[VPN] FreeSWAN CA 2.02 x PIX - Trouble in phase 2
Jean-Francois Dive
jef at linuxbe.org
Tue Sep 30 07:02:10 EDT 2003
you dont see the answer from the PIX, sounds like the problem is in the
PIX or freeswan side p2 parameter negociation. I would have expected the
PIX to send back an informational message. Send us the PIX log's /
config related to IPSec. Check that the selector (proxy identities in
cisco terms) do match properly.
JeF
On Sun, 2003-09-28 at 01:22, Alberto Fabiano wrote:
> Mrs,
>
> After an exhausting research for Google and reading of several materials,
> the conclusion that I am needing help urgently arrive! : -)
>
> I have a FreeSWan CA 2.02 and am trying to stablish a tunnel with a PIX
> through 3DES, MD5, IKE dh 2, using PSK the some days and am not I obtaining
> success in the phase 2 of IPSec, will it be that anybody could feel a help?
>
> In an initial moment, I got to close VPN (phase 1 and 2) and I made some
> tests without a lot of headaches, but now, I don't know because am not
> getting more to close.
>
> It follows the parts of my ipsec.conf below, whack status and related to
> this tunnel.
>
>
> # cat /var/chroot-ipsec/etc/ipsec.conf
>
> #
> # Default Configuration File for FreeS/WAN IPSEC
> #
>
> config setup
> interfaces="ipsec0=eth0"
> klipsdebug=none
> plutodebug=all
> dumpdir=
> manualstart=
> fragicmp=no
> packetdefault=drop
> hidetos=yes
> uniqueids=yes
> overridemtu=16260
> nocrsend=yes
> nat_traversal=yes
> keep_alive=60
>
> conn %default
> rekeymargin=9m
> rekeyfuzz=100%
> keyingtries=0
>
> conn VPN_5
> type=tunnel
> keyexchange=ike
> pfsgroup=modp1024
> pfs=yes
> auto=start
> authby=secret
> ike=3des-md5-modp1024
> esp=3des-md5-96
> keylife=28800
> ikelifetime=2880
> compress=no
> left=192.168.1.22
> leftsubnet=192.168.1.5/255.255.255.255
> leftnexthop=10.10.1.119
> right=10.10.18.143
> rightsubnet=10.10.18.146/255.255.255.255
> rightnexthop=10.10.38.10
> leftupdown="/opt/_updown 2>/tmp/log 1>/tmp/log"
> rightupdown="/opt/_updown 2>/tmp/log 1>/tmp/log"
> leftid=192.168.1.22
> rightid=10.10.18.143
>
>
> # chroot /var/chroot-ipsec/ /usr/local/lib/ipsec/whack --status
>
> 000 interface ipsec0/eth0 192.168.1.22
> 000 interface ipsec0/eth0 192.168.1.22
> 000
> 000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64, keysizemin=168,
> keysizemax=168
> 000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5,
> keysizemin=128,keysizemax=128
> 000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1,
> keysizemin=160, keysizemax=160
> 000
> 000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
> 000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
> 000
> 000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,6,36}
> trans={0,6,96} attrs={0,6,160}
> 000
>
> 000 "VPN_5":
> 192.168.1.5/32===192.168.1.22---10.10.1.119...10.10.38.10---10.10.18.143===1
> 0.10.18.146/32
> 000 "VPN_5": ike_life: 2880s; ipsec_life: 28800s; rekey_margin: 540s;
> rekey_fuzz: 100%; keyingtries: 0
> 000 "VPN_5": policy: PSK+ENCRYPT+TUNNEL+PFS; interface: eth0; trap erouted
> 000 "VPN_5": newest ISAKMP SA: #1; newest IPsec SA: #0; eroute owner: #0
> 000 "VPN_5": IKE algorithms wanted: 5_000-1-2, flags=-strict
> 000 "VPN_5": IKE algorithms found: 5_192-1_128-2,
> 000 "VPN_5": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024
> 000 "VPN_5": ESP algorithms wanted: 3_000-1, ; pfsgroup=2; flags=strict
> 000 "VPN_5": ESP algorithms loaded: 3_168-1_128,
> 000
> 000 #6: "VPN_5" STATE_QUICK_I1 (sent QI1, expecting QR1); EVENT_RETRANSMIT
> in 4s
> 000 #1: "VPN_5" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in
> 1673s; newest ISAKMP
> 000
>
>
> Awaiting help for my problem...
