I have utm220 in main office and some software appliance in remote offices.
In main office i created gateway (respond only type, and Authentication type by RSA key) and IPsec connection to each remote office.
In remote offices i created gataway (initiate connection type and Authentication type by RSA key)
Every thing work fine , but after 3-4 hour one of IPsec tunnel lost.
And after i re-generate RSA key on remote office UTM, and renew it in main office IPsec gateway. It continue work fine, but after some time IPsec tunnel for that or other remote office are lost again, and i need to re-generate RSA key .....
Why generated RSA key are lost 5 times in day, and why i need re-generte it every time ?
Please HELP ME !!!
On remote office UTM IPsec log i see :
2013:12:04-07:52:52 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #30: initiating Main Mode to replace #26
2013:12:04-07:52:53 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #30: received Vendor ID payload [strongSwan]
2013:12:04-07:52:53 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #30: ignoring Vendor ID payload [Cisco-Unity]
2013:12:04-07:52:53 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #30: received Vendor ID payload [XAUTH]
2013:12:04-07:52:53 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #30: received Vendor ID payload [Dead Peer Detection]
2013:12:04-07:52:53 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #30: received Vendor ID payload [RFC 3947]
2013:12:04-07:52:53 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #30: enabling possible NAT-traversal with method 3
2013:12:04-07:52:53 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #30: NAT-Traversal: Result using RFC 3947: no NAT detected
2013:12:04-07:52:53 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #30: we don't have a cert
2013:12:04-07:52:53 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #30: Peer ID is ID_FQDN: 'tomail.ru'
2013:12:04-07:52:53 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #30: Dead Peer Detection (RFC 3706) enabled
2013:12:04-07:52:53 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #30: ISAKMP SA established
2013:12:04-08:00:27 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #30: ignoring Delete SA payload: PROTO_IPSEC_ESP SA(0x008c9b0b) not found (maybe expired)
2013:12:04-08:07:22 anthill pluto[28587]: packet from 87.255.18.19:500: Informational Exchange is for an unknown (expired?) SA
2013:12:04-08:35:24 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #31: initiating Quick Mode PUBKEY+ENCRYPT+TUNNEL+UP to replace #29 {using isakmp#30}
2013:12:04-08:35:24 anthill pluto[28587]: "S_REF_IpsSitIpsectomai_0" #31: sent QI2, IPsec SA established {ESP=>0x5881240a 0x7ab25d07
And in main office utm IPsec log i see:
2013:12:04-09:49:09 UTM220 pluto[8635]: | *received 252 bytes from REM.OTE.IP.ADDR:500 on eth1
2013:12:04-09:49:09 UTM220 pluto[8635]: | **parse ISAKMP Message:
2013:12:04-09:49:09 UTM220 pluto[8635]: | initiator cookie:
2013:12:04-09:49:09 UTM220 pluto[8635]: | 64 0d c9 f6 ae 5f 8d 55
2013:12:04-09:49:09 UTM220 pluto[8635]: | responder cookie:
2013:12:04-09:49:09 UTM220 pluto[8635]: | 00 00 00 00 00 00 00 00
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_SA
2013:12:04-09:49:09 UTM220 pluto[8635]: | ISAKMP version: ISAKMP Version 1.0
2013:12:04-09:49:09 UTM220 pluto[8635]: | exchange type: ISAKMP_XCHG_IDPROT
2013:12:04-09:49:09 UTM220 pluto[8635]: | flags: none
2013:12:04-09:49:09 UTM220 pluto[8635]: | message ID: 00 00 00 00
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 252
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP Security Association Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_VID
