<div dir="ltr">Thank Alex<div>It works</div><div><div class="" style="font-size:12.8000001907349px"><table cellpadding="0" class=""><tbody><tr class=""><td class="" style="width:232px"><table cellpadding="0" class="" style="width:232px"><tbody><tr><td><h3 class=""><span name="st41ker" class="" style="font-size:12.8000001907349px">st41ker</span></h3></td></tr></tbody></table></td><td class=""><div class=""><span id=":nk" class="" title="Fri, Jul 17, 2015 at 1:17 AM" alt="Fri, Jul 17, 2015 at 1:17 AM">1:17 AM (9 hours ago)</span><div class="" tabindex="0" style="outline:0px"><span class=""><img class="" src="https://mail.google.com/mail/u/0/images/cleardot.gif" alt=""></span></div></div></td><td class=""></td><td class="" rowspan="2"><div class="" tabindex="0"><img class="" src="https://mail.google.com/mail/u/0/images/cleardot.gif" alt=""></div><div id=":nw" class="" tabindex="0"><img class="" src="https://mail.google.com/mail/u/0/images/cleardot.gif" alt=""></div></td></tr><tr class=""><td colspan="3"><table cellpadding="0" class="" style="width:396px"><tbody><tr><td class=""><div class=""><span class="">to <span dir="ltr" name="me" class="">me</span></span></div><div class=""><img class="" id=":nv" src="https://mail.google.com/mail/u/0/images/cleardot.gif" alt=""></div></td></tr></tbody></table></td></tr></tbody></table></div><div class="" style="font-size:medium"></div><div class="" style="font-size:medium"></div><div class="" style="font-size:medium"></div><div id=":nu" tabindex="-1" style="font-size:medium"></div><div id=":ni" class="" style="font-size:12.8000001907349px"><div id=":nh" class="" style="overflow:hidden"><div>Hello, Tom.</div><div> </div><div>Seems like there is misconfiguration on server. Both sides in IKEv1 MUST have the same IDs (in this case Traffic Selectors, or networks) configured.</div><div> </div><div>If you have <span style="font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;font-weight:inherit;line-height:inherit"><a href="http://10.3.1.0/255.255" target="_blank">10.3.1.0/255.255</a>.</span><span style="font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;font-weight:inherit;line-height:inherit">255.0</span> on one side then you must have exactly the same network configured on the other side.</div><div> </div><div>You can not use <span style="font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;font-weight:inherit;line-height:inherit"><a href="http://10.3.1.0/255.255" target="_blank">10.3.1.0/255.255</a>.</span><span style="font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;font-weight:inherit;line-height:inherit">255.0</span> on the client and leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> on the server side (as it can be for IKEv2), for example.</div><div> </div></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jul 15, 2015 at 8:23 PM, Tom Hu <span dir="ltr"><<a href="mailto:pleasetalktome@gmail.com" target="_blank">pleasetalktome@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>hi all</div><div><br></div><div><span style="color:rgb(80,0,80);font-size:12.8000001907349px">I used strongswan as GW and cisco vpn as client (not anyconnect) on Windows 7 to test interoperbility using RSA authentication</span><br style="color:rgb(80,0,80);font-size:12.8000001907349px"><span style="color:rgb(80,0,80);font-size:12.8000001907349px">After entered username/password on client xauth, getting the error</span><font color="#500050"><span style="font-size:12.8000001907349px">"Unable to validate the responder ID, ID=<a href="http://10.3.1.0/255.255.255.0" target="_blank">10.3.1.0/255.255.255.0</a> Protocol=0 port=0, the peer sent" </span></font><span style="color:rgb(80,0,80);font-size:12.8000001907349px"> </span><span style="color:rgb(80,0,80);font-size:12.8000001907349px">from cisco client </span><br></div><div><br></div><div>The config of GW</div><div>config setup<br></div><div><div><br></div><div>conn %default</div><div> ikelifetime=60m</div><div> keylife=20m</div><div> rekeymargin=3m</div><div> keyingtries=5</div><div> mobike=no</div><div> keyexchange=ike</div><div> #dpdaction=clear</div><div> #dpddelay=2s</div><div><br></div><div>include /etc/ipsec.cert.conf</div></div><div><br></div><div><div># cat ipsec.cert.conf</div><div><br></div><div>conn cert</div><div> type=tunnel</div><div> auto=add</div><div> esp=aes128-sha1!</div><div> ike=aes128-sha1-modp1024!</div><div> left=192.168.11.55</div><div> right=%any</div><div> leftauth=pubkey</div><div> rightauth=pubkey</div><div> rightauth2=xauth</div><div> leftsubnet=<a href="http://10.3.1.0/24" target="_blank">10.3.1.0/24</a></div><div> rightid=%any</div><div> rightsourceip=<a href="http://10.3.0.0/28" target="_blank">10.3.0.0/28</a></div><div> leftcert=cert.pem</div><div>#</div></div><div><br></div>cisco vpn client log:<div><br><div><div>Cisco Systems VPN Client Version 5.0.07.0440</div><div>Copyright (C) 1998-2010 Cisco Systems, Inc. All Rights Reserved.</div><div>Client Type(s): Windows, WinNT</div><div>Running on: 6.1.7600 </div><div><br></div><div>374 18:08:23.093 07/15/15 Sev=Info/6<span style="white-space:pre-wrap"> </span>CERT/0x63600026</div><div>Attempting to find a Certificate using Serial Hash.</div><div><br></div><div>375 18:08:23.123 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>CM/0x63100002</div><div>Begin connection process</div><div><br></div><div>376 18:08:23.093 07/15/15 Sev=Info/6<span style="white-space:pre-wrap"> </span>CERT/0x63600027</div><div>Found a Certificate using Serial Hash.</div><div><br></div><div>377 18:08:23.139 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>CM/0x63100004</div><div>Establish secure connection</div><div><br></div><div>378 18:08:23.096 07/15/15 Sev=Info/6<span style="white-space:pre-wrap"> </span>CERT/0x63600026</div><div>Attempting to find a Certificate using Serial Hash.