[Vpn-help] Cisco VPN 3000 and Shrew 2.1.5-rc-4(2) issue

Thu Nov 26 13:43:55 CST 2009

Hi,

I have experienced exactly the same problem since 2.1.5 rc-3, as a user
wanting to VPN to my university (so I cannot change the concentrator
config). Matthew wanted to analyze the problem, but unfortunately I got
no response from him since August or so ... I am suspecting that is has
something to do with the dead peer detection protocol (dpd).

Daniel

> From: Mathieu Ploton <mploton at gmail.com>
> Subject: [Vpn-help] Cisco VPN 3000 and Shrew 2.1.5-rc-4(2) issue
> To: vpn-help at lists.shrew.net
> Message-ID:
> 	<fcc0fade0911260656g319e9a6ax45e43ebbafc8300 at mail.gmail.com>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Hello,
>
>
>
> One of my user want to connect to the VPN3000 Concentrator with a windows 7
> 64b station.
>
>
> I'm trying to import the cisco vpn profile to
> *Shrew*vpn-client-2.1.5-rc-4(2) in order to make it work in Windows 7
> 64b.
>
>
>
> The import goes well and I'm able to connect but a few sec after the
> connection, I get this message :
>
>
>
> network device configured
> tunnel enabled
> *session terminated by gateway*
> tunnel disabled
> detached from key daemon ...
>
>
>
>    - *My concentrator is a VPN 3000 and the log does not say much :*
>
>
>
> 3758 11/24/2009 12:11:13.710 SEV=4 IKE/52 RPT=19713 remote address
> Group [vg-clients] User [toto]
> User (toto) authenticated.
>
> 3759 11/24/2009 12:11:13.720 SEV=4 IKE/149 RPT=46
> Hardware client security attribute SECURE UNIT was enabled but not requeste
>
>
>
>    - *Here is the log from shrew* :
>
>
>
> 09/11/24 12:12:18 ii : device ROOT\VNET\0000 disabled
> 09/11/24 12:12:18 ii : network process thread begin ...
> 09/11/24 12:12:18 ii : pfkey process thread begin ...
> 09/11/24 12:12:18 ii : ipc server process thread begin ...
> 09/11/24 12:12:19 ii : ipc client process thread begin ...
> 09/11/24 12:12:19 <A : peer config add message
> 09/11/24 12:12:19 DB : peer added ( obj count = 1 )
> 09/11/24 12:12:19 ii : local address 172.16.60.12 selected for peer
> 09/11/24 12:12:20 DB : tunnel added ( obj count = 1 )
> 09/11/24 12:12:20 <A : proposal config message
> 09/11/24 12:12:20 <A : proposal config message
> 09/11/24 12:12:20 <A : client config message
> 09/11/24 12:12:20 <A : xauth username message
> 09/11/24 12:12:20 <A : xauth password message
> 09/11/24 12:12:20 <A : local id 'vg-domain' message
> 09/11/24 12:12:20 <A : preshared key message
> 09/11/24 12:12:20 <A : peer tunnel enable message
> 09/11/24 12:12:20 DB : new phase1 ( ISAKMP initiator )
> 09/11/24 12:12:20 DB : exchange type is aggressive
> 09/11/24 12:12:20 DB : 172.16.60.12:500 <-> public_ip_gateway:500
> 09/11/24 12:12:20 DB : 56e1b7cb81389699:0000000000000000
> 09/11/24 12:12:20 DB : phase1 added ( obj count = 1 )
> 09/11/24 12:12:20 >> : security association payload
> 09/11/24 12:12:20 >> : - proposal #1 payload
> 09/11/24 12:12:20 >> : -- transform #1 payload
> 09/11/24 12:12:20 >> : -- transform #2 payload
> 09/11/24 12:12:20 >> : -- transform #3 payload
> 09/11/24 12:12:20 >> : -- transform #4 payload
> 09/11/24 12:12:20 >> : -- transform #5 payload