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 52
2013:12:04-09:49:09 UTM220 pluto[8635]: | DOI: ISAKMP_DOI_IPSEC
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP Vendor ID Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_VID
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP Vendor ID Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_VID
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP Vendor ID Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_VID
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 12
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP Vendor ID Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_VID
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP Vendor ID Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_VID
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP Vendor ID Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_VID
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP Vendor ID Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_VID
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP Vendor ID Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_VID
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP Vendor ID Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NONE
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: packet from REM.OTE.IP.ADDR:500: received Vendor ID payload [strongSwan]
2013:12:04-09:49:09 UTM220 pluto[8635]: packet from REM.OTE.IP.ADDR:500: ignoring Vendor ID payload [Cisco-Unity]
2013:12:04-09:49:09 UTM220 pluto[8635]: packet from REM.OTE.IP.ADDR:500: received Vendor ID payload [XAUTH]
2013:12:04-09:49:09 UTM220 pluto[8635]: packet from REM.OTE.IP.ADDR:500: received Vendor ID payload [Dead Peer Detection]
2013:12:04-09:49:09 UTM220 pluto[8635]: packet from REM.OTE.IP.ADDR:500: received Vendor ID payload [RFC 3947]
2013:12:04-09:49:09 UTM220 pluto[8635]: packet from REM.OTE.IP.ADDR:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
2013:12:04-09:49:09 UTM220 pluto[8635]: packet from REM.OTE.IP.ADDR:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
2013:12:04-09:49:09 UTM220 pluto[8635]: packet from REM.OTE.IP.ADDR:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2013:12:04-09:49:09 UTM220 pluto[8635]: packet from REM.OTE.IP.ADDR:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
2013:12:04-09:49:09 UTM220 pluto[8635]: | ****parse IPsec DOI SIT:
2013:12:04-09:49:09 UTM220 pluto[8635]: | IPsec DOI SIT: SIT_IDENTITY_ONLY
2013:12:04-09:49:09 UTM220 pluto[8635]: | ****parse ISAKMP Proposal Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NONE
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 40
2013:12:04-09:49:09 UTM220 pluto[8635]: | proposal number: 0
2013:12:04-09:49:09 UTM220 pluto[8635]: | protocol ID: PROTO_ISAKMP
2013:12:04-09:49:09 UTM220 pluto[8635]: | SPI size: 0
2013:12:04-09:49:09 UTM220 pluto[8635]: | number of transforms: 1
2013:12:04-09:49:09 UTM220 pluto[8635]: | *****parse ISAKMP Transform Payload (ISAKMP):
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NONE
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 32
2013:12:04-09:49:09 UTM220 pluto[8635]: | transform number: 0
2013:12:04-09:49:09 UTM220 pluto[8635]: | transform ID: KEY_IKE
2013:12:04-09:49:09 UTM220 pluto[8635]: | ******parse ISAKMP Oakley attribute:
2013:12:04-09:49:09 UTM220 pluto[8635]: | af+type: OAKLEY_LIFE_TYPE
2013:12:04-09:49:09 UTM220 pluto[8635]: | length/value: 1
2013:12:04-09:49:09 UTM220 pluto[8635]: | ******parse ISAKMP Oakley attribute:
2013:12:04-09:49:09 UTM220 pluto[8635]: | af+type: OAKLEY_LIFE_DURATION
