[Users] freeswan cisco 828 interop

From: Joop Marijne (jmarijne_at_penguin-systems.nl)
Date: Thu Jan 09 2003 - 22:38:28 CET


Hi all,

I am trying to connect a cisco 828 sdsl router to a linux freeswan box. I am
not very experienced with cisco ios, but there are some examples on the net.
below are the freeswan config, cisco config and the debug info. I am using
cisco IOS 12.2 with 3des option pack, freeswan 1.98b with kernel 2.4.19

the problem is when I start the connection, freeswan logs:
hoofddorp" #1: protocol/port in Phase 1 ID Payload must be 0/0 or 17/500 but
are 17/0

the cisco reports succesfull exchange of the preshared keys, but then it
fails with the same problem. I am not sure which side is sending this
packet.

Hope somebody can shed some light on this.

config of the freeswan box:

conn hoofddorp
        # Left security gateway, subnet behind it, next hop toward right.
        left=64.65.66.146
        leftsubnet=10.124.207.0/24
        leftnexthop=%defaultroute
        # Right security gateway, subnet behind it, next hop toward left.
        right=41.42.43.49
        rightsubnet=10.110.1.0/24
        rightnexthop=
        # To authorize this connection, but not actually start it, at
startup,
        # uncomment this.
        auto=start
        authby=secret

and the cisco:

!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname "hoofddorp"
!
enable secret 0 pwd
!
ip subnet-zero
no ip domain lookup
!
!
crypto isakmp policy 1
 encr 3des
 hash sha
 authentication pre-share
 group 2
crypto isakmp key SECRETKEY 64.65.66.146
!
!
crypto ipsec transform-set linux esp-3des esp-sha-hmac
!
crypto map TEST 1 ipsec-isakmp
 set peer 64.65.66.146
 set transform-set linux
 set pfs group2
 match address 102
!
!
!
!
interface Ethernet0
 ip address 10.110.1.254 255.255.255.0
 no ip proxy-arp
 ip nat inside
 hold-queue 100 out
!
interface ATM0
 no ip address
 no atm ilmi-keepalive
 pvc 0 0/35
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
 dsl equipment-type CPE
 dsl operating-mode GSHDSL symmetric annex B
 dsl linerate AUTO
!
interface Dialer0
 ip address negotiated
 ip nat outside
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 no peer default ip address
 ppp authentication pap callin
 ppp pap sent-username webxpar12 password 0 pwd
 crypto map TEST
!
ip nat inside source list 101 interface Dialer0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0 permanent
no ip http server
!
!
access-list 101 permit ip 10.110.1.0 0.0.0.255 any
access-list 102 permit ip 10.124.207.0 0.0.0.255 10.110.1.0 0.0.0.255
dialer-list 1 protocol ip permit
!
line con 0
 stopbits 1
line vty 0 4
 password 0 pwd
 login
!
scheduler max-task-time 5000
end

syslog freeswan:

Jan 9 21:49:51 linux-01 ipsec_setup: ...FreeS/WAN IPsec started
Jan 9 21:49:51 linux-01 pluto[15172]: Starting Pluto (FreeS/WAN Version
1.98b)
Jan 9 21:49:51 linux-01 pluto[15172]: added connection description
"hoofddorp"
Jan 9 21:49:51 linux-01 pluto[15172]: listening for IKE messages
Jan 9 21:49:51 linux-01 pluto[15172]: adding interface ipsec0/eth1
64.65.66.146
Jan 9 21:49:51 linux-01 pluto[15172]: loading secrets from
"/etc/ipsec.secrets"
Jan 9 21:49:51 linux-01 pluto[15172]: "hoofddorp" #1: initiating Main Mode
Jan 9 21:49:52 linux-01 pluto[15172]: "hoofddorp" #1: ignoring Vendor ID
payload
Jan 9 21:49:52 linux-01 last message repeated 3 times
Jan 9 21:49:52 linux-01 pluto[15172]: "hoofddorp" #1: protocol/port in
Phase 1 ID Payload must be 0/0 or 17/500 but are 17/0

