<HTML><HEAD>
<STYLE id=eMClientCss>BLOCKQUOTE.cite {
PADDING-LEFT: 10px; MARGIN-LEFT: 5px; BORDER-LEFT: #cccccc 1px solid; PADDING-RIGHT: 0px; MARGIN-RIGHT: 0px
}
BLOCKQUOTE.cite2 {
PADDING-TOP: 0px; PADDING-LEFT: 10px; MARGIN-LEFT: 5px; BORDER-LEFT: #cccccc 1px solid; MARGIN-TOP: 3px; PADDING-RIGHT: 0px; MARGIN-RIGHT: 0px
}
.plain PRE {
FONT-SIZE: 100%; FONT-FAMILY: monospace; FONT-WEIGHT: normal; FONT-STYLE: normal
}
.plain TT {
FONT-SIZE: 100%; FONT-FAMILY: monospace; FONT-WEIGHT: normal; FONT-STYLE: normal
}
#b5e1a3c5335645dba1dbc479324e7090 {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
.plain PRE {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
.plain TT {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
BODY {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
</STYLE>
</HEAD>
<BODY>
<DIV><FONT size=2>Hi everyone,<BR></FONT></DIV>
<DIV><FONT size=2>i've been banging my heads against this issue for several days and i cannot establish connection with VPN server (Centos/Strongswan v5.1.2) from my Android phone using IPSec Xauth RSA (ikev1) connection type. I tried various tutorials but the problem remains the same. Have no problem connecting from iPhone (ikev1) and Android (ikev2).<BR><BR>I am getting "invalid HASH_V1 payload length, decryption failed?" error<BR></DIV></FONT><FONT size=2></FONT>
<DIV><FONT size=2>This is the configuration for the strongswan connection</FONT></DIV>
<DIV><BR><FONT size=2>ipsec.conf:</FONT></DIV>
<DIV><FONT size=2>conn %default<BR> ikelifetime=60m<BR> keylife=20m<BR> rekeymargin=3m<BR> keyingtries=1</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><BR><FONT size=2>conn android_IPSec_ikev1<BR> keyexchange=ikev1<BR> left=%defaultroute<BR> leftsubnet=0.0.0.0/0<BR> leftcert=serverCert.pem<BR> leftfirewall=yes<BR> right=%any<BR> rightsourceip=10.255.0.0/24<BR> rightdns=212.59.1.1<BR> rightauth=pubkey<BR> rightauth2=xauth<BR> auto=add</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>ipsec.secret</FONT></DIV><FONT size=2>: RSA serverKey.pem<BR>kemeris : XAUTH "pass1"</FONT>
<DIV> </DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>error.log</FONT></DIV>
<DIV><FONT size=2>Apr 8 11:31:32 s1 charon: 11[NET] received packet: from 10.0.0.11[500] to 78.60.3.52[500] (476 bytes)<BR>Apr 8 11:31:32 s1 charon: 11[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V ]<BR>Apr 8 11:31:32 s1 charon: 11[IKE] received NAT-T (RFC 3947) vendor ID<BR>Apr 8 11:31:32 s1 charon: 11[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID<BR>Apr 8 11:31:32 s1 charon: 11[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID<BR>Apr 8 11:31:32 s1 charon: 11[IKE] received draft-ietf-ipsec-nat-t-ike-00 vendor ID<BR>Apr 8 11:31:32 s1 charon: 11[IKE] received XAuth vendor ID<BR>Apr 8 11:31:32 s1 charon: 11[IKE] received Cisco Unity vendor ID<BR>Apr 8 11:31:32 s1 charon: 11[IKE] received FRAGMENTATION vendor ID<BR>Apr 8 11:31:32 s1 charon: 11[IKE] received DPD vendor ID<BR>Apr 8 11:31:32 s1 charon: 11[IKE] 10.0.0.11 is initiating a Main Mode IKE_SA<BR>Apr 8 11:31:32 s1 charon: 11[ENC] generating ID_PROT response 0 [ SA V V V ]<BR>Apr 8 11:31:32 s1 charon: 11[NET] sending packet: from 78.60.3.52[500] to 10.0.0.11[500] (136 bytes)<BR>Apr 8 11:31:32 s1 charon: 10[NET] received packet: from 10.0.0.11[500] to 78.60.3.52[500] (228 bytes)<BR>Apr 8 11:31:32 s1 charon: 10[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]<BR>Apr 8 11:31:32 s1 charon: 10[IKE] sending cert request for "C=LT, S=Vilniaus m., L=Vilnius, O=Zeusman MB, CN=vpn.zeusman.lt"<BR>Apr 8 11:31:32 s1 charon: 10[ENC] generating ID_PROT response 0 [ KE No CERTREQ NAT-D NAT-D ]<BR>Apr 8 11:31:32 s1 charon: 10[NET] sending packet: from 78.60.3.52[500] to 10.0.0.11[500] (350 bytes)<BR>Apr 8 11:31:32 s1 charon: 12[NET] received packet: from 10.0.0.11[500] to 78.60.3.52[500] (1228 bytes)<BR>Apr 8 11:31:32 s1 charon: 12[ENC] parsed ID_PROT request 0 [ ID CERT SIG ]<BR>Apr 8 11:31:32 s1 charon: 12[IKE] received end entity cert "C=GB, O=Zeusman MB, CN=Tadas Blinda"<BR>Apr 8 11:31:32 s1 charon: 12[CFG] looking for XAuthInitRSA peer configs matching 78.60.3.52...10.0.0.11[C=GB, O=Zeusman MB, CN=Tadas Blinda]<BR>Apr 8 11:31:32 s1 charon: 12[CFG] selected peer config "ios_IPSec_ikev1"<BR>Apr 8 11:31:32 s1 charon: 12[CFG] using trusted ca certificate "C=LT, S=Vilniaus m., L=Vilnius, O=Zeusman MB, CN=vpn.zeusman.lt"<BR>Apr 8 11:31:32 s1 charon: 12[CFG] checking certificate status of "C=GB, O=Zeusman MB, CN=Tadas Blinda"<BR>Apr 8 11:31:32 s1 charon: 12[CFG] certificate status is not available<BR>Apr 8 11:31:32 s1 charon: 12[CFG] reached self-signed root ca with a path length of 0<BR>Apr 8 11:31:32 s1 charon: 12[CFG] using trusted certificate "C=GB, O=Zeusman MB, CN=Tadas Blinda"<BR>Apr 8 11:31:32 s1 charon: 12[IKE] authentication of 'C=GB, O=Zeusman MB, CN=Tadas Blinda' with RSA successful<BR>Apr 8 11:31:32 s1 charon: 12[IKE] authentication of 'C=LT, S=Vilniaus m., L=Vilnius, O=Zeusman MB, CN=vpn.zeusman.lt' (myself) successful<BR>Apr 8 11:31:32 s1 charon: 12[ENC] generating ID_PROT response 0 [ ID SIG ]<BR>Apr 8 11:31:32 s1 charon: 12[NET] sending packet: from 78.60.3.52[500] to 10.0.0.11[500] (412 bytes)<BR>Apr 8 11:31:32 s1 charon: 12[ENC] generating TRANSACTION request 3632658472 [ HASH CPRQ(X_USER X_PWD) ]<BR>Apr 8 11:31:32 s1 charon: 12[NET] sending packet: from 78.60.3.52[500] to 10.0.0.11[500] (76 bytes)<BR>Apr 8 11:31:32 s1 charon: 13[NET] received packet: from 10.0.0.11[500] to 78.60.3.52[500] (92 bytes)<BR>Apr 8 11:31:32 s1 charon: 13[ENC] invalid HASH_V1 payload length, decryption failed?<BR>Apr 8 11:31:32 s1 charon: 13[ENC] could not decrypt payloads<BR>Apr 8 11:31:32 s1 charon: 13[IKE] message parsing failed<BR>Apr 8 11:31:32 s1 charon: 13[IKE] ignore malformed INFORMATIONAL request<BR>Apr 8 11:31:32 s1 charon: 13[IKE] INFORMATIONAL_V1 request with message ID 2246676801 processing failed<BR>Apr 8 11:31:35 s1 charon: 15[NET] received packet: from 10.0.0.11[500] to 78.60.3.52[500] (1228 bytes)<BR>Apr 8 11:31:35 s1 charon: 15[IKE] received retransmit of request with ID 0, retransmitting response<BR>Apr 8 11:31:35 s1 charon: 15[NET] sending packet: from 78.60.3.52[500] to 10.0.0.11[500] (412 bytes)<BR>Apr 8 11:31:35 s1 charon: 05[NET] received packet: from 10.0.0.11[500] to 78.60.3.52[500] (92 bytes)<BR>Apr 8 11:31:35 s1 charon: 05[ENC] invalid HASH_V1 payload length, decryption failed?<BR>Apr 8 11:31:35 s1 charon: 05[ENC] could not decrypt payloads<BR>Apr 8 11:31:35 s1 charon: 05[IKE] message parsing failed<BR>Apr 8 11:31:35 s1 charon: 05[IKE] ignore malformed INFORMATIONAL request</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><SPAN class=325464116-21032011><SPAN class=325464116-21032011><FONT size=2>Is there something I did wrong? </FONT></SPAN></SPAN></DIV>
<DIV><SPAN class=325464116-21032011><SPAN class=325464116-21032011><SPAN id=fdcdbd68b022459db775473e0436092a><SPAN id=b5e1a3c5335645dba1dbc479324e7090>
<DIV><SPAN class=325464116-21032011><SPAN class=325464116-21032011><SPAN class=st><FONT size=2>Please bear in mind that I am a newbie </FONT></SPAN></SPAN></SPAN></SPAN></SPAN><FONT size=2>:)</FONT></SPAN></SPAN></DIV></DIV>
<DIV>
<DIV><PRE><FONT size=2 face=Tahoma>Thanks,</FONT></PRE><FONT size=2>kemeris</FONT></DIV></DIV></BODY></HTML>