</div><div><br></div><div>379 18:08:23.139 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>CM/0x63100024</div><div>Attempt connection with server "192.168.11.55"</div><div><br></div><div>380 18:08:23.097 07/15/15 Sev=Info/6<span style="white-space:pre-wrap"> </span>CERT/0x63600027</div><div>Found a Certificate using Serial Hash.</div><div><br></div><div>381 18:08:23.143 07/15/15 Sev=Info/6<span style="white-space:pre-wrap"> </span>IKE/0x6300003B</div><div>Attempting to establish a connection with 192.168.11.55.</div><div><br></div><div>382 18:08:23.101 07/15/15 Sev=Info/6<span style="white-space:pre-wrap"> </span>CERT/0x63600026</div><div>Attempting to find a Certificate using Serial Hash.</div><div><br></div><div>383 18:08:23.154 07/15/15 Sev=Info/6<span style="white-space:pre-wrap"> </span>CERT/0x63600026</div><div>Attempting to find a Certificate using Serial Hash.</div><div><br></div><div>384 18:08:23.101 07/15/15 Sev=Info/6<span style="white-space:pre-wrap"> </span>CERT/0x63600027</div><div>Found a Certificate using Serial Hash.</div><div><br></div><div>385 18:08:23.155 07/15/15 Sev=Info/6<span style="white-space:pre-wrap"> </span>CERT/0x63600027</div><div>Found a Certificate using Serial Hash.</div><div><br></div><div>386 18:08:23.120 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>CERT/0x63600015</div><div>Cert (cn=vpn3,ou=Dev,o=IBM,st=CA,c=US) verification succeeded.</div><div><br></div><div>387 18:08:23.167 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000001</div><div>Starting IKE Phase 1 Negotiation</div><div><br></div><div>388 18:08:23.167 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000013</div><div>SENDING >>> ISAKMP OAK MM (SA, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to 192.168.11.55</div><div><br></div><div>389 18:08:23.169 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IPSEC/0x63700008</div><div>IPSec driver successfully started</div><div><br></div><div>390 18:08:23.170 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IPSEC/0x63700014</div><div>Deleted all keys</div><div><br></div><div>391 18:08:23.170 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x6300002F</div><div>Received ISAKMP packet: peer = 192.168.11.55</div><div><br></div><div>392 18:08:23.170 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000014</div><div>RECEIVING <<< ISAKMP OAK MM (SA, VID(Xauth), VID(dpd), VID(Unity), VID(Nat-T)) from 192.168.11.55</div><div><br></div><div>393 18:08:23.178 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x63000001</div><div>Peer supports XAUTH</div><div><br></div><div>394 18:08:23.178 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x63000001</div><div>Peer supports DPD</div><div><br></div><div>395 18:08:23.178 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x63000001</div><div>Peer is a Cisco-Unity compliant peer</div><div><br></div><div>396 18:08:23.178 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x63000001</div><div>Peer supports NAT-T</div><div><br></div><div>397 18:08:23.178 07/15/15 Sev=Info/6<span style="white-space:pre-wrap"> </span>IKE/0x63000001</div><div>IOS Vendor ID Contruction successful</div><div><br></div><div>398 18:08:23.178 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000013</div><div>SENDING >>> ISAKMP OAK MM (KE, NON, NAT-D, NAT-D, VID(?), VID(Unity)) to 192.168.11.55</div><div><br></div><div>399 18:08:23.183 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x6300002F</div><div>Received ISAKMP packet: peer = 192.168.11.55</div><div><br></div><div>400 18:08:23.183 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000014</div><div>RECEIVING <<< ISAKMP OAK MM (KE, NON, CERT_REQ, NAT-D, NAT-D) from 192.168.11.55</div><div><br></div><div>401 18:08:23.239 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000013</div><div>SENDING >>> ISAKMP OAK MM *(ID, CERT, CERT_REQ, SIG, NOTIFY:STATUS_INITIAL_CONTACT) to 192.168.11.55</div><div><br></div><div>402 18:08:23.243 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x6300002F</div><div>Received ISAKMP packet: peer = 192.168.11.55</div><div><br></div><div>403 18:08:23.243 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000014</div><div>RECEIVING <<< ISAKMP OAK MM *(ID, CERT, SIG) from 192.168.11.55</div><div><br></div><div>404 18:08:23.249 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>CERT/0x63600015</div><div>Cert (cn=vpn4,ou=Dev,o=IBM,st=CA,c=US) verification succeeded.</div><div><br></div><div>405 18:08:23.250 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000083</div><div>IKE Port in use - Local Port = 0xE900, Remote Port = 0x01F4</div><div><br></div><div>406 18:08:23.250 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x63000072</div><div>Automatic NAT Detection Status:</div><div> Remote end is NOT behind a NAT device</div><div> This end is NOT behind a NAT device</div><div><br></div><div>407 18:08:23.250 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>CM/0x6310000E</div><div>Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system</div><div><br></div><div>408 18:08:23.250 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x6300002F</div><div>Received ISAKMP packet: peer = 192.168.11.55</div><div><br></div><div>409 18:08:23.250 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000014</div><div>RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 192.168.11.55</div><div><br></div><div>410 18:08:23.250 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>CM/0x63100015</div><div>Launch xAuth application</div><div><br></div><div>411 18:08:25.250 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x6300002F</div><div>Received