<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:inherit;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hello, hopefully someone could help us with an issue we are having with this setup.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We have a Windows 2012 R2 Server and a Debian 9 server running the latest release of StrongSwan. The configuration we are trying to implement is a host-to-host IPSEC connection in transport mode between these two hosts on the same subnet
using X.509 certificates for authentication.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Windows Server is on 192.168.1.76/24 (hostname LAB-DC-01)<o:p></o:p></p>
<p class="MsoNormal">Debian Server is on 192.168.1.73/24 (hostname LAB-DEBCLIENT-01)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Both servers have the same root CA certificate, except the Linux server has it converted to PEM from DER. My understanding is there isn’t any requirements for extra certificates except this one mutual CA, correct me if I’m wrong. The Windows
server configuration is done using the Connection Security Rules using RCA Certificate Signing, I then upload the rootca.pem to /etc/ipsec.d/cacerts<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Configs LAB-DEBCLIENT-01:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">/etc/ipsec.conf<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># ipsec.conf - strongSwan IPsec configuration file <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">config setup<o:p></o:p></p>
<p class="MsoNormal"> charondebug="ike 2, knl 2, cfg 2"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">conn %default<o:p></o:p></p>
<p class="MsoNormal"> ikelifetime=60m<o:p></o:p></p>
<p class="MsoNormal"> keylife=20m<o:p></o:p></p>
<p class="MsoNormal"> rekeymargin=3m<o:p></o:p></p>
<p class="MsoNormal"> keyingtries=1<o:p></o:p></p>
<p class="MsoNormal"> mobike=no<o:p></o:p></p>
<p class="MsoNormal"> keyexchange=ike<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">conn host-host<o:p></o:p></p>
<p class="MsoNormal"> left=192.168.1.73<o:p></o:p></p>
<p class="MsoNormal"># leftcert=rootca.pem<o:p></o:p></p>
<p class="MsoNormal"> leftid=@LAB-DEBCLIENT-01<o:p></o:p></p>
<p class="MsoNormal"> leftfirewall=yes<o:p></o:p></p>
<p class="MsoNormal"> right=192.168.1.76<o:p></o:p></p>
<p class="MsoNormal"> rightid=@LAB-DC-01<o:p></o:p></p>
<p class="MsoNormal"> type=transport<o:p></o:p></p>
<p class="MsoNormal"> auto=add<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">ca strongswan <o:p></o:p></p>
<p class="MsoNormal"> cacert=rootca.pem<o:p></o:p></p>
<p class="MsoNormal"> crluri=http://cdp.ourdomain.com/VP%20Issuing%20CA1.crl #changed ourdomain part for the mailing list<o:p></o:p></p>
<p class="MsoNormal"> auto=add<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Logs:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve changed the domain name to ourcompany for security reasons, so that can be ignored. My concerns are the two log lines below but can’t seem to find the reason:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Oct 10 16:43:40 LAB-DEBCLIENT-0 charon: 03[ENC] header verification failed<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:40 LAB-DEBCLIENT-0 charon: 03[NET] received invalid IKE header from 192.168.1.76 - ignored<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[CFG] no acceptable ENCRYPTION_ALGORITHM found<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.6.0, Linux 4.9.0-4-amd64, x86_64)<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[KNL] known interfaces and IP addresses:<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[KNL] lo<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[KNL] 127.0.0.1<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[KNL] ::1<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[KNL] eth0<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[KNL] 192.168.1.73<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[KNL] fe80::215:5dff:fe01:82cd<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[CFG] loaded ca certificate "CN=ourcompany Root CA" from '/etc/ipsec.d/cacerts/rootca.pem'<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[LIB] loaded plugins: charon aes des rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem fips-prf gmp curve25519 xcbc cmac hmac curl
attr kernel-netlink resolve socket-default stroke vici updown xauth-generic<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 00[JOB] spawning 16 worker threads<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 05[CFG] received stroke: add ca 'strongswan'<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 05[CFG] ca strongswan<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 05[CFG] cacert=rootca.pem<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 05[CFG] crluri=http://cdp.ourdomain.com/VP%20Issuing%20CA1.crl<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 05[CFG] loaded ca certificate "CN=company Root CA" from 'rootca.pem'<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 05[CFG] added ca 'strongswan'<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[CFG] received stroke: add connection 'host-host'<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[CFG] conn host-host<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[CFG] left=192.168.1.73<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[CFG] leftid=@LAB-DEBCLIENT-01<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[CFG] leftupdown=ipsec _updown iptables<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[CFG] right=192.168.1.76<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[CFG] rightid=@LAB-DC-01<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[CFG] ike=aes128-sha256-curve25519<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[CFG] esp=aes128-sha256<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[CFG] dpddelay=30<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[CFG] dpdtimeout=150<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[CFG] sha256_96=no<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[CFG] mediation=no<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[KNL] 192.168.1.76 is not a local address or the interface is down<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:33 LAB-DEBCLIENT-0 charon: 06[CFG] added configuration 'host-host'<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:40 LAB-DEBCLIENT-0 charon: 03[ENC] header