<p class="MsoNormal">I’m having an issue with getting strongswan to complete its
phase2 authorization with our Cisco ASA… I’ve tried about 20 different
combinations of the IKE/ESP encryption types with no luck, and the same issue
occurs during the MAIN_I2 stage.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">If anyone can offer any assistance or guidance it would be
greatly appreciated!</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">========PLUTO ERROR LOG========</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">| inserting event EVENT_RETRANSMIT, timeout in 40 seconds
for #3</p>
<p class="MsoNormal">| next event EVENT_RETRANSMIT in 40 seconds for #3</p>
<p class="MsoNormal">|</p>
<p class="MsoNormal">| *received 68 bytes from xxx.xxx.xxx.xxx:500 on eth0</p>
<p class="MsoNormal">| a4 39 4a 95 51 b7 93 b0 16 06 2a
8d e7 0e c9 79</p>
<p class="MsoNormal">| 0b 10 05 00 00 00 00 00 00 00 00
44 00 00 00 28</p>
<p class="MsoNormal">| 00 00 00 01 00 00 00 04 b0 12 3d
04 98 12 22 05</p>
<p class="MsoNormal">| 01 00 00 00 03 00 00 00 04 00 00
00 84 81 07 01</p>
<p class="MsoNormal">| ec 62 aa 0c</p>
<p class="MsoNormal">| **parse ISAKMP Message:</p>
<p class="MsoNormal">| initiator cookie:</p>
<p class="MsoNormal">| a4 39 4a 95 51 b7 93 b0</p>
<p class="MsoNormal">| responder cookie:</p>
<p class="MsoNormal">| 16 06 2a 8d e7 0e c9 79</p>
<p class="MsoNormal">| next payload type: ISAKMP_NEXT_N</p>
<p class="MsoNormal">| ISAKMP version: ISAKMP Version 1.0</p>
<p class="MsoNormal">| exchange type: ISAKMP_XCHG_INFO</p>
<p class="MsoNormal">| flags: none</p>
<p class="MsoNormal">| message ID: 00 00 00 00</p>
<p class="MsoNormal">| length: 68</p>
<p class="MsoNormal">| ICOOKIE: a4 39 4a 95 51 b7 93 b0</p>
<p class="MsoNormal">| RCOOKIE: 16 06 2a 8d e7 0e c9 79</p>
<p class="MsoNormal">| peer: 48 03 f2 47</p>
<p class="MsoNormal">| state hash entry 1</p>
<p class="MsoNormal">| state object #3 found, in STATE_MAIN_I2</p>
<p class="MsoNormal">"cisco-asa" #3: Informational Exchange message
must be encrypted</p>
<p class="MsoNormal">| next event EVENT_RETRANSMIT in 40 seconds for #3</p>
<p class="MsoNormal">|</p>
<p class="MsoNormal">| *time to handle event</p>
<p class="MsoNormal">| event after this is EVENT_REINIT_SECRET in 3390 seconds</p>
<p class="MsoNormal">| handling event EVENT_RETRANSMIT for xxx.xxx.xxx.xxx
"cisco-asa" #3</p>
<p class="MsoNormal">"cisco-asa" #3: max number of retransmissions (2)
reached STATE_MAIN_I2</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">========IPSEC.CONF========</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">config setup</p>
<p class="MsoNormal"> plutodebug=all</p>
<p class="MsoNormal"> #
crlcheckinterval=600</p>
<p class="MsoNormal"> #
strictcrlpolicy=yes</p>
<p class="MsoNormal"> # cachecrls=yes</p>
<p class="MsoNormal"> nat_traversal=yes</p>
<p class="MsoNormal"> charonstart=no</p>
<p class="MsoNormal"> # plutostart=no</p>
<p class="MsoNormal"> plutostderrlog=/var/log/pluto.log</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">conn cisco-asa</p>
<p class="MsoNormal"> type=tunnel</p>
<p class="MsoNormal">
left=%defaultroute</p>
<p class="MsoNormal"> leftid=@GROUPID</p>
<p class="MsoNormal">
right=xxx.xxx.xxx.xxx</p>
<p class="MsoNormal">
rightsourceip=%dhcp</p>
<p class="MsoNormal">
rightnexthop=%defaultroute</p>
<p class="MsoNormal">
rightsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></p>
<p class="MsoNormal"> xauth=client</p>
<p class="MsoNormal"> authby=xauthpsk</p>
<p class="MsoNormal"> ike=3des</p>
<p class="MsoNormal"> esp=3des-sha</p>
<p class="MsoNormal"> pfs=no</p>
<p class="MsoNormal"> auto=start</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">========IPSEC.SECRETS========</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">: PSK "groupid-secret"</p>
<p class="MsoNormal">xxx.xxx.xxx.xxx username : XAUTH "password"</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">========CISCO ASA CONFIG========</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">crypto ipsec transform-set connset esp-3des esp-sha-hmac</p>
<p class="MsoNormal">crypto dynamic-map conn 90 set transform-set connset</p>
<p class="MsoNormal">crypto map connmap 8 match address 104</p>
<p class="MsoNormal">crypto map connmap 8 set peer xxx.xxx.xxx.xxx </p>
<p class="MsoNormal">crypto map connmap 8 set transform-set connset</p>
<p class="MsoNormal">crypto map connmap 10000 ipsec-isakmp dynamic conn</p>
<p class="MsoNormal">crypto map connmap interface outside</p>
<p class="MsoNormal">crypto isakmp identity address </p>
<p class="MsoNormal">crypto isakmp enable outside</p>
<p class="MsoNormal">crypto isakmp policy 10</p>
<p class="MsoNormal"> authentication pre-share</p>
<p class="MsoNormal"> encryption 3des</p>
<p class="MsoNormal"> hash sha</p>
<p class="MsoNormal"> group 2</p>
<p class="MsoNormal"> lifetime 86400</p>
<p class="MsoNormal">crypto isakmp nat-traversal 20</p><div style="margin: 0pt;" name="sig_bc903d36d0"></div>