<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div></div><div><br></div><br><div><div>On 21 Apr 2011, at 13:25, neil payne wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div>Hi Andreas, </div><div>We're now running version 4.5.1 on the leftfirewall (downgraded from the one below). We are using the same config files as the ones I sent last night but on the left firewall it doesn't recognize the net-net connection:</div><div><br></div><div><div>ubuntu@ip-10-5-51-61:/etc$ sudo ipsec --version</div><div>sudo: unable to resolve host ip-10-5-51-61</div><div>Linux strongSwan U4.5.1/K2.6.32-312-ec2</div><div>Institute for Internet Technologies and Applications</div><div>University of Applied Sciences Rapperswil, Switzerland</div><div>See 'ipsec --copyright' for copyright information.</div><div>ubuntu@ip-10-5-51-61:/etc$ </div><div>ubuntu@ip-10-5-51-61:/etc$ </div><div>ubuntu@ip-10-5-51-61:/etc$ </div><div>ubuntu@ip-10-5-51-61:/etc$ </div><div><font class="Apple-style-span" color="#FF584E">ubuntu@ip-10-5-51-61:/etc$ sudo ipsec up net-net</font></div><div><font class="Apple-style-span" color="#FF584E">sudo: unable to resolve host ip-10-5-51-61</font></div><div><font class="Apple-style-span" color="#FF584E">021 no connection named "net-net"</font></div><div>ubuntu@ip-10-5-51-61:/etc$ </div></div><div><br></div><div><br></div><div>If I use ipsec up net-net on the rightfirewall running 4.3.2 it does generate IKE packets which reach the leftfirewall but the left firewall doesn't recognize it and logs:</div><div><br></div><div><div>Apr 21 12:10:15 ip-10-5-51-61 pluto[16057]: packet from 50.56.121.20:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]</div><div>Apr 21 12:10:15 ip-10-5-51-61 pluto[16057]: packet from 50.56.121.20:500: <font class="Apple-style-span" color="#3A58FA">initial Main Mode message received on 10.5.51.61:500 but no connection has been authorized with policy=PSK</font></div></div><div><br></div><div>Regards,</div><div>Neil.</div><div><br></div><div><br></div><br><div><div>On 20 Apr 2011, at 22:43, neil payne wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Hi Andreas,<br>No! <br>In fact I didn't know this was the ignition key.<br>Unfortunately my colleague upgraded to strongswan 4.5.2dr5 on my prompting on one of the firewalls and now ipsec wont start - i get the following messages in auth.log:<br><br>Apr 20 21:32:06 ip-10-5-51-61 ipsec_starter[21851]: pluto has died -- restart scheduled (5sec)<br>Apr 20 21:32:06 ip-10-5-51-61 ipsec_starter[21851]: pluto refused to be started<br>Apr 20 21:32:06 ip-10-5-51-61 ipsec_starter[21851]: charon has died -- restart scheduled (5sec)<br>Apr 20 21:32:06 ip-10-5-51-61 ipsec_starter[21851]: charon refused to be started<br>Apr 20 21:32:11 ip-10-5-51-61 ipsec_starter[21851]: pluto has died -- restart scheduled (5sec)<br>Apr 20 21:32:11 ip-10-5-51-61 ipsec_starter[21851]: pluto refused to be started<br>Apr 20 21:32:11 ip-10-5-51-61 ipsec_starter[21851]: charon has died -- restart scheduled (5sec)<br>Apr 20 21:32:11 ip-10-5-51-61 ipsec_starter[21851]: charon refused to be started<br>Apr 20 21:32:16 ip-10-5-51-61 ipsec_starter[21851]: pluto has died -- restart scheduled (5sec)<br>Apr 20 21:32:16 ip-10-5-51-61 ipsec_starter[21851]: pluto refused to be started<br>Apr 20 21:32:16 ip-10-5-51-61 ipsec_starter[21851]: charon has died -- restart scheduled (5sec)<br>Apr 20 21:32:16 ip-10-5-51-61 ipsec_starter[21851]: charon refused to be started<br>Apr 20 21:32:21 ip-10-5-51-61 ipsec_starter[21851]: pluto has died -- restart scheduled (5sec)<br>Apr 20 21:32:21 ip-10-5-51-61 ipsec_starter[21851]: pluto refused to be started<br><br>I fear that we didn't need this upgrade and my configs may have worked with the standard release if I'd known about this start command.<br>Would you recommend uninstalling this release or are the errors recoverable?<br>Thank you very much for your time and attention.<br>Regards,<br>Neil.<br><br><br>On 20 Apr 2011, at 20:43, Andreas Steffen wrote:<br><br><blockquote type="cite">Hi Neil,<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">are you starting the connection explicitly with<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> ipsec up net-net<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">on one of the two peers?<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Regards<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Andreas<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">On 20.04.2011 19:56, neil payne wrote:<br></blockquote><blockquote type="cite"><blockquote type="cite">Hi Andreas, I amended my syntax on ipsec.secrets as you suggested<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">(may be change crypto algos later) but i still see no ike packets<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">generated by the firewall on either side when i try and ping the<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">remote encryption domain. Is my config missing something, i don't<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">know how i'm going wrong here but surely it is something fundamental<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">missing, I cannot tell as I've followed the available documentation<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">as best as I can? I'm getting desperate for a solution now.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Thanks, Neil<br></blockquote></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">======================================================================<br></blockquote><blockquote type="cite">Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br></blockquote><blockquote type="cite">strongSwan - the Linux VPN Solution! <a href="http://www.strongswan.org/">www.strongswan.org</a><br></blockquote><blockquote type="cite">Institute for Internet Technologies and Applications<br></blockquote><blockquote type="cite">University of Applied Sciences Rapperswil<br></blockquote><blockquote type="cite">CH-8640 Rapperswil (Switzerland)<br></blockquote><blockquote type="cite">===========================================================[ITA-HSR]==<br></blockquote><br></div></blockquote></div><br></div></blockquote></div><br></div></blockquote></div><br></body></html>