Hi everybody!!!
Can anyone help me ? I am trying to set an IPSec tunnel, but it doesn't work.
Let me explain my network : at one side I have cisco router with public IP address and local IP address (for LAN), and at the other side it is Linux operating system. IPSEc tunnel goes over Internet. Only Linux side can initiate tunnel. After tunnel is up, and we try to send a ping to the cisco router, tunnel goes down.
Here is my debugging log :
*Mar 1 03:23:53.167: ISAKMP (0:1): Checking ISAKMP transform 3 against priority 10 policy
*Mar 1 03:23:53.167: ISAKMP: life type in seconds
*Mar 1 03:23:53.167: ISAKMP: life duration (basic) of 28800
*Mar 1 03:23:53.167: ISAKMP: encryption 3DES-CBC
*Mar 1 03:23:53.167: ISAKMP: hash MD5
*Mar 1 03:23:53.167: ISAKMP: auth pre-share
*Mar 1 03:23:53.167: ISAKMP: default group 2
*Mar 1 03:23:53.167: ISAKMP (0:1): atts are acceptable. Next payload is 0
*Mar 1 03:23:53.275: ISAKMP (0:1): processing vendor id payload
*Mar 1 03:23:53.275: ISAKMP (0:1): processing vendor id payload
*Mar 1 03:23:53.275: ISAKMP (0:1): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
*Mar 1 03:23:53.275: ISAKMP (0:1): sending packet to 195....... (R) MM_SA_SETUP
*Mar 1 03:23:53.299: ISAKMP (0:1): received packet from 195...... (R) MM_SA_SETUP
*Mar 1 03:23:53.299: ISAKMP (0:1): processing KE payload. message ID = 0
*Mar 1 03:23:53.431: ISAKMP (0:1): processing NONCE payload. message ID = 0
*Mar 1 03:23:53.431: ISAKMP (0:1): found peer pre-shared key matching 195.......
*Mar 1 03:23:53.431: ISAKMP (0:1): SKEYID state generated
*Mar 1 03:23:53.431: ISAKMP (0:1): sending packet to 195...... (R) MM_KEY_EXCH
*Mar 1 03:23:53.571: ISAKMP (0:1): received packet from 195........ (R) MM_KEY_EXCH
*Mar 1 03:23:53.571: ISAKMP (0:1): processing ID payload. message ID = 0
*Mar 1 03:23:53.571: ISAKMP (0:1): processing HASH payload. message ID = 0
*Mar 1 03:23:53.571: ISAKMP (0:1): SA has been authenticated with 195.......
*Mar 1 03:23:53.575: ISAKMP (0:1): sending packet to 195........ (R) QM_IDLE
*Mar 1 03:23:53.619: ISAKMP (0:1): received packet from 195....... (R) QM_IDLE
*Mar 1 03:23:53.623: ISAKMP (0:1): processing HASH payload. message ID = -132137554
*Mar 1 03:23:53.623: ISAKMP (0:1): processing SA payload. message ID = -132137554
*Mar 1 03:23:53.623: ISAKMP (0:1): Checking IPSec proposal 0
*Mar 1 03:23:53.623: ISAKMP: transform 0, ESP_3DES
*Mar 1 03:23:53.623: ISAKMP: attributes in transform:
*Mar 1 03:23:53.623: ISAKMP: encaps is 1
*Mar 1 03:23:53.623: ISAKMP: SA life type in seconds
*Mar 1 03:23:53.623: ISAKMP: SA life duration (basic) of 28800
*Mar 1 03:23:53.623: ISAKMP: authenticator is HMAC-MD5
*Mar 1 03:23:53.623: ISAKMP (0:1): atts are acceptable.
*Mar 1 03:23:53.623: IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) INBOUND local= 213...., remote= 195.....,
local_proxy= 192....../255.255.255.0/0/0 (type=4),
remote_proxy= 192......./255.255.255.0/0/0 (type=4),
protocol= ESP, transform= esp-3des esp-md5-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4
*Mar 1 03:23:53.623: ISAKMP (0:1): processing NONCE payload. message ID = -132137554
*Mar 1 03:23:53.623: ISAKMP (0:1): processing ID payload. message ID = -132137554
*Mar 1 03:23:53.627: ISAKMP (0:1): processing ID payload. message ID = -132137554
*Mar 1 03:23:53.627: ISAKMP (0:1): asking for 1 spis from ipsec
*Mar 1 03:23:53.627: IPSEC(key_engine): got a queue event...
