Hi, I have a central Linux VPN gateway with Debian 5 and Strongswan 4.2.4-5+lenny3 default package(using a fixed IP). I'm trying to connect remote dynamic site-to-site tunnels, using Sonicwall devices behind and adsl router. My problem is that I can only establish one tunnel, after that, the second, third and so on fail to work. This is what I have:<div>
<br></div><div><br></div><div>LAN: 192.168.110.1 <--This tunnel always work</div><div>[Sonicwall TZ 100] dyndnsclient, reporting the WAN IP of the adsl router -- <a href="http://host1.dyndns.org">host1.dyndns.org</a></div>
<meta charset="utf-8"><div>WAN:192.168.1.1</div><div>|</div><div><meta charset="utf-8">LAN:192.168.1.254</div><div>[ADSL Router]</div><div>WAN: Z.Z.Z.Z</div><div>|</div><div>|</div><div>[Strongswan Fixed IP] WAN: 189.X.X.66 LAN: 192.168.100.3<br clear="all">
|</div><div>|</div><div><meta charset="utf-8"><meta charset="utf-8"><div>WAN: Y.Y.Y.Y</div><div>[ADSL Router]</div><div><meta charset="utf-8"><div>LAN:192.168.1.254</div></div><div>|</div><div><meta charset="utf-8"><div>WAN:192.168.1.1</div>
</div><div>[Sonicwall TZ 100] dyndnsclient, reporting the WAN IP of the adsl router -- <a href="http://host2.dyndns.org">host2.dyndns.org</a></div><meta charset="utf-8"><div><meta charset="utf-8"><div>LAN: 192.168.101.1</div>
</div><div><br></div><div>(here I represent 2, but will have about 20 remote dynamic sites)</div><div><br></div><div><br></div><div>This is my ipsec.conf:</div><div>-------------------</div><div><div>config setup</div><div>
<span class="Apple-tab-span" style="white-space:pre"> </span>plutodebug=all</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>klipsdebug=all</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>charondebug=all</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>nat_traversal=yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>charonstart=yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>plutostart=yes</div>
</div><div><br></div><div><div>conn %default</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>type=tunnel</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>leftsubnet=<a href="http://192.168.100.0/24">192.168.100.0/24</a></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>left=189.X.X.66</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>leftnexthop=189.X.X.65</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>leftid=189.X.X.66</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>keyexchange=ikev1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>authby=secret</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>leftsourceip=192.168.100.3</div>
</div><div><br></div><div><div>conn to-one</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auth=esp</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ike=3des-sha1-modp1024,3des-md5-modp1024</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>keyexchange=ikev1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ikelifetime=28800s</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>esp=null-sha1</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>pfs=no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>keyingtries=1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>authby=secret</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>right=<a href="http://host1.dyndns.org">host1.dyndns.org</a></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>rightsubnet=<a href="http://192.168.110.0/24">192.168.110.0/24</a></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>rightid=@<a href="http://host1.dyndns.org">host1.dyndns.org</a></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auto=add</div></div>
<div><br></div><div><div>conn to-two</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auth=esp</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ike=3des-sha1-modp1024,3des-md5-modp1024</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>keyexchange=ikev1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ikelifetime=28800s</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>esp=null-sha1</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>pfs=no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>authby=secret</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>right=<a href="http://host2.dyndns.org">host2.dyndns.org</a></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>rightsubnet=<a href="http://192.168.101.0/24">192.168.101.0/24</a></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>rightid=@<a href="http://host2.dyndns.org">host2.dyndns.org</a></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>auto=add</div></div><div>--------------------</div><div>(i know I shouldn't use null-sha1, i just left it like that in my last attempt, the same error happens with other algorithms)</div>