ISAKMP packet: peer = 192.168.11.55</div><div><br></div><div>412 18:08:25.251 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000014</div><div>RECEIVING <<< ISAKMP OAK TRANS *(Retransmission) from 192.168.11.55</div><div><br></div><div>413 18:08:27.257 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x6300002F</div><div>Received ISAKMP packet: peer = 192.168.11.55</div><div><br></div><div>414 18:08:27.257 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000014</div><div>RECEIVING <<< ISAKMP OAK TRANS *(Retransmission) from 192.168.11.55</div><div><br></div><div>415 18:08:29.258 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x6300002F</div><div>Received ISAKMP packet: peer = 192.168.11.55</div><div><br></div><div>416 18:08:29.258 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000014</div><div>RECEIVING <<< ISAKMP OAK TRANS *(Retransmission) from 192.168.11.55</div><div><br></div><div>417 18:08:30.056 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>CM/0x63100017</div><div>xAuth application returned</div><div><br></div><div>418 18:08:30.056 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000013</div><div>SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 192.168.11.55</div><div><br></div><div>419 18:08:30.094 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x6300002F</div><div>Received ISAKMP packet: peer = 192.168.11.55</div><div><br></div><div>420 18:08:30.094 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000014</div><div>RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 192.168.11.55</div><div><br></div><div>421 18:08:30.094 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000013</div><div>SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 192.168.11.55</div><div><br></div><div>422 18:08:30.094 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>CM/0x6310000E</div><div>Established Phase 1 SA. 1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system</div><div><br></div><div>423 18:08:30.097 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x6300005E</div><div>Client sending a firewall request to concentrator</div><div><br></div><div>424 18:08:30.097 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000013</div><div>SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 192.168.11.55</div><div><br></div><div>425 18:08:30.098 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x6300002F</div><div>Received ISAKMP packet: peer = 192.168.11.55</div><div><br></div><div>426 18:08:30.098 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000014</div><div>RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 192.168.11.55</div><div><br></div><div>427 18:08:30.098 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x63000010</div><div>MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 10.3.0.1</div><div><br></div><div>428 18:08:30.099 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>CM/0x63100019</div><div>Mode Config data received</div><div><br></div><div>429 18:08:30.125 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000056</div><div>Received a key request from Driver: Local IP = 10.3.0.1, GW IP = 192.168.11.55, Remote IP = 0.0.0.0</div><div><br></div><div>430 18:08:30.126 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000013</div><div>SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 192.168.11.55</div><div><br></div><div>431 18:08:30.128 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x6300002F</div><div>Received ISAKMP packet: peer = 192.168.11.55</div><div><br></div><div>432 18:08:30.128 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000014</div><div>RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID) from 192.168.11.55</div><div><br></div><div><span style="background-color:rgb(255,0,0)">433 18:08:30.128 07/15/15 Sev=Warning/3<span style="white-space:pre-wrap"> </span>IKE/0xE3000060</span></div><div><span style="background-color:rgb(255,0,0)">Unable to validate the responder ID, ID=<a href="http://10.3.1.0/255.255.255.0" target="_blank">10.3.1.0/255.255.255.0</a> Protocol=0 port=0, the peer sent</span></div><div><br></div><div>434 18:08:30.128 07/15/15 Sev=Warning/2<span style="white-space:pre-wrap"> </span>IKE/0xE300009B</div><div>Failed to process ID payload (MsgHandler:681)</div><div><br></div><div>435 18:08:30.128 07/15/15 Sev=Warning/2<span style="white-space:pre-wrap"> </span>IKE/0xE300009B</div><div>Failed to process QM Msg 2 (NavigatorQM:455)</div><div><br></div><div>436 18:08:30.128 07/15/15 Sev=Warning/2<span style="white-space:pre-wrap"> </span>IKE/0xE30000A7</div><div>Unexpected SW error occurred while processing Quick Mode negotiator:(Navigator:2263)</div><div><br></div><div>437 18:08:30.128 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000013</div><div>SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 192.168.11.55</div><div><br></div><div>438 18:08:30.128 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000049</div><div>Discarding IPsec SA negotiation, MsgID=A8BAAF56</div><div><br></div><div>439 18:08:30.233 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IPSEC/0x63700014</div><div>Deleted all keys</div><div><br></div><div>440 18:08:40.373 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000013</div><div>SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to 192.168.11.55</div><div><br></div><div>441 18:08:40.374 07/15/15 Sev=Info/6<span style="white-space:pre-wrap"> </span>IKE/0x6300003D</div><div>Sending DPD request to 192.168.11.55, our seq# = 234858457</div><div><br></div><div>442 18:08:40.375 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x6300002F</div><div>Received ISAKMP packet: peer = 192.168.11.55</div><div><br></div><div>443 18:08:40.375 