) pluto[10841]: "S_A__IT_0" #994: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): i am NATed
2006:02:17-13:21:08 (none) pluto[10841]: "S_A__IT_0" #994: I am sending my cert
2006:02:17-13:21:08 (none) pluto[10841]: "S_A__IT_0" #994: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
2006:02:17-13:21:08 (none) pluto[10841]: "S_A__IT_0" #994: Main mode peer ID is ID_IPV4_ADDR: '85.42.34.146'
2006:02:17-13:21:08 (none) pluto[10841]: "S_A__IT_0" #994: we require peer to have ID 'C=IT, ST=RM, L=K, O=G, OU=G, CN=it_gw, E=it_gw@business.com', but peer declares '85.42.34.146'
2006:02:17-13:21:08 (none) pluto[10841]: "S_A__IT_0" #994: sending encrypted notification INVALID_ID_INFORMATION to 85.42.34.146:4500
2006:02:17-13:21:08 (none) pluto[10841]: "S_A__IT_0" #994: failed to build notification for spisize=0
It appears that Gateway A looks for the wrong key. The local key at Gateway IT is it_gw ('C=IT, ST=RM, L=K, O=G, OU=G, CN=it_gw, E=it_gw@business.com').
Here are the connection parameters:
Type: Standard
ipsec Policy: Custom
Auto Packet Filter: on
Strict Routing: on
Authentication: it_gw
Custom Policy is:
IKE Mode: Main Mode
Encryption Algorithm: 3DES 168 bit
Authentication Algorithm: SHA2 512 bit
IKE DH Group: DH Group5
SA Lifetime: 7800
IPSEC Settings:
IPSEC Mode: Tunnel
IPSEC Protocol: ESP
Encryption Algorithm: AES (256 bit)
Enforce Algorithm: on
Authentication Algorithm: SHA2 512 bit
SA Lifetime: 900
PFS: PFS group5
Compression: off
Does anybody know what is causing this problem and how it can be fixed?
When the Astaro Gateway machine is restared on both sides the connection establishes.
This thread was automatically locked due to age.