ISAKMP debug output:

9.bbeyond.nl 479: 00:08:36: ISAKMP (0:6): Checking ISAKMP transform 2
against priority 1 policy
Jan 9 21:47:25 remote-cisco 480: 00:08:36: ISAKMP: life type in
seconds
Jan 9 21:47:25 remote-cisco 481: 00:08:36: ISAKMP: life duration
(basic) of 3600
Jan 9 21:47:25 remote-cisco 482: 00:08:36: ISAKMP: encryption 3DES-CBC
Jan 9 21:47:25 remote-cisco 483: 00:08:36: ISAKMP: hash SHA
Jan 9 21:47:25 remote-cisco 484: 00:08:36: ISAKMP: auth pre-share
Jan 9 21:47:25 remote-cisco 485: 00:08:36: ISAKMP: default group 2
Jan 9 21:47:25 remote-cisco 486: 00:08:36: ISAKMP (0:6): atts are
acceptable. Next payload is 3
Jan 9 21:47:25 remote-cisco 487: 00:08:36: ISAKMP (0:6): Input =
IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Jan 9 21:47:25 remote-cisco 488: 00:08:36: ISAKMP (0:6): Old State =
IKE_R_MM1 New State = IKE_R_MM1
Jan 9 21:47:25 remote-cisco 489:
Jan 9 21:47:25 remote-cisco 490: 00:08:36: ISAKMP (0:6): sending packet to
64.65.66.146 my_port 500 peer_port 500 (R) MM_SA_SETUP
Jan 9 21:47:25 remote-cisco 491: 00:08:36: ISAKMP (0:6): Input =
IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Jan 9 21:47:25 remote-cisco 492: 00:08:36: ISAKMP (0:6): Old State =
IKE_R_MM1 New State = IKE_R_MM2
Jan 9 21:47:25 remote-cisco 493:
Jan 9 21:47:25 remote-cisco 494: 00:08:36: ISAKMP (0:6): received packet
from 64.65.66.146 dport 500 sport 500 (R) MM_SA_SETUP
Jan 9 21:47:25 remote-cisco 495: 00:08:36: ISAKMP (0:6): Input =
IKE_MESG_FROM_PEER, IKE_MM_EXCH
Jan 9 21:47:25 remote-cisco 496: 00:08:36: ISAKMP (0:6): Old State =
IKE_R_MM2 New State = IKE_R_MM3
Jan 9 21:47:25 remote-cisco 497:
Jan 9 21:47:25 remote-cisco 498: 00:08:36: ISAKMP (0:6): processing KE
payload. message ID = 0
Jan 9 21:47:25 remote-cisco 499: 00:08:37: ISAKMP (0:6): processing NONCE
payload. message ID = 0
Jan 9 21:47:25 remote-cisco 500: 00:08:37: ISAKMP (0:6): found peer
pre-shared key matching 64.65.66.146
Jan 9 21:47:26 remote-cisco 501: 00:08:37: ISAKMP (0:6): SKEYID state
generated
Jan 9 21:47:26 remote-cisco 502: 00:08:37: ISAKMP (0:6): Input =
IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Jan 9 21:47:26 remote-cisco 503: 00:08:37: ISAKMP (0:6): Old State =
IKE_R_MM3 New State = IKE_R_MM3
Jan 9 21:47:26 remote-cisco 504:
Jan 9 21:47:26 remote-cisco 505: 00:08:37: ISAKMP (0:6): sending packet to
64.65.66.146 my_port 500 peer_port 500 (R) MM_KEY_EXCH
Jan 9 21:47:26 remote-cisco 506: 00:08:37: ISAKMP (0:6): Input =
IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Jan 9 21:47:26 remote-cisco 507: 00:08:37: ISAKMP (0:6): Old State =
IKE_R_MM3 New State = IKE_R_MM4
Jan 9 21:47:26 remote-cisco 508:
Jan 9 21:47:26 remote-cisco 509: 00:08:37: ISAKMP (0:6): received packet
from 64.65.66.146 dport 500 sport 500 (R) MM_KEY_EXCH
Jan 9 21:47:26 remote-cisco 510: 00:08:37: ISAKMP (0:6): Input =
IKE_MESG_FROM_PEER, IKE_MM_EXCH
Jan 9 21:47:26 remote-cisco 511: 00:08:37: ISAKMP (0:6): Old State =
IKE_R_MM4 New State = IKE_R_MM5
Jan 9 21:47:26 remote-cisco 512:
Jan 9 21:47:26 remote-cisco 513: 00:08:37: ISAKMP (0:6): processing ID
payload. message ID = 0
Jan 9 21:47:26 remote-cisco 514: 00:08:37: ISAKMP (0:6): processing HASH
payload. message ID = 0
Jan 9 21:47:26 remote-cisco 515: 00:08:37: ISAKMP (0:6): SA has been
authenticated with 64.65.66.146
Jan 9 21:47:26 remote-cisco 516: 00:08:37: ISAKMP (0:6): Input =
IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Jan 9 21:47:26 remote-cisco 517: 00:08:37: ISAKMP (0:6): Old State =
IKE_R_MM5 New State = IKE_R_MM5
Jan 9 21:47:26 remote-cisco 518:
Jan 9 21:47:26 remote-cisco 519: 00:08:37: ISAKMP (0:6): SA is doing
pre-shared key authentication using id type ID_IPV4_ADDR
Jan 9 21:47:26 remote-cisco 520: 00:08:37: ISAKMP (6): ID payload
Jan 9 21:47:26 remote-cisco 521: ^Inext-payload : 8
Jan 9 21:47:26 remote-cisco 522: ^Itype : 1
Jan 9 21:47:26 remote-cisco 523: ^Iaddr : 41.42.43.49
Jan 9 21:47:26 remote-cisco 524: ^Iprotocol : 17
!!!!This must be the problem !!!
Jan 9 21:47:26 remote-cisco 525: ^Iport : 0