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000014</div><div>RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from 192.168.11.55</div><div><br></div><div>444 18:08:40.375 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x63000040</div><div>Received DPD ACK from 192.168.11.55, seq# received = 234858457, seq# expected = 234858457</div><div><br></div><div>445 18:08:50.513 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000013</div><div>SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to 192.168.11.55</div><div><br></div><div>446 18:08:50.514 07/15/15 Sev=Info/6<span style="white-space:pre-wrap"> </span>IKE/0x6300003D</div><div>Sending DPD request to 192.168.11.55, our seq# = 234858458</div><div><br></div><div>447 18:08:50.515 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x6300002F</div><div>Received ISAKMP packet: peer = 192.168.11.55</div><div><br></div><div>448 18:08:50.515 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000014</div><div>RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from 192.168.11.55</div><div><br></div><div>449 18:08:50.515 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>IKE/0x63000040</div><div>Received DPD ACK from 192.168.11.55, seq# received = 234858458, seq# expected = 234858458</div><div><br></div><div>450 18:09:00.160 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000017</div><div>Marking IKE SA for deletion (I_Cookie=9E9978E0D95B4917 R_Cookie=613A22AF838F7C54) reason = DEL_REASON_PEER_NOT_RESPONDING</div><div><br></div><div>451 18:09:00.160 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000013</div><div>SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 192.168.11.55</div><div><br></div><div>452 18:09:01.168 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x6300004B</div><div>Discarding IKE SA negotiation (I_Cookie=9E9978E0D95B4917 R_Cookie=613A22AF838F7C54) reason = DEL_REASON_PEER_NOT_RESPONDING</div><div><br></div><div>453 18:09:01.168 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>CM/0x63100012</div><div>Phase 1 SA deleted before first Phase 2 SA is up cause by "DEL_REASON_PEER_NOT_RESPONDING". 0 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system</div><div><br></div><div>454 18:09:01.168 07/15/15 Sev=Info/5<span style="white-space:pre-wrap"> </span>CM/0x63100025</div><div>Initializing CVPNDrv</div><div><br></div><div>455 18:09:01.172 07/15/15 Sev=Info/6<span style="white-space:pre-wrap"> </span>CM/0x63100046</div><div>Set tunnel established flag in registry to 0.</div><div><br></div><div>456 18:09:01.172 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IKE/0x63000001</div><div>IKE received signal to terminate VPN connection</div><div><br></div><div>457 18:09:01.177 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IPSEC/0x63700014</div><div>Deleted all keys</div><div><br></div><div>458 18:09:01.177 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IPSEC/0x63700014</div><div>Deleted all keys</div><div><br></div><div>459 18:09:01.178 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IPSEC/0x63700014</div><div>Deleted all keys</div><div><br></div><div>460 18:09:01.178 07/15/15 Sev=Info/4<span style="white-space:pre-wrap"> </span>IPSEC/0x6370000A</div><div>IPSec driver successfully stopped</div><div><br></div></div><div>the strongswan log <div><br></div><div><div><div># cat /var/log/charon.log</div><div>18:24:19 00[DMN] Starting IKE charon daemon (strongSwan 5.2.2, Linux 2.6.32-</div><div><br></div><div>220.17.1.142.bos_dove_72.x86_64.VPN-APP-S5_SN_DOVE, x86_64)</div><div>18:24:19 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'</div><div>18:24:19 00[CFG] loaded ca certificate "C=US, ST=CA, L=San, O=IBM, OU=Dev, CN=CA1" from </div><div><br></div><div>'/etc/ipsec.d/cacerts/ca.pem'</div><div>18:24:19 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'</div><div>18:24:19 00[LIB] opening directory '/etc/ipsec.d/aacerts' failed: No such file or directory</div><div>18:24:19 00[CFG] reading directory failed</div><div>18:24:19 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'</div><div>18:24:19 00[LIB] opening directory '/etc/ipsec.d/ocspcerts' failed: No such file or directory</div><div>18:24:19 00[CFG] reading directory failed</div><div>18:24:19 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'</div><div>18:24:19 00[LIB] opening directory '/etc/ipsec.d/acerts' failed: No such file or directory</div><div>18:24:19 00[CFG] reading directory failed</div><div>18:24:19 00[CFG] loading crls from '/etc/ipsec.d/crls'</div><div>18:24:19 00[LIB] opening directory '/etc/ipsec.d/crls' failed: No such file or directory</div><div>18:24:19 00[CFG] reading directory failed</div><div>18:24:19 00[CFG] loading secrets from '/etc/ipsec.secrets'</div><div>18:24:19 00[CFG] loaded RSA private key from '/etc/ipsec.d/private/key.pem'</div><div>18:24:19 00[CFG] loaded 1 RADIUS server configuration</div><div>18:24:19 00[LIB] loaded plugins: charon aes des sha1 sha2 md4 md5 pem pkcs1 gmp random nonce </div><div><br></div><div>xauth-pam x509 revocation hmac xcbc stroke kernel-netlink socket-default fips-prf eap-mschapv2 </div><div><br></div><div>eap-md5 eap-tls eap-identity eap-radius updown</div><div>18:24:19 00[LIB] unable to load 12 plugin features (12 due to unmet dependencies)</div><div>18:24:19 00[JOB] spawning 16 worker threads</div><div>18:24:19 06[CFG] received stroke: add connection 'cert'</div><div>18:24:19 06[CFG] adding virtual IP address pool <a href="http://10.3.0.0/28" target="_blank">10.3.0.0/28</a></div><div>18:24:19 06[CFG] loaded certificate "C=US, ST=CA, O=IBM, OU=Dev, CN=vpn4" from 'cert.pem'</div><div>18:24:19 06[CFG] added configuration 'cert'</div><div>18:24:34 08[NET] received packet: from 192.168.11.4[59640] to 