verification failed<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:40 LAB-DEBCLIENT-0 charon: 03[NET] received invalid IKE header from 192.168.1.76 - ignored<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 03[ENC] header verification failed<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 03[NET] received invalid IKE header from 192.168.1.76 - ignored<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[NET] received packet: from 192.168.1.76[500] to 192.168.1.73[500] (312 bytes)<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V ]<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[CFG] looking for an ike config for 192.168.1.73...192.168.1.76<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[CFG] candidate: 192.168.1.73...192.168.1.76, prio 3096<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[CFG] found matching ike config: 192.168.1.73...192.168.1.76 with prio 3096<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[ENC] received unknown vendor ID: 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:05<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[ENC] received unknown vendor ID: 21:4c:a4:fa:ff:a7:f3:2d:67:48:e5:30:33:95:ae:83<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[IKE] received MS NT5 ISAKMPOAKLEY vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[IKE] received NAT-T (RFC 3947) vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[IKE] received FRAGMENTATION vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[ENC] received unknown vendor ID: fb:1d:e3:cd:f3:41:b7:ea:16:b7:e5:be:08:55:f1:20<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[ENC] received unknown vendor ID: 26:24:4d:38:ed:db:61:b3:17:2a:36:e3:d0:cf:b8:19<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[ENC] received unknown vendor ID: e3:a5:96:6a:76:37:9f:e7:07:22:82:31:e5:ce:86:52<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[IKE] 192.168.1.76 is initiating a Main Mode IKE_SA<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[IKE] IKE_SA (unnamed)[1] state change: CREATED => CONNECTING<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[CFG] selecting proposal:<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[CFG] no acceptable PSEUDO_RANDOM_FUNCTION found<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[CFG] selecting proposal:<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[CFG] no acceptable ENCRYPTION_ALGORITHM found<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[CFG] selecting proposal:<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[CFG] proposal matches<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[CFG] received proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[CFG] configured proposals: IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/CURVE_25519, IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/HMAC_SHA1_96/HMAC_MD5_96/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/PRF_HMAC_MD5/CURVE_25519/MODP_3072/MODP_4096/MODP_8192/MODP_2048/MODP_1024<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[IKE] sending XAuth vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[IKE] sending DPD vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[IKE] sending FRAGMENTATION vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[IKE] sending NAT-T (RFC 3947) vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[ENC] generating ID_PROT response 0 [ SA V V V V ]<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 09[NET] sending packet: from 192.168.1.73[500] to 192.168.1.76[500] (160 bytes)<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 10[NET] received packet: from 192.168.1.76[500] to 192.168.1.73[500] (260 bytes)<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 10[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 10[IKE] sending cert request for "CN=ourcompany Root CA"<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 10[ENC] generating ID_PROT response 0 [ KE No CERTREQ NAT-D NAT-D ]<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 10[NET] sending packet: from 192.168.1.73[500] to 192.168.1.76[500] (280 bytes)<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[NET] received packet: from 192.168.1.76[500] to 192.168.1.73[500] (92 bytes)<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[ENC] parsed INFORMATIONAL_V1 request 799120018 [ HASH N((28)) ]<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[IKE] received (28) error notify<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[IKE] IKE_SA (unnamed)[1] state change: CONNECTING => DESTROYING<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[NET] received packet: from 192.168.1.76[500] to 192.168.1.73[500] (312 bytes)<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V ]<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[CFG] looking for an ike config for 192.168.1.73...192.168.1.76<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[CFG] candidate: 192.168.1.73...192.168.1.76, prio 3096<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[CFG] found matching ike config: 192.168.1.73...192.168.1.76 with prio 3096<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[ENC] received unknown vendor ID: 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:05<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[ENC] received unknown vendor ID: 21:4c:a4:fa:ff:a7:f3:2d:67:48:e5:30:33:95:ae:83<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[IKE] received MS NT5 ISAKMPOAKLEY vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[IKE] received NAT-T (RFC 3947) vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[IKE] received FRAGMENTATION vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[ENC] received unknown vendor ID: fb:1d:e3:cd:f3:41:b7:ea:16:b7:e5:be:08:55:f1:20<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[ENC] received unknown vendor ID: 26:24:4d:38:ed:db:61:b3:17:2a:36:e3:d0:cf:b8:19<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[ENC] received unknown vendor ID: e3:a5:96:6a:76:37:9f:e7:07:22:82:31:e5:ce:86:52<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[IKE] 192.168.1.76 is initiating a Main Mode IKE_SA<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[IKE] IKE_SA (unnamed)[2] state change: CREATED => CONNECTING<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[CFG] selecting proposal:<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[CFG] no acceptable PSEUDO_RANDOM_FUNCTION