<div><br></div><div>And my ipsec.secrets:</div><div>--------</div><div><div>@<a href="http://host1.dyndns.org">host1.dyndns.org</a><span class="Apple-tab-span" style="white-space:pre"> </span>189.X.X.66 : PSK "mypsk"</div>
<div>@<a href="http://host2.dyndns.org">host2.dyndns.org</a><span class="Apple-tab-span" style="white-space:pre"> </span>189.X.X.66 : PSK "mypsk"</div></div><div><br></div><div>--------</div><div>Always the tunnel "to-one" works well, it get's established with no problem, but for the other tunnels I get something like:</div>
<div><br></div><div>-------------</div><div><div>Dec 22 01:40:41 vpngdl pluto[3339]: packet from 187.X.X.32:61362: ignoring Vendor ID payload [5b362bc820f60007] <--This ip is from tunnel "to-two"</div><meta charset="utf-8"><div>
Dec 22 01:40:41 vpngdl pluto[3339]: packet from 187.X.X.32:61362: received Vendor ID payload [RFC 3947]</div><div>Dec 22 01:40:41 vpngdl pluto[3339]: packet from 187.X.X.32:61362: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]</div>
<div>Dec 22 01:40:41 vpngdl pluto[3339]: packet from 187.X.X.32:61362: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]</div><div>Dec 22 01:40:41 vpngdl pluto[3339]: | ****parse IPsec DOI SIT:</div><div>Dec 22 01:40:41 vpngdl pluto[3339]: | IPsec DOI SIT: SIT_IDENTITY_ONLY</div>
<div>Dec 22 01:40:41 vpngdl pluto[3339]: | ****parse ISAKMP Proposal Payload:</div><div>Dec 22 01:40:41 vpngdl pluto[3339]: | next payload type: ISAKMP_NEXT_NONE</div><div>Dec 22 01:40:41 vpngdl pluto[3339]: | length: 40</div>
<div>Dec 22 01:40:41 vpngdl pluto[3339]: | proposal number: 1</div><div>Dec 22 01:40:41 vpngdl pluto[3339]: | protocol ID: PROTO_ISAKMP</div><div>Dec 22 01:40:41 vpngdl pluto[3339]: | SPI size: 0</div><div>Dec 22 01:40:41 vpngdl pluto[3339]: | number of transforms: 1</div>
</div><div>[snip]</div><div><div>Dec 22 01:40:41 vpngdl pluto[3339]: packet from 187.X.X.32:61362: initial Main Mode message received on 189.X.X.66:500 but no connection has been authorized with policy=PSK </div></div><div>
---------</div><div><br></div><div>Sounds like it isn't detecting my configuration, but when I restart ipsec both tunnels seems to load correctly:</div><div><br></div><div>-----------</div><div><div>Dec 22 01:39:27 vpngdl pluto[3339]: added connection description "to-one"</div>
<div>Dec 22 01:39:27 vpngdl pluto[3339]: | <a href="http://192.168.100.0/24===189.X.X.66---189.X.X.65...187.X.X.95[@host1.dyndns.org]===192.168.110.0/24">192.168.100.0/24===189.X.X.66---189.X.X.65...187.X.X.95[@host1.dyndns.org]===192.168.110.0/24</a></div>
<div>Dec 22 01:39:27 vpngdl pluto[3339]: | ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 1; policy: PSK+ENCRYPT+TUNNEL</div><div>Dec 22 01:39:27 vpngdl pluto[3339]: | next event EVENT_REINIT_SECRET in 3599 seconds</div>
</div><div>[snip]</div><div><div>Dec 22 01:39:27 vpngdl pluto[3339]: added connection description "to-two"</div><div>Dec 22 01:39:27 vpngdl pluto[3339]: | <a href="http://192.168.100.0/24===189.X.X.66---189.X.X.65...187.Z.Z.32[@host2.dyndns.org]===192.168.101.0/24">192.168.100.0/24===189.X.X.66---189.X.X.65...187.Z.Z.32[@host2.dyndns.org]===192.168.101.0/24</a></div>
<div>Dec 22 01:39:27 vpngdl pluto[3339]: | ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3; policy: PSK+ENCRYPT+TUNNEL</div><div>Dec 22 01:39:27 vpngdl pluto[3339]: | next event EVENT_REINIT_SECRET in 3599 seconds</div>
</div><div>------------</div><div><br></div><div>And no matter what order I use in ipsec.conf and ipsec.secrets, tunnel one always works and the others don't, even restarting the strongswan server. The VPN options in the sonicwall side is configured identical (changing hosts and left/right, of course) in all remote/dynamic points. I've tried with 3 remote sites with similar setup, but always tunnel one is established and the rest don't.</div>
<div><br></div><meta charset="utf-8"><div>Can the problem be that all the adsl routers use the same lan class to connect to the firewall? (192.168.1.x)</div><div>Any idea about what can be happening or how to solve it?</div>
<div><br></div><div>Regards</div><br>Omar<br>
</div>