192.168.11.55[500] (1160 bytes)</div><div>18:24:34 08[ENC] parsed ID_PROT request 0 [ SA V V V V V ]</div><div>18:24:34 08[IKE] received XAuth vendor ID</div><div>18:24:34 08[IKE] received DPD vendor ID</div><div>18:24:34 08[IKE] received FRAGMENTATION vendor ID</div><div>18:24:34 08[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID</div><div>18:24:34 08[IKE] received Cisco Unity vendor ID</div><div>18:24:34 08[IKE] 192.168.11.4 is initiating a Main Mode IKE_SA</div><div>18:24:34 08[ENC] generating ID_PROT response 0 [ SA V V V V ]</div><div>18:24:34 08[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59640] (160 bytes)</div><div>18:24:34 09[NET] received packet: from 192.168.11.4[59640] to 192.168.11.55[500] (288 bytes)</div><div>18:24:34 09[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D V V ]</div><div>18:24:34 09[ENC] received unknown vendor ID: 20:7f:78:d5:92:7b:32:88:21:6d:a6:10:54:6b:75:e5</div><div>18:24:34 09[IKE] received Cisco Unity vendor ID</div><div>18:24:34 09[IKE] sending cert request for "C=US, ST=CA, L=San, O=IBM, OU=Dev, CN=CA1"</div><div>18:24:34 09[ENC] generating ID_PROT response 0 [ KE No CERTREQ NAT-D NAT-D ]</div><div>18:24:34 09[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59640] (333 bytes)</div><div>18:24:35 10[NET] received packet: from 192.168.11.4[59640] to 192.168.11.55[500] (1692 bytes)</div><div>18:24:35 10[ENC] parsed ID_PROT request 0 [ ID CERT CERTREQ SIG N(INITIAL_CONTACT) ]</div><div>18:24:35 10[IKE] received cert request for 'C=US, ST=CA, L=San, O=IBM, OU=Dev, CN=CA1'</div><div>18:24:35 10[IKE] received end entity cert "C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3"</div><div>18:24:35 10[CFG] looking for XAuthInitRSA peer configs matching 192.168.11.55...192.168.11.4</div><div><br></div><div>[C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3]</div><div>18:24:35 10[CFG] selected peer config "cert"</div><div>18:24:35 10[CFG] using certificate "C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3"</div><div>18:24:35 10[CFG] using trusted ca certificate "C=US, ST=CA, L=San, O=IBM, OU=Dev, CN=CA1"</div><div>18:24:35 10[CFG] checking certificate status of "C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3"</div><div>18:24:35 10[CFG] certificate status is not available</div><div>18:24:35 10[CFG] reached self-signed root ca with a path length of 0</div><div>18:24:35 10[IKE] authentication of 'C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3' with RSA successful</div><div>18:24:35 10[IKE] authentication of '192.168.11.55' (myself) successful</div><div>18:24:35 10[IKE] sending end entity cert "C=US, ST=CA, O=IBM, OU=Dev, CN=vpn4"</div><div>18:24:35 10[ENC] generating ID_PROT response 0 [ ID CERT SIG ]</div><div>18:24:35 10[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59640] (1516 bytes)</div><div>18:24:35 10[ENC] generating TRANSACTION request 1437880664 [ HASH CPRQ(X_USER X_PWD) ]</div><div><span style="background-color:rgb(255,0,0)">18:24:35 10[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59640] (76 bytes)</span></div><div><span style="background-color:rgb(255,0,0)">18:24:37 11[IKE] sending retransmit 1 of request message ID 1437880664, seq 1</span></div><div><span style="background-color:rgb(255,0,0)">18:24:37 11[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59640] (76 bytes)</span></div><div><span style="background-color:rgb(255,0,0)">18:24:39 12[IKE] sending retransmit 2 of request message ID 1437880664, seq 1</span></div><div><span style="background-color:rgb(255,0,0)">18:24:39 12[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59640] (76 bytes)</span></div><div><span style="background-color:rgb(255,0,0)">18:24:41 13[IKE] sending retransmit 3 of request message ID 1437880664, seq 1</span></div><div><span style="background-color:rgb(255,0,0)">18:24:41 13[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59640] (76 bytes)</span></div><div><span style="background-color:rgb(255,0,0)">18:24:43 14[IKE] sending retransmit 4 of request message ID 1437880664, seq 1</span></div><div><span style="background-color:rgb(255,0,0)">18:24:43 14[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59640] (76 bytes)</span></div><div><span style="background-color:rgb(255,0,0)">18:24:45 15[IKE] sending retransmit 5 of request message ID 1437880664, seq 1</span></div><div><span style="background-color:rgb(255,0,0)">18:24:45 15[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59640] (76 bytes)</span></div><div><span style="background-color:rgb(255,0,0)">18:24:47 16[IKE] giving up after 5 retransmits</span></div><div><span style="background-color:rgb(255,0,0)">----- failed retry-----</span></div><div><span style="background-color:rgb(255,0,0)">18:24:47 16[IKE] peer not responding, trying again (2/5)</span></div><div>18:24:47 16[IKE] initiating Main Mode IKE_SA cert[1] to %any</div><div>18:24:47 16[ENC] generating ID_PROT request 0 [ SA V V V V V ]</div><div>18:24:47 16[NET] sending packet: from 192.168.11.55[500] to 0.0.0.0[500] (176 bytes)</div><div>18:24:47 05[NET] received packet: from 192.168.11.55[500] to 192.168.11.55[500] (176 bytes)</div><div>18:24:47 05[ENC] parsed ID_PROT response 0 [ SA V V V V V ]</div><div>18:24:47 05[IKE] received XAuth vendor ID</div><div>18:24:47 05[IKE] received DPD vendor ID</div><div>18:24:47 05[IKE] received Cisco Unity vendor ID</div><div>18:24:47 05[IKE] received NAT-T (RFC 3947) vendor ID</div><div>18:24:47 05[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID</div><div>18:24:47 05[ENC] generating ID_PROT request 0 [ KE No NAT-D NAT-D ]</div><div>18:24:47 05[NET] sending packet: from 192.168.11.55[500] to 192.168.11.55[500] (244 bytes)</div><div>18:24:47 07[NET] received packet: from 192.168.11.55[500] to 192.168.11.55[500] (244 bytes)</div><div>18:24:47 07[ENC] parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]</div><div>18:24:47 07[IKE] sending cert request for "C=US, ST=CA, L=San, O=IBM, OU=Dev, CN=CA1"</div><div>18:24:47 07[IKE] authentication of '192.168.11.55' (myself) successful</div><div>18:24:47 07[IKE] sending end entity cert "C=US, ST=CA, O=IBM, OU=Dev, CN=vpn4"</div><div>18:24:47 07[ENC] generating ID_PROT request 0 [ ID CERT SIG CERTREQ ]</div><div>18:24:47 07[NET] sending packet: from 192.168.11.55[500] to 192.168.11.55[500] (1612 bytes)</div><div>18:24:47 06[NET] received packet: from 192.168.11.55[500] to 192.168.11.55[500] (1612 bytes)</div><div>18:24:47 06[ENC] invalid ID_V1 payload length, decryption failed?