<pre><font size="2">Hi All,<b><br> </b>I<b> </b>am trying to establish an IPsec connection between two hosts..i choose host-host(transport mode) for set up..<br> i have done the needed configuration for this setup and i start IPsec.<br>
<br>but some error has been occured as show below while i execute <b>"ipsec up sample-self-signed".</b>And sometimes i got error like<br><b>Asynchronous network error for eth0</b><br><b><br></b>Kindly help me.....<b><br>
<br>ipsec up sample-self-signed</b><br><br>[root@INFCH02598 ~]# ipsec up sample-self-signed<br>002 "sample-self-signed" #8: initiating Main Mode<br>104 "sample-self-signed" #8: STATE_MAIN_I1: initiate<br>
003 "sample-self-signed" #8: received Vendor ID payload [strongSwan]<br>003 "sample-self-signed" #8: received Vendor ID payload [XAUTH]<br>003 "sample-self-signed" #8: received Vendor ID payload [Dead Peer Detection]<br>
106 "sample-self-signed" #8: STATE_MAIN_I2: sent MI2, expecting MR2<br>002 "sample-self-signed" #8: we don't have a cert<br>108 "sample-self-signed" #8: STATE_MAIN_I3: sent MI3, expecting MR3<br>
003 "sample-self-signed" #8: ignoring informational payload, type INVALID_KEY_INFORMATION<br>010 "sample-self-signed" #8: STATE_MAIN_I3: retransmission; will wait 20s for response<br>003 "sample-self-signed" #8: next payload type of ISAKMP Hash Payload has an unknown value: 254<br>
003 "sample-self-signed" #8: malformed payload in packet<br>003 "sample-self-signed" #8: discarding duplicate packet; already STATE_MAIN_I3<br>010 "sample-self-signed" #8: STATE_MAIN_I3: retransmission; will wait 40s for response<br>
003 "sample-self-signed" #8: next payload type of ISAKMP Hash Payload has an unknown value: 24<br>003 "sample-self-signed" #8: malformed payload in packet<br>003 "sample-self-signed" #8: discarding duplicate packet; already STATE_MAIN_I3<br>
031 "sample-self-signed" #8: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message<br>000 "sample-self-signed" #8: starting keying attempt 2 of at most 3, but releasing whack<br>
<br><br><b>ipsec statusall</b><br><br>000 Status of IKEv1 pluto daemon (strongSwan 4.4.0):<br>000 interface lo/lo ::1:500<br>000 interface lo/lo <a href="http://127.0.0.1:500">127.0.0.1:500</a><br>000 interface eth0/eth0 <a href="http://172.29.23.110:500">172.29.23.110:500</a><br>
000 %myid = '%any'<br>000 loaded plugins: aes des sha1 md5 sha2 hmac gmp random pem pkcs1 <br>000 debug options: control<br>000 <br>000 "sample-self-signed": 172.29.23.110[C=IN, O=LNT, CN=INFCH02598]...172.29.23.146[C=IN, O=LNT, CN=INFCH00889]; unrouted; eroute owner: #0<br>
000 "sample-self-signed": ike_life: 10800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3<br>000 "sample-self-signed": policy: PUBKEY+ENCRYPT+TUNNEL+PFS+UP; prio: 32,32; interface: eth0; <br>
000 "sample-self-signed": newest ISAKMP SA: #0; newest IPsec SA: #0; <br>000 <br>000 #12: "sample-self-signed" STATE_MAIN_I3 (sent MI3, expecting MR3); EVENT_RETRANSMIT in 25s<br>000 #12: pending Phase 2 for "sample-self-signed" replacing #0<br>
000 #11: "sample-self-signed" STATE_MAIN_R2 (sent MR2, expecting MI3); EVENT_RETRANSMIT in 6s<br>000 <br><br><b>ip xfrm policy</b><br><br>[root@INFCH02598 ~]# ip xfrm policy<br>src ::/0 dst ::/0 <br> dir in priority 0 ptype main <br>
src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> <br> dir in priority 0 ptype main <br>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> <br>
dir in priority 0 ptype main <br>src ::/0 dst ::/0 <br> dir out priority 0 ptype main <br>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> <br> dir out priority 0 ptype main <br>
src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> <br> dir out priority 0 ptype main <br><br><br>Thanks in advance<br><br>Regards<br>Dhanavel<br></font></pre>