Re: RES: FreeSWAN CA 2.02 x PIX - Trouble in phase 2

well yes, so you need to set both side to appropriate settings. Check
algorithms, protocols and selectors, they must match exactly (well lets
say exactly) to get the negociation to suceed. The debugs on the PIX
should show you the proposals. 

Again, if you want you should send your PIX ipsec config and freeswan
ipsec.conf file and one should be able to see what's not correctly
configured.

J.

On Thu, 2003-10-02 at 13:58, Alberto Fabiano wrote:
> Hi Jean-Francois,
> 
> 	I already made some experiences, but now I verified that the trouble there
> is in the following point:
> 
> 	- ignoring informational payload, type NO_PROPOSAL_CHOSEN
> 
> 	- max number of retransmissions (2) reached STATE_QUICK_I1.  No acceptable
> response to our first Quick Mode message: perhaps peer likes no proposal
> 
>       I found several references on this message (some 18 in Google) but up
> to now I didn't get to identify indeed what is, maybe for my poor experience
> with FreeSWAN.
> 
> 	Thankful to all for the helps, but I still seek a light! :-)
> 
> 
> Att.
> []´s++
> 
> ./alberto -fabiano
> 
> 
> 
> 
> > -----Mensagem original-----
> > De: Jean-Francois Dive [mailto:[email protected]]
> > Enviada em: terça-feira, 30 de setembro de 2003 08:02
> > Para: Alberto Fabiano
> > Cc: Vpn
> > Assunto: Re: [VPN] FreeSWAN CA 2.02 x PIX - Trouble in phase 2
> >
> >
> > you dont see the answer from the PIX, sounds like the problem is in the
> > PIX or freeswan side p2 parameter negociation. I would have expected the
> > PIX to send back an informational message. Send us the PIX log's /
> > config related to IPSec. Check that the selector (proxy identities in
> > cisco terms) do match properly.
> >
> > JeF
> >
> > On Sun, 2003-09-28 at 01:22, Alberto Fabiano wrote:
> > > Mrs,
> > >
> > > 	After an exhausting research for Google and reading of
> > several materials,
> > > the conclusion that I am needing help urgently arrive! : -)
> > >
> > > 	I have a FreeSWan CA 2.02 and am trying to stablish a
> > tunnel with a PIX
> > > through 3DES, MD5, IKE dh 2, using PSK the some days and am not
> > I obtaining
> > > success in the phase 2 of IPSec, will it be that anybody could
> > feel a help?
> > >
> > > 	In an initial moment, I got to close VPN (phase 1 and 2)
> > and I made some
> > > tests without a lot of headaches, but now, I don't know because am not
> > > getting more to close.
> > >
> > > 	It follows the parts of my ipsec.conf below, whack status
> > and related to
> > > this tunnel.
> > >
> > >
> > > # cat /var/chroot-ipsec/etc/ipsec.conf
> > >
> > > #
> > > # Default Configuration File for FreeS/WAN IPSEC
> > > #
> > >
> > > config setup
> > >         interfaces="ipsec0=eth0"
> > >         klipsdebug=none
> > >         plutodebug=all
> > >         dumpdir=
> > >         manualstart=
> > >         fragicmp=no
> > >         packetdefault=drop
> > >         hidetos=yes
> > >         uniqueids=yes
> > >         overridemtu=16260
> > >         nocrsend=yes
> > >         nat_traversal=yes
> > >         keep_alive=60
> > >
> > > conn %default
> > >         rekeymargin=9m
> > >         rekeyfuzz=100%
> > >         keyingtries=0
> > >
> > > conn VPN_5
> > >         type=tunnel
> > >         keyexchange=ike
> > >         pfsgroup=modp1024
> > >         pfs=yes
> > >         auto=start
> > >         authby=secret
> > >         ike=3des-md5-modp1024
> > >         esp=3des-md5-96
> > >         keylife=28800
> > >         ikelifetime=2880
> > >         compress=no
> > >         left=192.168.1.22
> > >         leftsubnet=192.168.1.5/255.255.255.255
> > >         leftnexthop=10.10.1.119
> > >         right=10.10.18.143
> > >         rightsubnet=10.10.18.146/255.255.255.255
> > >         rightnexthop=10.10.38.10
> > >         leftupdown="/opt/_updown 2>/tmp/log 1>/tmp/log"
> > >         rightupdown="/opt/_updown 2>/tmp/log 1>/tmp/log"
> > >         leftid=192.168.1.22
> > >         rightid=10.10.18.143
> > >
> > >
> > > # chroot /var/chroot-ipsec/ /usr/local/lib/ipsec/whack --status
> > >
> > > 000 interface ipsec0/eth0 192.168.1.22
> > > 000 interface ipsec0/eth0 192.168.1.22
> > > 000
> > > 000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64,
> > keysizemin=168,
> > > keysizemax=168