>
> Thanks for all!!!
> - Kind Regards.
>
>
>
> Alberto Fabiano Caires de Medeiros
> --------------------------------------------------------------------------
> e-mail: alberto at combat.com.br
> --------------------------------------------------------------------------
>
>
> -----BEGIN PGP PUBLIC KEY BLOCK-----
>
> mQGiBD9spjwRBACQ2aQEqcQyGxaoNX4Zvk/9v6fCxyPWAcBQSSiPjJyi3cXa9kLB
> XsQjdgBY90x45wFwI0QwneWFCP364YZXdo7ZRPiLjI+qV6expjCIIm/LXi1LphwK
> 6l87HYbm74a2T6mdxRmxhCrgsA+ezSCEkMA9YolPw2r+ufvp59IrrYHrcwCg5aTW
> LbsbVQ2i+beAfpFPw8muW1kEAINssb8RXbilwIL6k7ZPbHQghkTIM7iIK5eGwMOx
> lYtmzoA2tCzJla0tp9G1ls2hW12d6io80P5jbYpx+17nhPV49oVA6yKGJNCaTAzi
> uyRxUYOYhSyS8PXxOPp600NGJ8qiX53JEPKPLxoiF/HG6EWihEIDFqvI11mIEcfi
> WFTDA/0SKjjkKt+S1fk42AbnE39pz1Kn6av2hYz00DX4XensZcnmmcbA1eO0a+TP
> foTl0x2ipHN7eymcVudDVU6fbQu18SJa+rSutW3GBmreRDi0NQ4vilCAVueyQpVP
> WS/jnOcw+uQp2PRkY8ylKxIOcgQZqy56jCEcbFH/eTxTfqA6c7REQWxiZXJ0byBG
> YWJpYW5vIENhaXJlcyBkZSBNZWRlaXJvcyAoazRsMXBzMCkgPGFsYmVydG9AY29t
> YmF0LmNvbS5icj6IWwQTEQIAGwUCP2ymPAYLCQgHAwIDFQIDAxYCAQIeAQIXgAAK
> CRDlbFd4k92tdCi4AJ9EyxOlZMrAdINGlB6GBs9/jG3omwCfdLbqML4sXLCMoXU/
> dJNLLC+lBSK5AQ0EP2ymQBAEAL5xjfRLFgxBVEiBK3Kr+1y75euY5nKC8H0CJy93
> w0YTB2E3DMVNFBX6woj7jnoW5+F+/a0+iVfOgkHWeGbvE7ZghCphrb4AOa2j3DHA
> eP2GNQarNEqP1v3RYa8e7WNEUx/RVnhxeW7XMsX7ylGx9e8QTTwAEFFc3gUoiYTn
> 2ljrAAMFA/4gDsxYp68UWniwzSCFgq16a6ATscTF45aPq0ROkUepWIMKY2/X/FQc
> e4FMSzRWC38fKILrkxhoaWIx1r2MFUiQtk3ItdXSDh5u2D/U+nHQqhYcgqjTzsfK
> 659HXw5GzmzbpueKymD6wsU1uYf9sq7dYxqQBJMleNB6vZi+ODZmRYhGBBgRAgAG
> BQI/bKZAAAoJEOVsV3iT3a1098cAn0BnS7NFu98qLc7XQL//rBh94EqzAJ9KGwCF
> K15S/3LqsNGqQEMRdzdQaw==
> =R5pw
> -----END PGP PUBLIC KEY BLOCK-----
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.521 / Virus Database: 319 - Release Date: 23/9/2003
>
> _______________________________________________
> VPN mailing list
> VPN at lists.shmoo.com
> http://lists.shmoo.com/mailman/listinfo/vpn
--
-> Jean-Francois Dive
--> jef at linuxbe.org
I think that God in creating Man somewhat overestimated his ability.
-- Oscar Wilde
More information about the VPN
mailing list