2013:12:04-09:49:09 UTM220 pluto[8635]: | length/value: 7800
2013:12:04-09:49:09 UTM220 pluto[8635]: | ******parse ISAKMP Oakley attribute:
2013:12:04-09:49:09 UTM220 pluto[8635]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
2013:12:04-09:49:09 UTM220 pluto[8635]: | length/value: 5
2013:12:04-09:49:09 UTM220 pluto[8635]: | ******parse ISAKMP Oakley attribute:
2013:12:04-09:49:09 UTM220 pluto[8635]: | af+type: OAKLEY_HASH_ALGORITHM
2013:12:04-09:49:09 UTM220 pluto[8635]: | length/value: 1
2013:12:04-09:49:09 UTM220 pluto[8635]: | ******parse ISAKMP Oakley attribute:
2013:12:04-09:49:09 UTM220 pluto[8635]: | af+type: OAKLEY_AUTHENTICATION_METHOD
2013:12:04-09:49:09 UTM220 pluto[8635]: | length/value: 3
2013:12:04-09:49:09 UTM220 pluto[8635]: | ******parse ISAKMP Oakley attribute:
2013:12:04-09:49:09 UTM220 pluto[8635]: | af+type: OAKLEY_GROUP_DESCRIPTION
2013:12:04-09:49:09 UTM220 pluto[8635]: | length/value: 5
2013:12:04-09:49:09 UTM220 pluto[8635]: | preparse_isakmp_policy: peer requests PUBKEY authentication
2013:12:04-09:49:09 UTM220 pluto[8635]: | creating state object #2380 at 0x9759968
2013:12:04-09:49:09 UTM220 pluto[8635]: | ICOOKIE: 64 0d c9 f6 ae 5f 8d 55
2013:12:04-09:49:09 UTM220 pluto[8635]: | RCOOKIE: 12 99 3e 11 66 22 5c 07
2013:12:04-09:49:09 UTM220 pluto[8635]: | peer: 4d ec ff 9e
2013:12:04-09:49:09 UTM220 pluto[8635]: | state hash entry 14
2013:12:04-09:49:09 UTM220 pluto[8635]: | inserting event EVENT_SO_DISCARD, timeout in 0 seconds for #2380
2013:12:04-09:49:09 UTM220 pluto[8635]: "S_REF_IpsSitVpntoshop18_0"[1] REM.OTE.IP.ADDR #2380: responding to Main Mode from unknown peer REM.OTE.IP.ADDR
2013:12:04-09:49:09 UTM220 pluto[8635]: | **emit ISAKMP Message:
2013:12:04-09:49:09 UTM220 pluto[8635]: | initiator cookie:
2013:12:04-09:49:09 UTM220 pluto[8635]: | 64 0d c9 f6 ae 5f 8d 55
2013:12:04-09:49:09 UTM220 pluto[8635]: | responder cookie:
2013:12:04-09:49:09 UTM220 pluto[8635]: | 12 99 3e 11 66 22 5c 07
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_SA
2013:12:04-09:49:09 UTM220 pluto[8635]: | ISAKMP version: ISAKMP Version 1.0
2013:12:04-09:49:09 UTM220 pluto[8635]: | exchange type: ISAKMP_XCHG_IDPROT
2013:12:04-09:49:09 UTM220 pluto[8635]: | flags: none
2013:12:04-09:49:09 UTM220 pluto[8635]: | message ID: 00 00 00 00
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***emit ISAKMP Security Association Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_VID
2013:12:04-09:49:09 UTM220 pluto[8635]: | DOI: ISAKMP_DOI_IPSEC
2013:12:04-09:49:09 UTM220 pluto[8635]: | *****parse ISAKMP Transform Payload (ISAKMP):
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NONE
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 32
2013:12:04-09:49:09 UTM220 pluto[8635]: | transform number: 0
2013:12:04-09:49:09 UTM220 pluto[8635]: | transform ID: KEY_IKE
2013:12:04-09:49:09 UTM220 pluto[8635]: | ******parse ISAKMP Oakley attribute:
2013:12:04-09:49:09 UTM220 pluto[8635]: | af+type: OAKLEY_LIFE_TYPE
2013:12:04-09:49:09 UTM220 pluto[8635]: | length/value: 1
2013:12:04-09:49:09 UTM220 pluto[8635]: | [1 is OAKLEY_LIFE_SECONDS]
2013:12:04-09:49:09 UTM220 pluto[8635]: | ******parse ISAKMP Oakley attribute:
2013:12:04-09:49:09 UTM220 pluto[8635]: | af+type: OAKLEY_LIFE_DURATION
2013:12:04-09:49:09 UTM220 pluto[8635]: | length/value: 7800
2013:12:04-09:49:09 UTM220 pluto[8635]: | ******parse ISAKMP Oakley attribute:
2013:12:04-09:49:09 UTM220 pluto[8635]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
2013:12:04-09:49:09 UTM220 pluto[8635]: | length/value: 5
2013:12:04-09:49:09 UTM220 pluto[8635]: | [5 is 3DES_CBC]
2013:12:04-09:49:09 UTM220 pluto[8635]: | ******parse ISAKMP Oakley attribute:
2013:12:04-09:49:09 UTM220 pluto[8635]: | af+type: OAKLEY_HASH_ALGORITHM
2013:12:04-09:49:09 UTM220 pluto[8635]: | length/value: 1
2013:12:04-09:49:09 UTM220 pluto[8635]: | [1 is HMAC_MD5]
2013:12:04-09:49:09 UTM220 pluto[8635]: | ******parse ISAKMP Oakley attribute:
2013:12:04-09:49:09 UTM220 pluto[8635]: | af+type: OAKLEY_AUTHENTICATION_METHOD
2013:12:04-09:49:09 UTM220 pluto[8635]: | length/value: 3
2013:12:04-09:49:09 UTM220 pluto[8635]: | [3 is RSA signature]
2013:12:04-09:49:09 UTM220 pluto[8635]: | ******parse ISAKMP Oakley attribute:
2013:12:04-09:49:09 UTM220 pluto[8635]: | af+type: OAKLEY_GROUP_DESCRIPTION
2013:12:04-09:49:09 UTM220 pluto[8635]: | length/value: 5
2013:12:04-09:49:09 UTM220 pluto[8635]: | [5 is MODP_1536]
2013:12:04-09:49:09 UTM220 pluto[8635]: | Oakley Transform 0 accepted
2013:12:04-09:49:09 UTM220 pluto[8635]: | ****emit IPsec DOI SIT:
2013:12:04-09:49:09 UTM220 pluto[8635]: | IPsec DOI SIT: SIT_IDENTITY_ONLY
2013:12:04-09:49:09 UTM220 pluto[8635]: | ****emit ISAKMP Proposal Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NONE
2013:12:04-09:49:09 UTM220 pluto[8635]: | proposal number: 0
2013:12:04-09:49:09 UTM220 pluto[8635]: | protocol ID: PROTO_ISAKMP
2013:12:04-09:49:09 UTM220 pluto[8635]: | SPI size: 0
2013:12:04-09:49:09 UTM220 pluto[8635]: | number of transforms: 1
2013:12:04-09:49:09 UTM220 pluto[8635]: | *****emit ISAKMP Transform Payload (ISAKMP):
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NONE
2013:12:04-09:49:09 UTM220 pluto[8635]: | transform number: 0
2013:12:04-09:49:09 UTM220 pluto[8635]: | transform ID: KEY_IKE
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting 24 raw bytes of attributes into ISAKMP Transform Payload (ISAKMP)
2013:12:04-09:49:09 UTM220 pluto[8635]: | attributes 80 0b 00 01 80 0c 1e 78 80 01 00 05 80 02 00 01
2013:12:04-09:49:09 UTM220 pluto[8635]: | 80 03 00 03 80 04 00 05
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Transform Payload (ISAKMP): 32
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Proposal Payload: 40
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Security Association Payload: 52
2013:12:04-09:49:09 UTM220 pluto[8635]: | out_vendorid(): sending [strongSwan]
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***emit ISAKMP Vendor ID Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_VID
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
2013:12:04-09:49:09 UTM220 pluto[8635]: | V_ID 88 2f e5 6d 6f d2 0d bc 22 51 61 3b 2e be 5b eb
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Vendor ID Payload: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | out_vendorid(): sending [Cisco-Unity]
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***emit ISAKMP Vendor ID Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_VID
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
2013:12:04-09:49:09 UTM220 pluto[8635]: | V_ID 12 f5 f2 8c 45 71 68 a9 70 2d 9f e2 74 cc 01 00
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Vendor ID Payload: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | out_vendorid(): sending [XAUTH]
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***emit ISAKMP Vendor ID Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_VID
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting 8 raw bytes of V_ID into ISAKMP Vendor ID Payload
2013:12:04-09:49:09 UTM220 pluto[8635]: | V_ID 09 00 26 89 df d6 b7 12
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Vendor ID Payload: 12
2013:12:04-09:49:09 UTM220 pluto[8635]: | out_vendorid(): sending [Dead Peer Detection]
