<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>Hi,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-US>while trying to connect to a watchguard, the watchguard log shows the following message:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'>Process 3rd Msg (AM): failed to process hash payload<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>It’s an aggressive mode connection and the first message is sent successfully and a reply is received. When strongswan sends it’s second message to the watchguard, the watchguard log shows the above message (log see below).<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>I have verified the connection with two other clients (vpnc, which gets stuck during xauth) and shrew soft windows clients (which succeeds with the connection) and everything looks the same. The only difference I can see is that the other clients sends more NAT-T VID payloads.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Could it be that the hash is really miscalculated?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Any idea how to track down this issue?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Thanks & Regards<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Gerald<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>charon: 16[IKE] initiating Aggressive Mode IKE_SA iosn[1] to 1.2.3.4 <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>charon: 16[ENC] generating AGGRESSIVE request 0 [ SA KE No ID V V V V V ] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>charon: 16[NET] sending packet: from 10.11.12.75[500] to 1.2.3.4[500] (410 bytes) <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>charon: 05[NET] received packet: from 1.2.3.4[500] to 10.11.12.75[500] (360 bytes) <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>charon: 05[ENC] parsed AGGRESSIVE response 0 [ SA KE No ID V V NAT-D NAT-D V HASH ] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>charon: 05[IKE] received DPD vendor ID <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>charon: 05[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>charon: 05[IKE] received XAuth vendor ID <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>charon: 05[IKE] local host is behind NAT, sending keep alives <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>charon: 05[ENC] generating AGGRESSIVE request 0 [ NAT-D NAT-D HASH ] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>charon: 05[NET] sending packet: from 10.11.12.75[4500] to 1.2.3.4[4500] (108 bytes) <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>charon: 04[NET] received packet: from 1.2.3.4[4500] to 10.11.12.75[4500] (360 bytes) <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>charon: 04[IKE] received retransmit of response with ID 0, resending last request <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>charon: 04[NET] sending packet: from 10.11.12.75[4500] to 1.2.3.4[4500] (108 bytes)<o:p></o:p></span></p></div></body></html>