(racoon 938) Re: Ipsec between Linux and Cisco

Hi,

> sainfo address 10.1.14.3/24 udp address 10.1.24.3/24                    
Prease correct the "sainfo address..." to
"sainfo address 10.1.14.3 udp address 10.1.23.3 udp"
You shoule try on "anonymous" if it works or not.


> Hi,
> 
> I'm trying to set up an IPSec tunnel between a Linux machine and a Cisco
> router. Phase 1 was OK but in Phase 2 after the negotiation started I
> got errors which say "failed to get sainfo". What could have caused
> these errors ? The messages I got are like this:
> 
> 2005-02-18 12:40:41: INFO: isakmp.c:891:isakmp_ph1begin_r(): respond new
> phase 1 negotiation: 10.1.14.3[500]<=>10.1.23.3[500]
> 2005-02-18 12:40:41: INFO: isakmp.c:896:isakmp_ph1begin_r(): begin
> Identity Protection mode.
> 2005-02-18 12:40:41: WARNING: isakmp_inf.c:1343:isakmp_check_notify():
> ignore INITIAL-CONTACT notification, because it is only accepted after
> phase1.
> 2005-02-18 12:40:41: INFO: isakmp.c:2431:log_ph1established(): ISAKMP-SA
> established 10.1.14.3[500]-10.1.23.3[500]
> spi:f28e3a6f1a787258:d18318a491907e41
> 2005-02-18 12:41:11: INFO: isakmp.c:891:isakmp_ph1begin_r(): respond new
> phase 1 negotiation: 10.1.14.3[500]<=>10.1.23.3[500]
> 2005-02-18 12:41:11: INFO: isakmp.c:896:isakmp_ph1begin_r(): begin
> Identity Protection mode.
> 2005-02-18 12:41:11: WARNING: isakmp_inf.c:1343:isakmp_check_notify():
> ignore INITIAL-CONTACT notification, because it is only accepted after
> phase1.
> 2005-02-18 12:41:11: INFO: isakmp.c:2431:log_ph1established(): ISAKMP-SA
> established 10.1.14.3[500]-10.1.23.3[500]
> spi:f28e3a6fbffed6c1:0a259615632edbb6
> 2005-02-18 12:41:11: INFO: isakmp.c:1046:isakmp_ph2begin_r(): respond
> new phase 2 negotiation: 10.1.14.3[0]<=>10.1.23.3[0]
> 2005-02-18 12:41:11: ERROR: isakmp_quick.c:1811:get_sainfo_r(): failed
> to get sainfo.
> 2005-02-18 12:41:11: ERROR: isakmp_quick.c:1045:quick_r1recv(): failed
> to get sainfo.
> 2005-02-18 12:41:11: ERROR: isakmp.c:1060:isakmp_ph2begin_r(): failed to
> pre-process packet.
> 
> The setup is as follows:
> 
> In Linux:
> 
> racoon.conf:
> 
> path pre_shared_key "/etc/psk.txt";
> 
> 
> remote 10.1.23.3 {
> 		  exchange_mode main;
> 		  proposal {
> 			    encryption_algorithm des;
> 			    hash_algorithm sha1;
> 			    authentication_method pre_shared_key;
> 			    dh_group modp1024;
> 			   }
> 		  }
> 
> sainfo address 10.1.14.3/24 udp address 10.1.24.3/24 udp {
> 			pfs_group modp1024;
> 			encryption_algorithm des, 3des;
> 			authentication_algorithm hmac_md5, hmac_sha1;
> 			compression_algorithm deflate;
> 			}
> 
> Ipsec.conf:
> 
> #!/usr/sbin/setkey -f
> #
> #Flush SAD and SPD
> 
> flush;
> spdflush;
> 
> spdadd 10.1.14.3/24 10.1.24.3/24 udp -P out ipsec
> esp/tunnel/10.1.14.3-10.1.23.3/require;
> spdadd 10.1.24.3/24 10.1.14.3/24 udp -P in ipsec
> esp/tunnel/10.1.23.3-10.1.14.3/require;
> 
> In the Cisco router I just specified the same pre-shared key and the AH
> and ESP algorithms.
> 
> Thank you for any suggestion.
> 
> Thuan

YAMASHITA Yutaka