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***emit ISAKMP Vendor ID Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_VID
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
2013:12:04-09:49:09 UTM220 pluto[8635]: | V_ID af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Vendor ID Payload: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | out_vendorid(): sending [RFC 3947]
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***emit ISAKMP Vendor ID Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NONE
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
2013:12:04-09:49:09 UTM220 pluto[8635]: | V_ID 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Vendor ID Payload: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Message: 172
2013:12:04-09:49:09 UTM220 pluto[8635]: | inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #2380
2013:12:04-09:49:09 UTM220 pluto[8635]: | next event EVENT_RETRANSMIT in 1 seconds for #2378
2013:12:04-09:49:09 UTM220 pluto[8635]: |
2013:12:04-09:49:09 UTM220 pluto[8635]: | *received 284 bytes from REM.OTE.IP.ADDR:500 on eth1
2013:12:04-09:49:09 UTM220 pluto[8635]: | **parse ISAKMP Message:
2013:12:04-09:49:09 UTM220 pluto[8635]: | initiator cookie:
2013:12:04-09:49:09 UTM220 pluto[8635]: | 64 0d c9 f6 ae 5f 8d 55
2013:12:04-09:49:09 UTM220 pluto[8635]: | responder cookie:
2013:12:04-09:49:09 UTM220 pluto[8635]: | 12 99 3e 11 66 22 5c 07
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_KE
2013:12:04-09:49:09 UTM220 pluto[8635]: | ISAKMP version: ISAKMP Version 1.0
2013:12:04-09:49:09 UTM220 pluto[8635]: | exchange type: ISAKMP_XCHG_IDPROT
2013:12:04-09:49:09 UTM220 pluto[8635]: | flags: none
2013:12:04-09:49:09 UTM220 pluto[8635]: | message ID: 00 00 00 00
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 284
2013:12:04-09:49:09 UTM220 pluto[8635]: | ICOOKIE: 64 0d c9 f6 ae 5f 8d 55
2013:12:04-09:49:09 UTM220 pluto[8635]: | RCOOKIE: 12 99 3e 11 66 22 5c 07
2013:12:04-09:49:09 UTM220 pluto[8635]: | peer: 4d ec ff 9e
2013:12:04-09:49:09 UTM220 pluto[8635]: | state hash entry 14
2013:12:04-09:49:09 UTM220 pluto[8635]: | state object #2380 found, in STATE_MAIN_R1
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP Key Exchange Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NONCE
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 196
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP Nonce Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NAT-D
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP NAT-D Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NAT-D
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP NAT-D Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NONE
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | **emit ISAKMP Message:
2013:12:04-09:49:09 UTM220 pluto[8635]: | initiator cookie:
2013:12:04-09:49:09 UTM220 pluto[8635]: | 64 0d c9 f6 ae 5f 8d 55
2013:12:04-09:49:09 UTM220 pluto[8635]: | responder cookie:
2013:12:04-09:49:09 UTM220 pluto[8635]: | 12 99 3e 11 66 22 5c 07
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_KE
2013:12:04-09:49:09 UTM220 pluto[8635]: | ISAKMP version: ISAKMP Version 1.0
2013:12:04-09:49:09 UTM220 pluto[8635]: | exchange type: ISAKMP_XCHG_IDPROT
2013:12:04-09:49:09 UTM220 pluto[8635]: | flags: none
2013:12:04-09:49:09 UTM220 pluto[8635]: | message ID: 00 00 00 00
2013:12:04-09:49:09 UTM220 pluto[8635]: "S_REF_IpsSitVpntoshop18_0"[1] REM.OTE.IP.ADDR #2380: NAT-Traversal: Result using RFC 3947: no NAT detected
2013:12:04-09:49:09 UTM220 pluto[8635]: | size of DH secret exponent: 1535 bits
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***emit ISAKMP Key Exchange Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NONCE