> 09/11/24 12:12:20 >> : -- transform #6 payload
> 09/11/24 12:12:20 >> : -- transform #7 payload
> 09/11/24 12:12:20 >> : -- transform #8 payload
> 09/11/24 12:12:20 >> : -- transform #9 payload
> 09/11/24 12:12:20 >> : -- transform #10 payload
> 09/11/24 12:12:20 >> : -- transform #11 payload
> 09/11/24 12:12:20 >> : -- transform #12 payload
> 09/11/24 12:12:20 >> : -- transform #13 payload
> 09/11/24 12:12:20 >> : -- transform #14 payload
> 09/11/24 12:12:20 >> : -- transform #15 payload
> 09/11/24 12:12:20 >> : -- transform #16 payload
> 09/11/24 12:12:20 >> : -- transform #17 payload
> 09/11/24 12:12:20 >> : -- transform #18 payload
> 09/11/24 12:12:20 >> : key exchange payload
> 09/11/24 12:12:20 >> : nonce payload
> 09/11/24 12:12:20 >> : identification payload
> 09/11/24 12:12:20 >> : vendor id payload
> 09/11/24 12:12:20 ii : local supports XAUTH
> 09/11/24 12:12:20 >> : vendor id payload
> 09/11/24 12:12:20 ii : local supports nat-t ( draft v00 )
> 09/11/24 12:12:20 >> : vendor id payload
> 09/11/24 12:12:20 ii : local supports nat-t ( draft v01 )
> 09/11/24 12:12:20 >> : vendor id payload
> 09/11/24 12:12:20 ii : local supports nat-t ( draft v02 )
> 09/11/24 12:12:20 >> : vendor id payload
> 09/11/24 12:12:20 ii : local supports nat-t ( draft v03 )
> 09/11/24 12:12:20 >> : vendor id payload
> 09/11/24 12:12:20 ii : local supports nat-t ( rfc )
> 09/11/24 12:12:20 >> : vendor id payload
> 09/11/24 12:12:20 ii : local supports DPDv1
> 09/11/24 12:12:20 >> : vendor id payload
> 09/11/24 12:12:20 ii : local is SHREW SOFT compatible
> 09/11/24 12:12:20 >> : vendor id payload
> 09/11/24 12:12:20 ii : local is NETSCREEN compatible
> 09/11/24 12:12:20 >> : vendor id payload
> 09/11/24 12:12:20 ii : local is SIDEWINDER compatible
> 09/11/24 12:12:20 >> : vendor id payload
> 09/11/24 12:12:20 ii : local is CISCO UNITY compatible
> 09/11/24 12:12:20 >= : cookies 56e1b7cb81389699:0000000000000000
> 09/11/24 12:12:20 >= : message 00000000
> 09/11/24 12:12:20 -> : send IKE packet 172.16.60.12:500 ->
> public_ip_gateway:500 ( 1161 bytes )
> 09/11/24 12:12:20 DB : phase1 resend event scheduled ( ref count = 2 )
> 09/11/24 12:12:20 <- : recv IKE packet public_ip_gateway:500 ->
> 172.16.60.12:500 ( 460 bytes )
> 09/11/24 12:12:20 DB : phase1 found
> 09/11/24 12:12:20 ii : processing phase1 packet ( 460 bytes )
> 09/11/24 12:12:20 =< : cookies 56e1b7cb81389699:ff96e981de6ec185
> 09/11/24 12:12:20 =< : message 00000000
> 09/11/24 12:12:20 << : security association payload
> 09/11/24 12:12:20 << : - propsal #1 payload
> 09/11/24 12:12:20 << : -- transform #14 payload
> 09/11/24 12:12:20 ii : unmatched isakmp proposal/transform
> 09/11/24 12:12:20 ii : cipher type ( 3des != aes )
> 09/11/24 12:12:20 ii : unmatched isakmp proposal/transform
> 09/11/24 12:12:20 ii : cipher type ( 3des != aes )
> 09/11/24 12:12:20 ii : unmatched isakmp proposal/transform
> 09/11/24 12:12:20 ii : cipher type ( 3des != aes )
> 09/11/24 12:12:20 ii : unmatched isakmp proposal/transform
> 09/11/24 12:12:20 ii : cipher type ( 3des != aes )
> 09/11/24 12:12:20 ii : unmatched isakmp proposal/transform
> 09/11/24 12:12:20 ii : cipher type ( 3des != aes )
