[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
isakmpd question
hi all,
i am trying to get a vpn tunnel to a Checkpoint NG FP3 working.
They are using:
Phase 1:
- AES-256
- SHA1
- DH Group 2
- Authentication Shared
- no aggressive Mode
Phase 2:
- AES-128
- SHA1
- Lifetime 3600sec
- no ip compression
- PFS
- DH Group 2
- Key Exchange for Subnets
i am getting this error message:
exchange_run: doi->initiator (0x3c12b000) failed
and the tunnel don't gets established
everything else seems to work fine
tcpdump shows me
--------------------------------------------------
13:10:01.510457 81.223.6.247.500 > 212.95.11.161.500: isakmp v1.0
exchange ID_PROT
cookie: 4a8701585e731441->0000000000000000 msgid: 00000000 len:
76
13:10:01.523664 212.95.11.161.500 > 81.223.6.247.500: isakmp v1.0
exchange ID_PROT
cookie: 4a8701585e731441->68093a78f8d7385a msgid: 00000000 len:
76 (DF)
13:10:02.735808 81.223.6.247.500 > 212.95.11.161.500: isakmp v1.0
exchange ID_PROT
cookie: 4a8701585e731441->68093a78f8d7385a msgid: 00000000 len:
180
13:10:02.750076 212.95.11.161.500 > 81.223.6.247.500: isakmp v1.0
exchange ID_PROT
cookie: 4a8701585e731441->68093a78f8d7385a msgid: 00000000 len:
184 (DF)
13:10:03.557676 81.223.6.247.500 > 212.95.11.161.500: isakmp v1.0
exchange ID_PROT encrypted
cookie: 4a8701585e731441->68093a78f8d7385a msgid: 00000000 len:
92
13:10:03.589408 212.95.11.161.500 > 81.223.6.247.500: isakmp v1.0
exchange ID_PROT encrypted
cookie: 4a8701585e731441->68093a78f8d7385a msgid: 00000000 len:
76 (DF)
13:10:03.696384 212.95.11.161.500 > 81.223.6.247.500: isakmp v1.0
exchange ID_PROT encrypted
cookie: 4a8701585e731441->68093a78f8d7385a msgid: 00000000 len:
76 (DF)
13:10:03.796680 212.95.11.161.500 > 81.223.6.247.500: isakmp v1.0
exchange ID_PROT encrypted
cookie: 4a8701585e731441->68093a78f8d7385a msgid: 00000000 len:
76 (DF)
----------------------------------------------------------------
my isakmpd.conf is:
-----------------------------------------------------------------
[General]
Retransmits= 5
Exchange-max-time= 120
Listen-on= 81.223.6.247
Shared-SADB= Defined
Policy-file= /etc/isakmpd/isakmpd.policy
Default-phase-1-lifetime= 28800
Default-phase-2-lifetime= 3600
Check-interval= 3600
# Incoming phase 1 negotiations are multiplexed on the source IP address
[Phase 1]
212.95.11.161= ISAKMP-peer-Checkpoint
Default= ISAKMP-peer-Checkpoint
# These connections are walked over after config file parsing and told
# to the application layer so that it will inform us when traffic wants
to
# pass over them. This means we can do on-demand keying.
[Phase 2]
Connections=
IPsec-OBSD-Checkpoint1,IPsec-OBSD-Checkpoint2
# The peers
[ISAKMP-peer-Checkpoint]
Phase= 1
Transport= udp
Local-address= 81.223.6.247
Address= 212.95.11.161
Configuration= Default-main-mode
Authentication= secret
# The different connections
[IPsec-OBSD-Checkpoint1]
Phase= 2
ISAKMP-peer= ISAKMP-peer-Checkpoint
Configuration= Default-quick-mode
Local-ID= Net-OBSD
Remote-ID= Net-Checkpoint1
[IPsec-OBSD-Checkpoint2]
Phase= 2
ISAKMP-peer= ISAKMP-peer-Checkpoint
Configuration= Default-quick-mode
Local-ID= Net-OBSD
Remote-ID= Net-Checkpoint2
# Our Networks
[Net-Checkpoint1]
ID-type= IPV4_ADDR_SUBNET
Network= 212.95.16.240
Netmask= 255.255.255.255
[Net-Checkpoint2]
ID-type= IPV4_ADDR_SUBNET
Network= 212.95.19.135
Netmask= 255.255.255.255
[Net-OBSD]
ID-type= IPV4_ADDR
Address= 81.223.6.247
# Phase 1 descriptions
[Default-main-mode]
DOI= IPSEC
EXCHANGE_TYPE= ID_PROT
Transforms= AES256-SHA-GRP2
# Phase 2 description
[Default-quick-mode]
DOI= IPSEC
EXCHANGE_TYPE= QUICK_MODE
Transforms= QM-AES128-SHA-GRP2-PFS-SUITE
[AES256-SHA-GRP2]
ENCRYPTION_ALGORITHM= AES_CBC
KEY_LENGTH= 256
HASH_ALGORITHM= SHA
AUTHENTICATION_METHOD= PRE_SHARED
GROUP_DESCRIPTION= MODP_1024
[QM-AES128-SHA-GRP2-PFS-SUITE]
Protocols= QM-ESP-AES-SHA-PFS
[QM-ESP-AES-SHA-PFS]
PROTOCOL_ID= IPSEC_ESP
Transforms= QM-ESP-AES-SHA-PFS-XF
[QM-ESP-AES-SHA-PFS-XF]
TRANSFORM_ID= AES
ENCAPSULATION_MODE= TUNNEL
AUTHENTICATION_ALGORITHM= HMAC_SHA
GROUP_DESCRIPTION= MODP_1024
--------------------------------------------------------------------
and my isakmpd.policy is
---------------------------------------------------------------------
Keynote-Version: 2
Comment: This policy accepts ESP SAs from a remote that uses the right
password
Authorizer: "POLICY"
Licensees: "passphrase:secret"
Conditions: app_domain == "IPsec policy" &&
esp_present == "yes" -> "true";
----------------------------------------------------------------------
i am running OpenBSD 3.5
does someone knows why it wont work ?
best regards
Wolfgang