</div><div>18:24:47 06[ENC] could not decrypt payloads</div><div>18:24:47 06[IKE] message parsing failed</div><div>18:24:47 06[ENC] generating INFORMATIONAL_V1 request 1677057335 [ HASH N(PLD_MAL) ]</div><div>18:24:47 06[NET] sending packet: from 192.168.11.55[500] to 192.168.11.55[500] (76 bytes)</div><div>18:24:47 06[IKE] ID_PROT response with message ID 0 processing failed</div><div>18:24:47 08[NET] received packet: from 192.168.11.55[500] to 192.168.11.55[500] (76 bytes)</div><div>18:24:47 08[ENC] parsed INFORMATIONAL_V1 request 1677057335 [ HASH N(PLD_MAL) ]</div><div>18:24:47 08[IKE] received PAYLOAD_MALFORMED error notify</div><div>18:27:42 15[NET] received packet: from 192.168.11.4[59648] to 192.168.11.55[500] (1160 bytes)</div><div>18:27:42 15[ENC] parsed ID_PROT request 0 [ SA V V V V V ]</div><div>18:27:42 15[IKE] received XAuth vendor ID</div><div>18:27:42 15[IKE] received DPD vendor ID</div><div>18:27:42 15[IKE] received FRAGMENTATION vendor ID</div><div>18:27:42 15[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID</div><div>18:27:42 15[IKE] received Cisco Unity vendor ID</div><div>18:27:42 15[IKE] 192.168.11.4 is initiating a Main Mode IKE_SA</div><div>18:27:42 15[ENC] generating ID_PROT response 0 [ SA V V V V ]</div><div>18:27:42 15[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59648] (160 bytes)</div><div>18:27:42 16[NET] received packet: from 192.168.11.4[59648] to 192.168.11.55[500] (288 bytes)</div><div>18:27:42 16[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D V V ]</div><div>18:27:42 16[ENC] received unknown vendor ID: 6b:5e:df:fd:d9:5a:49:17:3b:24:e1:32:64:cc:c0:e7</div><div>18:27:42 16[IKE] received Cisco Unity vendor ID</div><div>18:27:42 16[IKE] sending cert request for "C=US, ST=CA, L=San, O=IBM, OU=Dev, CN=CA1"</div><div>18:27:42 16[ENC] generating ID_PROT response 0 [ KE No CERTREQ NAT-D NAT-D ]</div><div>18:27:42 16[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59648] (333 bytes)</div><div>18:27:42 05[NET] received packet: from 192.168.11.4[59648] to 192.168.11.55[500] (1692 bytes)</div><div>18:27:42 05[ENC] parsed ID_PROT request 0 [ ID CERT CERTREQ SIG N(INITIAL_CONTACT) ]</div><div>18:27:42 05[IKE] received cert request for 'C=US, ST=CA, L=San, O=IBM, OU=Dev, CN=CA1'</div><div>18:27:42 05[IKE] received end entity cert "C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3"</div><div>18:27:42 05[CFG] looking for XAuthInitRSA peer configs matching 192.168.11.55...192.168.11.4</div><div><br></div><div>[C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3]</div><div>18:27:42 05[CFG] selected peer config "cert"</div><div>18:27:42 05[CFG] using certificate "C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3"</div><div>18:27:42 05[CFG] using trusted ca certificate "C=US, ST=CA, L=San, O=IBM, OU=Dev, CN=CA1"</div><div>18:27:42 05[CFG] checking certificate status of "C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3"</div><div>18:27:42 05[CFG] certificate status is not available</div><div>18:27:42 05[CFG] reached self-signed root ca with a path length of 0</div><div>18:27:42 05[IKE] authentication of 'C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3' with RSA successful</div><div>18:27:42 05[IKE] authentication of '192.168.11.55' (myself) successful</div><div>18:27:42 05[IKE] sending end entity cert "C=US, ST=CA, O=IBM, OU=Dev, CN=vpn4"</div><div>18:27:42 05[ENC] generating ID_PROT response 0 [ ID CERT SIG ]</div><div>18:27:42 05[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59648] (1516 bytes)</div><div>18:27:42 05[ENC] generating TRANSACTION request 1729591383 [ HASH CPRQ(X_USER X_PWD) ]</div><div>18:27:42 05[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59648] (76 bytes)</div><div>18:27:44 07[IKE] <span style="background-color:rgb(255,0,0)">sending retransmit 1 of request message ID 1729591383, seq 1</span></div><div><span style="background-color:rgb(255,0,0)">18:27:44 07[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59648] (76 bytes)</span></div><div><span style="background-color:rgb(255,0,0)">18:27:46 06[IKE] sending retransmit 2 of request message ID 1729591383, seq 1</span></div><div><span style="background-color:rgb(255,0,0)">18:27:46 06[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59648] (76 bytes)</span></div><div><span style="background-color:rgb(255,0,0)">18:27:48 08[IKE] sending retransmit 3 of request message ID 1729591383, seq 1</span></div><div><span style="background-color:rgb(255,0,0)">18:27:48 08[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59648] (76 bytes)</span></div><div><span style="background-color:rgb(255,0,0)">------- get username/password -----</span></div><div>18:27:49 09[NET] received packet: from 192.168.11.4[59648] to 192.168.11.55[500] (92 bytes)</div><div>18:27:49 09[ENC] parsed TRANSACTION response 1729591383 [ HASH CPRP(X_USER X_PWD) ]</div><div>18:27:49 09[IKE] PAM authentication of 'admin' successful</div><div>18:27:49 09[IKE] XAuth authentication