*Mar 1 03:23:53.627: IPSEC(spi_response): getting spi 1769205396 for SA
from 213.....to 195.....for prot 3
*Mar 1 03:23:53.627: ISAKMP: received ke message (2/1)
*Mar 1 03:23:53.879: ISAKMP (0:1): sending packet to 195.....(R) QM_IDLE
*Mar 1 03:23:53.911: ISAKMP (0:1): received packet from 195.......(R) QM_IDLE
*Mar 1 03:23:53.915: ISAKMP (0:1): Creating IPSec SAs
*Mar 1 03:23:53.915: inbound SA from 195......4 to 213........
*Mar 1 03:23:53.915: has spi 0x6973EE94 and conn_id 2000 and flags 4
*Mar 1 03:23:53.915: lifetime of 28800 seconds
*Mar 1 03:23:53.915: outbound SA from 213.......to 195...... (
*Mar 1 03:23:53.915: has spi -1901166751 and conn_id 2001 and flags C
*Mar 1 03:23:53.915: lifetime of 28800 seconds
*Mar 1 03:23:53.915: ISAKMP (0:1): deleting node -132137554 error FALSE reason "quick mode done (await()"
*Mar 1 03:23:53.915: IPSEC(key_engine): got a queue event...
*Mar 1 03:23:53.919: IPSEC(create_sa): sa created, (sa) sa_dest= 213.202.103.246, sa_prot= 50,
sa_spi= 0x6973EE94(1769205396),
sa_trans= esp-3des esp-md5-hmac , sa_conn_id= 2000
*Mar 1 03:23:53.919: IPSEC(create_sa): sa created,
(sa) sa_dest= 195.29.90.74, sa_prot= 50,
sa_spi= 0x8EAE7F61(2393800545),
sa_trans= esp-3des esp-md5-hmac , sa_conn_id= 2001
*Mar 1 03:24:43.915: ISAKMP (0:1): purging node -132137554
Sending 5, 100-byte ICMP Echos to 192.168......, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
Router#
*Mar 1 03:25:46.447: IPSEC(sa_request): ,
(key eng. msg.) OUTBOUND local= 213......, remote= 195.29.90.74,
local_proxy= 192.168...../255.255.255.255/0/0 (type=1),
remote_proxy= 192.168...../255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-3des esp-md5-hmac ,
lifedur= 28800s and 4608000kb,
spi= 0xE7347EAB(3878977195), conn_id= 0, keysize= 0, flags= 0x400C
*Mar 1 03:25:46.447: ISAKMP: received ke message (1/1)
*Mar 1 03:25:46.447: ISAKMP (0:1): sitting IDLE. Starting QM immediately (QM_IDLE )
*Mar 1 03:25:46.447: ISAKMP (0:1): beginning Quick Mode exchange, M-ID of 1625034649
*Mar 1 03:25:46.451: ISAKMP (0:1): sending packet to 195.....(R) QM_IDLE
*Mar 1 03:25:46.467: ISAKMP (0:1): received packet from 195.....(R) QM_IDLE
*Mar 1 03:25:46.471: ISAKMP (0:1): processing HASH payload. message ID = -2002660149
*Mar 1 03:25:46.471: ISAKMP (0:1): processing NOTIFY INVALID_ID_INFO protocol 1
spi 0, message ID = -2002660149, sa = 810A842C
*Mar 1 03:25:46.471: ISAKMP (0:1): deleting node -2002660149 error FALSE reason "informational (in) state 1"
*Mar 1 03:25:50.759: %CRYPTO-4-RECVD_PKT_INV_IDENTITY: identity covered by finer-grained SA
(ip) dest_addr= 192.168......, src_addr= 192.168.254.14, prot= 1
(ident) local=213....., remote=195......
local proxy=192.168...../255.255.255.0/0/0,
remote_proxy=192.168......255.255.255.0/0/0
*Mar 1 03:25:50.759: IPSEC(epa_des_crypt): decrypted packet failed SA identity check
*Mar 1 03:25:55.187: IPSEC(epa_des_crypt): decrypted packet failed SA identity check
*Mar 1 03:25:56.451: ISAKMP (0:1): retransmitting phase 2 QM_IDLE 1625034649 ...