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting 192 raw bytes of keyex value into ISAKMP Key Exchange Payload
2013:12:04-09:49:09 UTM220 pluto[8635]: | keyex value e2 0b ae 0d ef da 14 23 c9 66 dd 4e d6 f3 65 b2
2013:12:04-09:49:09 UTM220 pluto[8635]: | 4c 04 0f 18 be 47 de fb e0 9e 94 59 41 9c 6c 95
2013:12:04-09:49:09 UTM220 pluto[8635]: | 61 e1 95 da 8c 0c 40 0f 2d ec 4a 98 b4 f5 59 54
2013:12:04-09:49:09 UTM220 pluto[8635]: | 9f 8a 70 d5 06 df e6 ed 26 27 c2 a4 11 8d 98 50
2013:12:04-09:49:09 UTM220 pluto[8635]: | 31 7b 65 cf 3c 51 1b 1b 91 bb 94 90 2e 7e a3 7a
2013:12:04-09:49:09 UTM220 pluto[8635]: | d4 01 e2 53 9f ad 05 5a cf 81 55 61 a7 65 5e ee
2013:12:04-09:49:09 UTM220 pluto[8635]: | 6e 31 a7 f5 f5 5e 88 df 17 f4 a3 ee 00 37 a7 ba
2013:12:04-09:49:09 UTM220 pluto[8635]: | 39 b1 72 07 b5 e0 b6 2e e4 33 10 b5 1b b3 20 66
2013:12:04-09:49:09 UTM220 pluto[8635]: | 62 a5 e4 16 d7 45 91 82 82 e2 ef 56 37 7e 3d 37
2013:12:04-09:49:09 UTM220 pluto[8635]: | fe c0 e8 af d7 47 20 ed 8a 11 d1 92 2d 15 bd 5e
2013:12:04-09:49:09 UTM220 pluto[8635]: | e1 52 4d c8 3d dc 61 a6 8f b3 83 84 08 74 97 63
2013:12:04-09:49:09 UTM220 pluto[8635]: | fa 42 8a dd 3a 96 39 14 43 d1 46 9d e7 a1 6f 38
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Key Exchange Payload: 196
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***emit ISAKMP Nonce Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NAT-D
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting 16 raw bytes of Nr into ISAKMP Nonce Payload
2013:12:04-09:49:09 UTM220 pluto[8635]: | Nr 80 83 5b 09 12 d3 f9 78 16 a9 00 50 c7 30 6d 5d
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Nonce Payload: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | sending NATD payloads
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***emit ISAKMP NAT-D Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NAT-D
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting 16 raw bytes of NAT-D into ISAKMP NAT-D Payload
2013:12:04-09:49:09 UTM220 pluto[8635]: | NAT-D 0e 3a 07 90 ed 48 a4 9b e0 c0 bf 69 5e 46 e9 4f
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP NAT-D Payload: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***emit ISAKMP NAT-D Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NONE
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting 16 raw bytes of NAT-D into ISAKMP NAT-D Payload
2013:12:04-09:49:09 UTM220 pluto[8635]: | NAT-D fb 61 75 61 ae 71 54 6f 7d 90 97 aa 83 d8 47 f1
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP NAT-D Payload: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Message: 284
2013:12:04-09:49:09 UTM220 pluto[8635]: | inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #2380
2013:12:04-09:49:09 UTM220 pluto[8635]: | next event EVENT_RETRANSMIT in 1 seconds for #2378
2013:12:04-09:49:09 UTM220 pluto[8635]: |
2013:12:04-09:49:09 UTM220 pluto[8635]: | *received 180 bytes from REM.OTE.IP.ADDR:500 on eth1
2013:12:04-09:49:09 UTM220 pluto[8635]: | **parse ISAKMP Message:
2013:12:04-09:49:09 UTM220 pluto[8635]: | initiator cookie:
2013:12:04-09:49:09 UTM220 pluto[8635]: | 64 0d c9 f6 ae 5f 8d 55
2013:12:04-09:49:09 UTM220 pluto[8635]: | responder cookie:
2013:12:04-09:49:09 UTM220 pluto[8635]: | 12 99 3e 11 66 22 5c 07
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_ID
2013:12:04-09:49:09 UTM220 pluto[8635]: | ISAKMP version: ISAKMP Version 1.0
2013:12:04-09:49:09 UTM220 pluto[8635]: | exchange type: ISAKMP_XCHG_IDPROT
2013:12:04-09:49:09 UTM220 pluto[8635]: | flags: ISAKMP_FLAG_ENCRYPTION
2013:12:04-09:49:09 UTM220 pluto[8635]: | message ID: 00 00 00 00