of 'admin' successful</div><div>18:27:49 09[ENC] generating TRANSACTION request 2041229808 [ HASH CPS(X_STATUS) ]</div><div>18:27:49 09[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59648] (76 bytes)</div><div>18:27:49 10[NET] received packet: from 192.168.11.4[59648] to 192.168.11.55[500] (60 bytes)</div><div>18:27:49 10[ENC] parsed TRANSACTION response 2041229808 [ HASH CP ]</div><div>18:27:49 10[IKE] IKE_SA cert[2] established between 192.168.11.55</div><div><br></div><div>[192.168.11.55]...192.168.11.4[C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3]</div><div>18:27:49 10[IKE] scheduling reauthentication in 3407s</div><div>18:27:49 10[IKE] maximum IKE_SA lifetime 3587s</div><div>18:27:49 12[NET] received packet: from 192.168.11.4[59648] to 192.168.11.55[500] (204 bytes)</div><div>18:27:49 12[ENC] unknown attribute type (28683)</div><div>18:27:49 12[ENC] unknown attribute type (28684)</div><div>18:27:49 12[ENC] parsed TRANSACTION request 3997764575 [ HASH CPRQ(ADDR MASK DNS NBNS EXP </div><div><br></div><div>U_BANNER U_SAVEPWD U_DEFDOM U_SPLITINC U_SPLITDNS U_PFS (28683) U_BKPSRV (28684) VER U_FWTYPE </div><div><br></div><div>U_DDNSHOST U_NATTPORT U_LOCALLAN) ]</div><div>18:27:49 12[IKE] peer requested virtual IP %any</div><div>18:27:49 12[CFG] assigning new lease to 'admin'</div><div>18:27:49 12[IKE] assigning virtual IP 10.3.0.1 to peer 'admin'</div><div>18:27:49 12[ENC] generating TRANSACTION response 3997764575 [ HASH CPRP(ADDR) ]</div><div>18:27:49 12[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59648] (76 bytes)</div><div>18:27:49 13[NET] received packet: from 192.168.11.4[59648] to 192.168.11.55[500] (1036 bytes)</div><div>18:27:49 13[ENC] parsed QUICK_MODE request 2830806870 [ HASH SA No ID ID ]</div><div>18:27:49 13[IKE] received 2147483s lifetime, configured 1200s</div><div>18:27:49 13[ENC] generating QUICK_MODE response 2830806870 [ HASH SA No ID ID ]</div><div><span style="background-color:rgb(255,0,0)">---- enter QM then the client got invalid ID payload ------</span></div><div><br></div><div>18:27:49 13[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59648] (188 bytes)</div><div>18:27:49 14[NET] received packet: from 192.168.11.4[59648] to 192.168.11.55[500] (76 bytes)</div><div>18:27:49 14[ENC] parsed INFORMATIONAL_V1 request 1748929456 [ HASH D ]</div><div>18:27:49 14[IKE] received DELETE for ESP CHILD_SA with SPI 99de1a47</div><div>18:27:49 14[IKE] CHILD_SA not found, ignored</div><div>18:27:59 07[NET] received packet: from 192.168.11.4[59648] to 192.168.11.55[500] (92 bytes)</div><div>18:27:59 07[ENC] parsed INFORMATIONAL_V1 request 2690483197 [ HASH N(DPD) ]</div><div>18:27:59 07[ENC] generating INFORMATIONAL_V1 request 846596827 [ HASH N(DPD_ACK) ]</div><div>18:27:59 07[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59648] (92 bytes)</div><div>18:28:09 06[NET] received packet: from 192.168.11.4[59648] to 192.168.11.55[500] (92 bytes)</div><div>18:28:09 06[ENC] parsed INFORMATIONAL_V1 request 741866151 [ HASH N(DPD) ]</div><div>18:28:09 06[ENC] generating INFORMATIONAL_V1 request <a href="tel:2693244661" value="+12693244661" target="_blank">2693244661</a> [ HASH N(DPD_ACK) ]</div><div>18:28:09 06[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[59648] (92 bytes)</div><div>18:28:19 09[NET] received packet: from 192.168.11.4[59648] to 192.168.11.55[500] (92 bytes)</div><div>18:28:19 09[ENC] parsed INFORMATIONAL_V1 request 2657653456 [ HASH D ]</div><div>18:28:19 09[IKE] received DELETE for IKE_SA cert[2]</div><div>18:28:19 09[IKE] deleting IKE_SA cert[2] between 192.168.11.55[192.168.11.55]...192.168.11.4</div><div><br></div><div>[C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3]</div><div>18:28:19 09[CFG] lease 10.3.0.1 by 'admin' went offline</div><div>20:16:21 07[NET] received packet: from 192.168.11.4[62110] to 192.168.11.55[500] (1160 bytes)</div><div>20:16:21 07[ENC] parsed ID_PROT request 0 [ SA V V V V V ]</div><div>20:16:21 07[IKE] received XAuth vendor ID</div><div>20:16:21 07[IKE] received DPD vendor ID</div><div>20:16:21 07[IKE] received FRAGMENTATION vendor ID</div><div>20:16:21 07[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID</div><div>20:16:21 07[IKE] received Cisco Unity vendor ID</div><div>20:16:21 07[IKE] 192.168.11.4 is initiating a Main Mode IKE_SA</div><div>20:16:21 07[ENC] generating ID_PROT response 0 [ SA V V V V ]</div><div>20:16:21 07[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[62110] (160 bytes)</div><div>20:16:21 06[NET] received packet: from 192.168.11.4[62110] to 192.168.11.55[500] (288 bytes)</div><div>20:16:21 06[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D V V ]</div><div>20:16:21 06[ENC] received unknown vendor ID: 1b:46:5c:a1:26:50:a7:e7:d8:ff:60:b4:de:86:0f:f7</div><div>20:16:21 06[IKE] received Cisco Unity vendor ID</div><div>20:16:21 06[IKE] sending cert request for "C=US, ST=CA, L=San, O=IBM, OU=Dev, CN=CA1"</div><div>20:16:21 06[ENC] generating ID_PROT response 0 [ KE No CERTREQ NAT-D NAT-D ]</div><div>20:16:21 06[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[62110] (333 bytes)</div><div>20:16:21 08[NET] received packet: from 192.168.11.4[62110] to 192.168.11.55[500] (1692 bytes)</div><div>20:16:21 08[ENC] parsed ID_PROT request 0 [ ID CERT CERTREQ SIG N(INITIAL_CONTACT) ]</div><div>20:16:21 08[IKE] received cert request for 'C=US, ST=CA, L=San, O=IBM, OU=Dev, CN=CA1'</div><div>20:16:21 08[IKE] received end entity cert "C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3"</div><div>20:16:21 08[CFG] looking for XAuthInitRSA peer configs matching 192.168.11.55...192.168.11.4</div><div><br></div><div>[C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3]</div><div>20:16:21 08[CFG] selected