*Mar 1 03:25:56.451: ISAKMP (0:1): incrementing error counter on sa: retransmit phase 2
*Mar 1 03:25:56.451: ISAKMP (0:1): incrementing error counter on sa: retransmit phase 2
*Mar 1 03:25:56.451: ISAKMP (0:1): retransmitting phase 2 1625034649 QM_IDLE
*Mar 1 03:25:56.451: ISAKMP (0:1): sending packet to 195.....(R) QM_IDLE
*Mar 1 03:25:56.467: ISAKMP (0:1): received packet from 195........(R) QM_IDLE
*Mar 1 03:25:56.471: ISAKMP (0:1): processing HASH payload. message ID = -954052269
*Mar 1 03:25:56.471: ISAKMP (0:1): processing NOTIFY INVALID_MESSAGE_ID protocol 1
spi 0, message ID = -954052269, sa = 810A842C
*Mar 1 03:25:56.471: ISAKMP (0:1): incrementing error counter on sa: some bad notify
*Mar 1 03:25:56.471: ISAKMP (0:1): deleting node -954052269 error FALSE reason "informational (in) state 2"
*Mar 1 03:25:59.515: IPSEC(sa_request): ,
(key eng. msg.) OUTBOUND local= 213......., remote= 195.......,
local_proxy= 192.168....../255.255.255.255/0/0 (type=1),
remote_proxy= 192.168...../255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-3des esp-md5-hmac ,
lifedur= 28800s and 4608000kb,
spi= 0x3BFA2C03(1006251011), conn_id= 0, keysize= 0, flags= 0x400C
*Mar 1 03:25:59.515: ISAKMP: received ke message (1/1)
*Mar 1 03:25:59.519: ISAKMP (0:1): sitting IDLE. Starting QM immediately (QM_IDLE )
*Mar 1 03:25:59.519: ISAKMP (0:1): beginning Quick Mode exchange, M-ID of 684316732
*Mar 1 03:25:59.519: ISAKMP (0:1): sending packet to 195......(R) QM_IDLE
*Mar 1 03:25:59.539: ISAKMP (0:1): received packet from 195.......4 (R) QM_IDLE
*Mar 1 03:25:59.539: ISAKMP (0:1): processing HASH payload. message ID = 819349399
*Mar 1 03:25:59.539: ISAKMP (0:1): processing NOTIFY INVALID_ID_INFO protocol 1
spi 0, message ID = 819349399, sa = 810A842C
*Mar 1 03:25:59.539: ISAKMP (0:1): deleting node 819349399 error FALSE reason "informational (in) state 1"
*Mar 1 03:25:59.619: IPSEC(epa_des_crypt): decrypted packet failed SA identity check
*Mar 1 03:26:00.327: IPSEC(epa_des_crypt): decrypted packet failed SA identity check
*Mar 1 03:26:01.135: IPSEC(epa_des_crypt): decrypted packet failed SA identity check
*Mar 1 03:26:01.939: IPSEC(epa_des_crypt): decrypted packet failed SA identity check
*Mar 1 03:26:06.451: ISAKMP (0:1): retransmitting phase 2 QM_IDLE 1625034649 ...
*Mar 1 03:26:06.451: ISAKMP (0:1): incrementing error counter on sa: retransmit phase 2
*Mar 1 03:26:06.451: ISAKMP (0:1): incrementing error counter on sa: retransmit phase 2
*Mar 1 03:26:06.451: ISAKMP (0:1): retransmitting phase 2 1625034649 QM_IDLE
*Mar 1 03:26:06.451: ISAKMP (0:1): sending packet to 195......(R) QM_IDLE
SO, as you can see something bad happens. please help me, I'm loosing my mind.
This thread was automatically locked due to age.