Jan 9 21:47:26 remote-cisco 526: ^Ilength : 8
Jan 9 21:47:26 remote-cisco 527: 00:08:37: ISAKMP (6): Total payload
length: 12
Jan 9 21:47:27 remote-cisco 528: 00:08:37: ISAKMP (0:6): sending packet to
64.65.66.146 my_port 500 peer_port 500 (R) MM_KEY_EXCH
Jan 9 21:47:27 remote-cisco 529: 00:08:37: ISAKMP (0:6): Input =
IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Jan 9 21:47:27 remote-cisco 530: 00:08:37: ISAKMP (0:6): Old State =
IKE_R_MM5 New State = IKE_P1_COMPLETE
Jan 9 21:47:27 remote-cisco 531:
Jan 9 21:47:27 remote-cisco 532: 00:08:37: ISAKMP (0:6): Input =
IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
Jan 9 21:47:27 remote-cisco 533: 00:08:37: ISAKMP (0:6): Old State =
IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
Jan 9 21:47:27 remote-cisco 534:

more debugging

hoofddorp#show crypto ipsec sa

interface: Dialer0
    Crypto map tag: TEST, local addr. 41.42.43.49

   local ident (addr/mask/prot/port): (10.124.207.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (10.110.1.0/255.255.255.0/0/0)
   current_peer: 64.65.66.146:500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 41.42.43.49, remote crypto endpt.: 64.65.66.146
     path mtu 1500, media mtu 1500
     current outbound spi: 0

     inbound esp sas:

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

     outbound ah sas:

     outbound pcp sas:

_______________________________________________
Users mailing list
Users_at_lists.freeswan.org
http://lists.freeswan.org/mailman/listinfo/users



This archive was generated by hypermail 2.1.5 : Sat Jan 11 2003 - 05:21:13 CET