found<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[CFG] selecting proposal:<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[CFG] no acceptable ENCRYPTION_ALGORITHM found<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[CFG] selecting proposal:<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[CFG] proposal matches<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[CFG] received proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[CFG] configured proposals: IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/CURVE_25519, IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/HMAC_SHA1_96/HMAC_MD5_96/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/PRF_HMAC_MD5/CURVE_25519/MODP_3072/MODP_4096/MODP_8192/MODP_2048/MODP_1024<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[IKE] sending XAuth vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[IKE] sending DPD vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[IKE] sending FRAGMENTATION vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[IKE] sending NAT-T (RFC 3947) vendor ID<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[ENC] generating ID_PROT response 0 [ SA V V V V ]<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 11[NET] sending packet: from 192.168.1.73[500] to 192.168.1.76[500] (160 bytes)<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 13[NET] received packet: from 192.168.1.76[500] to 192.168.1.73[500] (260 bytes)<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 13[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 13[IKE] sending cert request for "CN=ourcomapny Root CA"<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 13[ENC] generating ID_PROT response 0 [ KE No CERTREQ NAT-D NAT-D ]<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 13[NET] sending packet: from 192.168.1.73[500] to 192.168.1.76[500] (280 bytes)<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 14[NET] received packet: from 192.168.1.76[500] to 192.168.1.73[500] (92 bytes)<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 14[ENC] parsed INFORMATIONAL_V1 request 2327092492 [ HASH N((28)) ]<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 14[IKE] received (28) error notify<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:41 LAB-DEBCLIENT-0 charon: 14[IKE] IKE_SA (unnamed)[2] state change: CONNECTING => DESTROYING<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:42 LAB-DEBCLIENT-0 charon: 03[ENC] header verification failed<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:42 LAB-DEBCLIENT-0 charon: 03[NET] received invalid IKE header from 192.168.1.76 - ignored<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:45 LAB-DEBCLIENT-0 charon: 03[ENC] header verification failed<o:p></o:p></p>
<p class="MsoNormal">Oct 10 16:43:45 LAB-DEBCLIENT-0 charon: 03[NET] received invalid IKE header from 192.168.1.76 - ignored<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td width="562" style="width:405.0pt;padding:0cm 0cm 3.75pt 0cm">
<p class="MsoNormal"><b><span style="color:#404040;mso-fareast-language:EN-GB">Ben Lavender</span></b><span style="color:#404040;mso-fareast-language:EN-GB"> | Technical Infrastructure Engineer at
</span><b><span style="font-size:12.0pt;color:#404040;mso-fareast-language:EN-GB">virtual</span></b><b><span style="font-size:12.0pt;color:#548DD4;mso-fareast-language:EN-GB">DCS<o:p></o:p></span></b></p>
</td>
</tr>
<tr>
<td width="562" style="width:405.0pt;padding:0cm 0cm 3.75pt 0cm">
<p class="MsoNormal"><b><span style="color:#404040;mso-fareast-language:EN-GB">Office</span></b><b><span style="color:#333333;mso-fareast-language:EN-GB">:</span></b><span style="color:#333333;mso-fareast-language:EN-GB"> </span><span style="mso-fareast-language:EN-GB"><a href="tel:03453888327"><span style="color:windowtext;text-decoration:none">
<b>01133023184 </b></span></a><span style="color:#333333">| </span><b><span style="color:#404040">Mobile</span><span style="color:#333333">:</span></b><span style="color:#333333"> </span><b>07958 167998</b><span style="color:#333333"><o:p></o:p></span></span></p>
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:#404040;mso-fareast-language:EN-GB"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:#404040;mso-fareast-language:EN-GB">Award winning Cloud Computing Services and Hosting from UK Data Centres.<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="color:#404040;mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#404040;mso-fareast-language:EN-GB">‘UK’s Most Cutting Edge Cloud Hosting Services Provider 2016-17’ – TMT News
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#404040;mso-fareast-language:EN-GB">‘Best International Cloud Computing Solutions Provider 2016-17’ – CV Magazine<o:p></o:p></span></p>
</td>
</tr>
<tr>
<td width="562" style="width:405.0pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:inherit;mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB"><img border="0" width="562" height="138" style="width:5.8541in;height:1.4375in" id="Picture_x0020_1" src="cid:image001.png@01D341E2.F2312E00" alt="cid:image002.png@01D33E97.652B0BA0"></span><span style="font-size:12.0pt;font-family:inherit;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
</td>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
</td>
</tr>
<tr>
<td width="562" style="width:405.0pt;padding:0cm 0cm 3.75pt 0cm">
<p class="MsoNormal"><span style="font-size:10.0pt;mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
</td>
<td style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:10.0pt;mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p><font face="Arial" color="Gray" size="1">Virtual Data Centre Services (virtualDCS) is registered in England and Wales under company number 07238621; registered address: The Waterscape, 42 Leeds and Bradford Road, LS5 3EG. This e-mail and any attachments
are strictly confidential and intended for the addressee only. If you are not the named addressee you must not disclose, copy, or take any action in reliance of this transmission, and you should notify us as soon as possible. Any views or opinions expressed
are solely those of the author and do not necessarily represent those of virtualDCS. This e-mail and any attachments are believed to be free from viruses but it is your responsibility to carry out all necessary virus checks, and virtualDCS accepts no liability
in connection therewith. </font></p>
<div></div>
</body>
</html>