<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-15">
<META content="MSHTML 6.00.2900.5945" name=GENERATOR></HEAD>
<BODY style="MARGIN: 4px 4px 1px; FONT: 10pt Tahoma">
<DIV>Hello,</DIV>
<DIV> </DIV>
<DIV>We are attempting to connect to a Customer, whom will not change their device, it is a Cisco, and their config is the following:</DIV>
<DIV> </DIV>
<DIV>IKE Policies (DO NOT MODIFY)<BR>Parameter ------------------------- Value<BR>Message encryption algorithm ------- Triple-DES<BR>Message integrity (hash) algorithm --- SHA<BR>Peer authentication method ---------- Preshared key <BR>Key exchange parameters ----------- Group 2 (1024-bit)- (Diffie-Hellman group identifier and Perfect Forward Secrecy Group)<BR>ISAKMP established securityassociations lifetime ------------------ 86400 seconds</DIV>
<DIV> </DIV>
<DIV>IPSec Parameters (DO NOT MODIFY)<BR>Parameter ----------------------------- Value<BR>Security-association (SA) establishment - ipsec-isakmp <BR>(IKE)IPSec Mode ---------------------------- Tunnel<BR>Mechanism for payload ----------------- ESP<BR>ESP transform -------------------------- ESP-3DES<BR>Hashed Message Authentication Code -- ESP-SHA-HMAC<BR>Security-association (SA) lifetime ------- 3600 seconds (1hr)<BR></DIV>
<DIV>We have agreed on a pre-shared key (PSK), it is in the ipsec.secrets file.</DIV>
<DIV> </DIV>
<DIV>My side is as follows:</DIV>
<DIV> </DIV>
<DIV>---- ipsec.conf</DIV>
<DIV>config setup<BR> plutodebug=control<BR> # crlcheckinterval=600<BR> # strictcrlpolicy=yes<BR> # cachecrls=yes<BR> # nat_traversal=yes<BR> # charonstart=no<BR> # plutostart=no</DIV>
<DIV> </DIV>
<DIV># Add connections here.</DIV>
<DIV> </DIV>
<DIV>conn Þfault<BR> left=71.5.36.91<BR> <BR>conn one<BR> ## Basic settings<BR> type=tunnel<BR> auto=start<BR> rekey=yes<BR> mobike=no<BR> authby=psk<BR> ## Diffie-Helman group 2 (1024 bits)<BR> pfs=yes<BR> ## IKE settings<BR> # required: 3DES, SHA, DH Group 2 (1024 bits)<BR> # required: Key lifetime 86400s<BR> ike=3des-sha-modp1024<BR> ikelifetime=86400s<BR> ## ESP settings<BR> # required: ESP-3DES, ESP-SHA-HMAC<BR> # required: SA lifetime 3600s<BR> esp=3des-sha<BR> keylife=3600s<BR> ## Host info<BR> leftsubnet=204.153.6.0/24<BR> right=144.168.7.164<BR> rightsubnet=144.151.202.0/24</DIV>
<DIV> </DIV>
<DIV>--- ipsec.secrets</DIV>
<DIV># First connection<BR>71.5.36.91 144.168.7.164: PSK "testFirst"</DIV>
<DIV> </DIV>
<DIV>--- ipsec statusall</DIV>
<DIV>000 interface lo/lo 127.0.0.1:500<BR>000 interface lo/lo 127.0.0.2:500<BR>000 interface eth0/eth0 10.195.1.249:500<BR>000 interface eth1/eth1 71.5.36.91:500<BR>000 interface eth2/eth2 204.153.6.1:500<BR>000 %myid = (none)<BR>000 debug control<BR>000 <BR>000 "one": 204.153.6.0/24===71.5.36.91...144.168.7.164===144.151.202.0/24; unrouted; eroute owner: #0<BR>000 "one": ike_life: 86400s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3<BR>000 "one": policy: PSK+ENCRYPT+TUNNEL+PFS+UP; prio: 24,24; interface: eth1; <BR>000 "one": newest ISAKMP SA: #0; newest IPsec SA: #0; <BR>000 "one": IKE algorithms wanted: 5_000-2-2, <BR>000 "one": IKE algorithms found: 5_192-2_160-2, <BR>000 "one": ESP algorithms wanted: 3_000-2, <BR>000 "one": ESP algorithms loaded: 3_192-2_160, <BR>000 <BR>000 #1: "one" STATE_MAIN_I1 (sent MI1, expecting MR1); EVENT_RETRANSMIT in 14s<BR>000 #1: pending Phase 2 for "att" replacing #0<BR>000 <BR>Performance:<BR> worker threads: 10 idle of 16, job queue load: 0, scheduled events: 0<BR>Listening IP addresses:<BR> 10.195.1.249<BR> 71.5.36.91<BR> 204.153.6.1<BR>Connections:</DIV>
<DIV> </DIV>
<DIV>So, there is something that is not talking. I have turned off the firewall on this box for this testing. So for my side that is not an issue. A packet capture shows only one packet going in each direction. The one coming from them is a NO-PROPOSAL-CHOSEN. </DIV>
<DIV> </DIV>
<DIV>The algorithms statement in the 'ipsec statusall' bothers me also.</DIV>
<DIV> </DIV>
<DIV>Can anyone provide any assistance?</DIV>
<DIV> </DIV>
<DIV>Thanks</DIV>
<DIV> </DIV>
<DIV>Stuart Beckett</DIV>
<DIV> </DIV>
<DIV> </DIV></BODY></HTML>