<div dir="ltr">Hello,<div><br></div><div>I have been trying to establish a reliable IPSEC tunnel between a CISCO SRP527W appliance and a Hosted Ubuntu server 10.04 LTS running Strongswan 4.3.2-1.1ubuntu1.</div><div><br></div>
<div>The Ubuntu server is behind a NAT'ed static Ip provided by the hosting provider . I have provided the necessary port 500 and 4500 port forwards.</div><div><br></div><div>The ipsec.conf configuration is as follows (with relevant IP's disguised):</div>
<div><br></div><div><div>config setup</div><div> plutodebug="control controlmore"</div><div> charondebug="ike 2, knl 3, cfg 0"</div><div> # crlcheckinterval=600</div><div> # strictcrlpolicy=yes</div>
<div> # cachecrls=yes</div><div> nat_traversal=yes</div><div> charonstart=yes</div><div> plutostart=yes</div><div><br></div><div># Add connections here.</div><div>conn %default</div><div> ikelifetime=60m</div>
<div> keylife=20m</div><div> rekeymargin=3m</div><div> keyingtries=1</div><div> keyexchange=ikev1</div><div> authby=psk</div><div> rekey=no</div><div><br></div><div>conn net-net</div>
<div> #local</div><div> left=10.12.89.248</div><div> leftsubnet=<a href="http://10.12.89.0/24">10.12.89.0/24</a></div><div> leftsourceip=<a href="http://10.12.89.0/24">10.12.89.0/24</a></div><div>
leftid=openvpms</div><div> leftfirewall=no</div><div> #</div><div> # Remote</div><div> right=XXX.YYYY.ZZZZ.AAAA</div><div> rightsubnet=<a href="http://192.168.1.0/24">192.168.1.0/24</a></div>
<div> rightsourceip=<a href="http://192.168.1.0/24">192.168.1.0/24</a></div><div> rightid=%any</div><div> auto=add</div><div> #</div><div> # IPSec</div><div> pfs=no</div><div> auth=esp</div>
<div> esp=aes-sha</div><div> ike=aes256-sha-modp1024</div><div> type=tunnel</div></div><div><br></div><div>I am able to initiate a working Ipsec tunnel between the Cisco device and the hosted server and have two way access across the tunnel. This works for a period of time (approx 1 hour) until I believe a rekeyng event is initiated and then the tunnel disconnects and will not re-connect until I restart ipsec on the Ubuntu host.</div>
<div><br></div><div style>On the Cisco device (limited debug information unfortunately) I see a Main Mode IKE failure. In /var/log/authlog I see.</div><div style><br></div><div style><div>May 19 06:39:30 openvpms pluto[28833]: | next event EVENT_NAT_T_KEEPALIVE in 18 seconds</div>
<div>May 19 06:39:30 openvpms pluto[28833]: |</div><div>May 19 06:39:30 openvpms pluto[28833]: | *received 224 bytes from <a href="http://149.135.31.64:500">149.135.31.64:500</a> on eth0</div><div>May 19 06:39:30 openvpms pluto[28833]: packet from XXX.YYYY.ZZZZ.AAAA 500: ignoring Vendor ID payload [4f4543714271574c644b7a41]</div>
<div>May 19 06:39:30 openvpms pluto[28833]: packet from XXX.YYYY.ZZZZ.AAAA 500: received Vendor ID payload [Dead Peer Detection]</div><div>May 19 06:39:30 openvpms pluto[28833]: packet from XXX.YYYY.ZZZZ.AAAA 500: received Vendor ID payload [RFC 3947]</div>
<div>May 19 06:39:30 openvpms pluto[28833]: packet from XXX.YYYY.ZZZZ.AAAA:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]</div><div>May 19 06:39:30 openvpms pluto[28833]: packet from XXX.YYYY.ZZZZ.AAAA:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]</div>
<div>May 19 06:39:30 openvpms pluto[28833]: packet from XXX.YYYY.ZZZZ.AAAA:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]</div><div>May 19 06:39:30 openvpms pluto[28833]: packet from XXX.YYYY.ZZZZ.AAAA:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]</div>
<div>May 19 06:39:30 openvpms pluto[28833]: | preparse_isakmp_policy: peer requests PSK authentication</div><div>May 19 06:39:30 openvpms pluto[28833]: packet from XXX.YYYY.ZZZZ.AAAA 500: initial Main Mode message received on <a href="http://10.12.89.248:500">10.12.89.248:500</a> but no connection has been authorized with policy=PSK</div>
<div><br></div></div><div style>If I turn off NAT-T on the Cisco device the tunnel remains up, I can access the remote network from the Ubuntu server but I am unable to access the Ubuntu server from the remote network.<br>
</div><div style> <br></div><div style>I am sure I have something amiss in my configuration but the logs and my diagnostics have not provided me with any insights into what.</div><div style><br></div><div style>I would greatly appreciate some guidance from anyone on the list who has experienced this issue before.</div>
<div style><br></div><div style>Kind Regards</div><div style>Tony De Keizer</div><div style><br></div></div>