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 180
2013:12:04-09:49:09 UTM220 pluto[8635]: | ICOOKIE: 64 0d c9 f6 ae 5f 8d 55
2013:12:04-09:49:09 UTM220 pluto[8635]: | RCOOKIE: 12 99 3e 11 66 22 5c 07
2013:12:04-09:49:09 UTM220 pluto[8635]: | peer: 4d ec ff 9e
2013:12:04-09:49:09 UTM220 pluto[8635]: | state hash entry 14
2013:12:04-09:49:09 UTM220 pluto[8635]: | state object #2380 found, in STATE_MAIN_R2
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP Identification Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_SIG
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 17
2013:12:04-09:49:09 UTM220 pluto[8635]: | ID type: ID_FQDN
2013:12:04-09:49:09 UTM220 pluto[8635]: | DOI specific A: 0
2013:12:04-09:49:09 UTM220 pluto[8635]: | DOI specific B: 0
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***parse ISAKMP Signature Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NONE
2013:12:04-09:49:09 UTM220 pluto[8635]: | length: 132
2013:12:04-09:49:09 UTM220 pluto[8635]: | removing 3 bytes of padding
2013:12:04-09:49:09 UTM220 pluto[8635]: "S_REF_IpsSitVpntoshop18_0"[1] REM.OTE.IP.ADDR #2380: Peer ID is ID_FQDN: 'MAIN.OFFICE.ADDR'
2013:12:04-09:49:09 UTM220 pluto[8635]: "S_REF_IpsSitVpntoshop18_0"[1] REM.OTE.IP.ADDR #2380: signature check for 'MAIN.OFFICE.ADDR' failed: wrong key?; tried 1
2013:12:04-09:49:09 UTM220 pluto[8635]: | public key for 'MAIN.OFFICE.ADDR' failed: decrypted SIG payload into a malformed ECB
2013:12:04-09:49:09 UTM220 pluto[8635]: "S_REF_IpsSitVpntoshop18_0"[1] REM.OTE.IP.ADDR #2380: sending encrypted notification INVALID_KEY_INFORMATION to REM.OTE.IP.ADDR:500
2013:12:04-09:49:09 UTM220 pluto[8635]: | **emit ISAKMP Message:
2013:12:04-09:49:09 UTM220 pluto[8635]: | initiator cookie:
2013:12:04-09:49:09 UTM220 pluto[8635]: | 64 0d c9 f6 ae 5f 8d 55
2013:12:04-09:49:09 UTM220 pluto[8635]: | responder cookie:
2013:12:04-09:49:09 UTM220 pluto[8635]: | 12 99 3e 11 66 22 5c 07
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_HASH
2013:12:04-09:49:09 UTM220 pluto[8635]: | ISAKMP version: ISAKMP Version 1.0
2013:12:04-09:49:09 UTM220 pluto[8635]: | exchange type: ISAKMP_XCHG_INFO
2013:12:04-09:49:09 UTM220 pluto[8635]: | flags: ISAKMP_FLAG_ENCRYPTION
2013:12:04-09:49:09 UTM220 pluto[8635]: | message ID: aa 02 b8 b4
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***emit ISAKMP Hash Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_N
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting 16 zero bytes of HASH into ISAKMP Hash Payload
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Hash Payload: 20
2013:12:04-09:49:09 UTM220 pluto[8635]: | ***emit ISAKMP Notification Payload:
2013:12:04-09:49:09 UTM220 pluto[8635]: | next payload type: ISAKMP_NEXT_NONE
2013:12:04-09:49:09 UTM220 pluto[8635]: | DOI: ISAKMP_DOI_IPSEC
2013:12:04-09:49:09 UTM220 pluto[8635]: | protocol ID: 1
2013:12:04-09:49:09 UTM220 pluto[8635]: | SPI size: 0
2013:12:04-09:49:09 UTM220 pluto[8635]: | Notify Message Type: INVALID_KEY_INFORMATION
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting 0 raw bytes of spi into ISAKMP Notification Payload
2013:12:04-09:49:09 UTM220 pluto[8635]: | spi
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Notification Payload: 12
2013:12:04-09:49:09 UTM220 pluto[8635]: | emitting length of ISAKMP Message: 60
2013:12:04-09:49:09 UTM220 pluto[8635]: | state transition function for STATE_MAIN_R2 failed: INVALID_KEY_INFORMATION
2013:12:04-09:49:09 UTM220 pluto[8635]: | next event EVENT_RETRANSMIT in 1 seconds for #2378
2013:12:04-09:49:10 UTM220 pluto[8635]: |
This thread was automatically locked due to age.