> > > 000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5,
> > > keysizemin=128,keysizemax=128
> > > 000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1,
> > > keysizemin=160, keysizemax=160
> > > 000
> > > 000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
> > > 000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
> > > 000
> > > 000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,6,36}
> > > trans={0,6,96} attrs={0,6,160}
> > > 000
> > >
> > > 000 "VPN_5":
> > >
> > 192.168.1.5/32===192.168.1.22---10.10.1.119...10.10.38.10---10.10.
> > 18.143===1
> > > 0.10.18.146/32
> > > 000 "VPN_5":   ike_life: 2880s; ipsec_life: 28800s; rekey_margin: 540s;
> > > rekey_fuzz: 100%; keyingtries: 0
> > > 000 "VPN_5":   policy: PSK+ENCRYPT+TUNNEL+PFS; interface: eth0;
> > trap erouted
> > > 000 "VPN_5":   newest ISAKMP SA: #1; newest IPsec SA: #0;
> > eroute owner: #0
> > > 000 "VPN_5":   IKE algorithms wanted: 5_000-1-2, flags=-strict
> > > 000 "VPN_5":   IKE algorithms found:  5_192-1_128-2,
> > > 000 "VPN_5":   IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024
> > > 000 "VPN_5":   ESP algorithms wanted: 3_000-1, ; pfsgroup=2;
> > flags=strict
> > > 000 "VPN_5":   ESP algorithms loaded: 3_168-1_128,
> > > 000
> > > 000 #6: "VPN_5" STATE_QUICK_I1 (sent QI1, expecting QR1);
> > EVENT_RETRANSMIT
> > > in 4s
> > > 000 #1: "VPN_5" STATE_MAIN_I4 (ISAKMP SA established);
> > EVENT_SA_REPLACE in
> > > 1673s; newest ISAKMP
> > > 000
> > >
> > >
> > > 	Awaiting help for my problem...
> > >
> > > Thanks for all!!!
> > > - Kind Regards.
> > >
> > >
> > >
> > > Alberto Fabiano Caires de Medeiros
> > >
> > --------------------------------------------------------------------------
> > > e-mail: [email protected]
> > >
> > --------------------------------------------------------------------------
> > >
> > >
> > > -----BEGIN PGP PUBLIC KEY BLOCK-----
> > >
> > > mQGiBD9spjwRBACQ2aQEqcQyGxaoNX4Zvk/9v6fCxyPWAcBQSSiPjJyi3cXa9kLB
> > > XsQjdgBY90x45wFwI0QwneWFCP364YZXdo7ZRPiLjI+qV6expjCIIm/LXi1LphwK
> > > 6l87HYbm74a2T6mdxRmxhCrgsA+ezSCEkMA9YolPw2r+ufvp59IrrYHrcwCg5aTW
> > > LbsbVQ2i+beAfpFPw8muW1kEAINssb8RXbilwIL6k7ZPbHQghkTIM7iIK5eGwMOx
> > > lYtmzoA2tCzJla0tp9G1ls2hW12d6io80P5jbYpx+17nhPV49oVA6yKGJNCaTAzi
> > > uyRxUYOYhSyS8PXxOPp600NGJ8qiX53JEPKPLxoiF/HG6EWihEIDFqvI11mIEcfi
> > > WFTDA/0SKjjkKt+S1fk42AbnE39pz1Kn6av2hYz00DX4XensZcnmmcbA1eO0a+TP
> > > foTl0x2ipHN7eymcVudDVU6fbQu18SJa+rSutW3GBmreRDi0NQ4vilCAVueyQpVP
> > > WS/jnOcw+uQp2PRkY8ylKxIOcgQZqy56jCEcbFH/eTxTfqA6c7REQWxiZXJ0byBG
> > > YWJpYW5vIENhaXJlcyBkZSBNZWRlaXJvcyAoazRsMXBzMCkgPGFsYmVydG9AY29t
> > > YmF0LmNvbS5icj6IWwQTEQIAGwUCP2ymPAYLCQgHAwIDFQIDAxYCAQIeAQIXgAAK
> > > CRDlbFd4k92tdCi4AJ9EyxOlZMrAdINGlB6GBs9/jG3omwCfdLbqML4sXLCMoXU/
> > > dJNLLC+lBSK5AQ0EP2ymQBAEAL5xjfRLFgxBVEiBK3Kr+1y75euY5nKC8H0CJy93
> > > w0YTB2E3DMVNFBX6woj7jnoW5+F+/a0+iVfOgkHWeGbvE7ZghCphrb4AOa2j3DHA
> > > eP2GNQarNEqP1v3RYa8e7WNEUx/RVnhxeW7XMsX7ylGx9e8QTTwAEFFc3gUoiYTn
> > > 2ljrAAMFA/4gDsxYp68UWniwzSCFgq16a6ATscTF45aPq0ROkUepWIMKY2/X/FQc
> > > e4FMSzRWC38fKILrkxhoaWIx1r2MFUiQtk3ItdXSDh5u2D/U+nHQqhYcgqjTzsfK
> > > 659HXw5GzmzbpueKymD6wsU1uYf9sq7dYxqQBJMleNB6vZi+ODZmRYhGBBgRAgAG
> > > BQI/bKZAAAoJEOVsV3iT3a1098cAn0BnS7NFu98qLc7XQL//rBh94EqzAJ9KGwCF
> > > K15S/3LqsNGqQEMRdzdQaw==
> > > =R5pw
> > > -----END PGP PUBLIC KEY BLOCK-----
> > >
> > > ---
> > > Outgoing mail is certified Virus Free.
> > > Checked by AVG anti-virus system (http://www.grisoft.com).
> > > Version: 6.0.521 / Virus Database: 319 - Release Date: 23/9/2003
> > >
> > > _______________________________________________
> > > VPN mailing list
> > > [email protected]
> > > http://lists.shmoo.com/mailman/listinfo/vpn
> > --
> >
> > -> Jean-Francois Dive
> > --> [email protected]
> >
> > I think that God in creating Man somewhat overestimated his ability.
> > -- Oscar Wilde
> >
> >
> > ---
> > Incoming mail is certified Virus Free.
> > Checked by AVG anti-virus system (http://www.grisoft.com).
> > Version: 6.0.522 / Virus Database: 320 - Release Date: 29/9/2003
> >
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.522 / Virus Database: 320 - Release Date: 29/9/2003
-- 

-> Jean-Francois Dive
--> [email protected]

I think that God in creating Man somewhat overestimated his ability.
-- Oscar Wilde