peer config "cert"</div><div>20:16:21 08[CFG] using certificate "C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3"</div><div>20:16:21 08[CFG] using trusted ca certificate "C=US, ST=CA, L=San, O=IBM, OU=Dev, CN=CA1"</div><div>20:16:21 08[CFG] checking certificate status of "C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3"</div><div>20:16:21 08[CFG] certificate status is not available</div><div>20:16:21 08[CFG] reached self-signed root ca with a path length of 0</div><div>20:16:21 08[IKE] authentication of 'C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3' with RSA successful</div><div>20:16:21 08[IKE] authentication of '192.168.11.55' (myself) successful</div><div>20:16:21 08[IKE] sending end entity cert "C=US, ST=CA, O=IBM, OU=Dev, CN=vpn4"</div><div>20:16:21 08[ENC] generating ID_PROT response 0 [ ID CERT SIG ]</div><div>20:16:21 08[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[62110] (1516 bytes)</div><div>20:16:21 08[ENC] generating TRANSACTION request 2850616008 [ HASH CPRQ(X_USER X_PWD) ]</div><div>20:16:21 08[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[62110] (76 bytes)</div><div>20:16:23 09[IKE] sending retransmit 1 of request message ID 2850616008, seq 1</div><div>20:16:23 09[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[62110] (76 bytes)</div><div>20:16:25 10[IKE] sending retransmit 2 of request message ID 2850616008, seq 1</div><div>20:16:25 10[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[62110] (76 bytes)</div><div>20:16:26 11[NET] received packet: from 192.168.11.4[62110] to 192.168.11.55[500] (92 bytes)</div><div>20:16:26 11[ENC] parsed TRANSACTION response 2850616008 [ HASH CPRP(X_USER X_PWD) ]</div><div>20:16:26 11[IKE] PAM authentication of 'admin' successful</div><div>20:16:26 11[IKE] XAuth authentication of 'admin' successful</div><div>20:16:26 11[ENC] generating TRANSACTION request 588066412 [ HASH CPS(X_STATUS) ]</div><div>20:16:26 11[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[62110] (76 bytes)</div><div>20:16:26 12[NET] received packet: from 192.168.11.4[62110] to 192.168.11.55[500] (60 bytes)</div><div>20:16:26 12[ENC] parsed TRANSACTION response 588066412 [ HASH CP ]</div><div>20:16:26 12[IKE] IKE_SA cert[3] established between 192.168.11.55</div><div><br></div><div>[192.168.11.55]...192.168.11.4[C=US, ST=CA, O=IBM, OU=Dev, CN=vpn3]</div><div>20:16:26 12[IKE] scheduling reauthentication in 3273s</div><div>20:16:26 12[IKE] maximum IKE_SA lifetime 3453s</div><div>20:16:26 14[NET] received packet: from 192.168.11.4[62110] to 192.168.11.55[500] (204 bytes)</div><div>20:16:26 14[ENC] unknown attribute type (28683)</div><div>20:16:26 14[ENC] unknown attribute type (28684)</div><div>20:16:26 14[ENC] parsed TRANSACTION request <a href="tel:2406481829" value="+12406481829" target="_blank">2406481829</a> [ HASH CPRQ(ADDR MASK DNS NBNS EXP </div><div><br></div><div>U_BANNER U_SAVEPWD U_DEFDOM U_SPLITINC U_SPLITDNS U_PFS (28683) U_BKPSRV (28684) VER U_FWTYPE </div><div><br></div><div>U_DDNSHOST U_NATTPORT U_LOCALLAN) ]</div><div>20:16:26 14[IKE] peer requested virtual IP %any</div><div>20:16:26 14[CFG] reassigning offline lease to 'admin'</div><div>20:16:26 14[IKE] assigning virtual IP 10.3.0.1 to peer 'admin'</div><div>20:16:26 14[ENC] generating TRANSACTION response <a href="tel:2406481829" value="+12406481829" target="_blank">2406481829</a> [ HASH CPRP(ADDR) ]</div><div>20:16:26 14[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[62110] (76 bytes)</div><div>20:16:26 15[NET] received packet: from 192.168.11.4[62110] to 192.168.11.55[500] (1036 bytes)</div><div>20:16:26 15[ENC] parsed QUICK_MODE request <a href="tel:4244192973" value="+14244192973" target="_blank">4244192973</a> [ HASH SA No ID ID ]</div><div>20:16:26 15[IKE] received 2147483s lifetime, configured 1200s</div><div>20:16:26 15[ENC] generating QUICK_MODE response <a href="tel:4244192973" value="+14244192973" target="_blank">4244192973</a> [ HASH SA No ID ID ]</div><div>20:16:26 15[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[62110] (188 bytes)</div><div>20:16:26 16[NET] received packet: from 192.168.11.4[62110] to 192.168.11.55[500] (76 bytes)</div><div>20:16:26 16[ENC] parsed INFORMATIONAL_V1 request 2557155737 [ HASH D ]</div><div>20:16:26 16[IKE] received DELETE for ESP CHILD_SA with SPI f3a12707</div><div>20:16:26 16[IKE] CHILD_SA not found, ignored</div><div>20:16:36 09[NET] received packet: from 192.168.11.4[62110] to 192.168.11.55[500] (92 bytes)</div><div>20:16:36 09[ENC] parsed INFORMATIONAL_V1 request 2004113721 [ HASH N(DPD) ]</div><div>20:16:36 09[ENC] generating INFORMATIONAL_V1 request 3836705764 [ HASH N(DPD_ACK) ]</div><div>20:16:36 09[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[62110] (92 bytes)</div><div>20:16:46 10[NET] received packet: from 192.168.11.4[62110] to 192.168.11.55[500] (92 bytes)</div><div>20:16:46 10[ENC] parsed INFORMATIONAL_V1 request 3010810231 [ HASH N(DPD) ]</div><div>20:16:46 10[ENC] generating INFORMATIONAL_V1 request 2810321439 [ HASH N(DPD_ACK) ]</div><div>20:16:46 10[NET] sending packet: from 192.168.11.55[500] to 192.168.11.4[62110] (92 bytes)</div><div>#</div></div></div></div></div><div><br></div><div><br></div><div>The question the client what it expects??</div><div>what is wrong of GW config ? I did use subjectnameALT to 10.3.1.1 and 192.168.11.55</div><div><br></div><div><div style="font-size:12.8000001907349px"><br></div><div style="font-size:12.8000001907349px">Any input, I am very appreciated</div></div><span class="HOEnZb"><font color="#888888"><div style="font-size:12.8000001907349px"><br></div><div style="font-size:12.8000001907349px">Tom</div><div><br></div></font></span></div>
</blockquote></div><br></div>