> 09/11/24 12:12:20 ii : unmatched isakmp proposal/transform
> 09/11/24 12:12:20 ii : cipher type ( 3des != aes )
> 09/11/24 12:12:20 ii : unmatched isakmp proposal/transform
> 09/11/24 12:12:20 ii : cipher type ( 3des != blowfish )
> 09/11/24 12:12:20 ii : unmatched isakmp proposal/transform
> 09/11/24 12:12:20 ii : cipher type ( 3des != blowfish )
> 09/11/24 12:12:20 ii : unmatched isakmp proposal/transform
> 09/11/24 12:12:20 ii : cipher type ( 3des != blowfish )
> 09/11/24 12:12:20 ii : unmatched isakmp proposal/transform
> 09/11/24 12:12:20 ii : cipher type ( 3des != blowfish )
> 09/11/24 12:12:20 ii : unmatched isakmp proposal/transform
> 09/11/24 12:12:20 ii : cipher type ( 3des != blowfish )
> 09/11/24 12:12:20 ii : unmatched isakmp proposal/transform
> 09/11/24 12:12:20 ii : cipher type ( 3des != blowfish )
> 09/11/24 12:12:20 ii : unmatched isakmp proposal/transform
> 09/11/24 12:12:20 ii : hash type ( hmac-sha != hmac-md5 )
> 09/11/24 12:12:20 ii : matched isakmp proposal #1 transform #14
> 09/11/24 12:12:20 ii : - transform    = ike
> 09/11/24 12:12:20 ii : - cipher type  = 3des
> 09/11/24 12:12:20 ii : - key length   = default
> 09/11/24 12:12:20 ii : - hash type    = sha1
> 09/11/24 12:12:20 ii : - dh group     = modp-1024
> 09/11/24 12:12:20 ii : - auth type    = xauth-initiator-psk
> 09/11/24 12:12:20 ii : - life seconds = 86400
> 09/11/24 12:12:20 ii : - life kbytes  = 0
> 09/11/24 12:12:20 << : key exchange payload
> 09/11/24 12:12:20 << : nonce payload
> 09/11/24 12:12:20 << : identification payload
> 09/11/24 12:12:20 ii : phase1 id target is any
> 09/11/24 12:12:20 ii : phase1 id match
> 09/11/24 12:12:20 ii : received = ipv4-host public_ip_gateway
> 09/11/24 12:12:20 << : hash payload
> 09/11/24 12:12:20 << : vendor id payload
> 09/11/24 12:12:20 ii : peer is CISCO UNITY compatible
> 09/11/24 12:12:20 << : vendor id payload
> 09/11/24 12:12:20 ii : peer supports XAUTH
> 09/11/24 12:12:20 << : vendor id payload
> 09/11/24 12:12:20 ii : peer supports DPDv1
> 09/11/24 12:12:20 << : vendor id payload
> 09/11/24 12:12:20 ii : peer supports nat-t ( draft v02 )
> 09/11/24 12:12:20 << : nat discovery payload
> 09/11/24 12:12:20 << : nat discovery payload
> 09/11/24 12:12:20 << : vendor id payload
> 09/11/24 12:12:20 ii : unknown vendor id ( 20 bytes )
> 09/11/24 12:12:20 0x : 4048b7d5 6ebce885 25e7de7f 00d6c2d3 c0000000
> 09/11/24 12:12:20 << : vendor id payload
> 09/11/24 12:12:20 ii : unknown vendor id ( 16 bytes )
> 09/11/24 12:12:20 0x : 0a514e9c de6fc185 4ba3f52b 64aeb625
> 09/11/24 12:12:20 << : vendor id payload
> 09/11/24 12:12:20 ii : unknown vendor id ( 16 bytes )
> 09/11/24 12:12:20 0x : 1f07f70e aa6514d3 b0fa9654 2a500401
> 09/11/24 12:12:20 ii : nat discovery - local address is translated
> 09/11/24 12:12:20 ii : switching to src nat-t udp port 4500
> 09/11/24 12:12:20 ii : switching to dst nat-t udp port 4500
> 09/11/24 12:12:20 == : DH shared secret ( 128 bytes )
> 09/11/24 12:12:20 == : SETKEYID ( 20 bytes )
> 09/11/24 12:12:20 == : SETKEYID_d ( 20 bytes )
> 09/11/24 12:12:20 == : SETKEYID_a ( 20 bytes )
> 09/11/24 12:12:20 == : SETKEYID_e ( 20 bytes )
> 09/11/24 12:12:20 == : cipher key ( 40 bytes )
> 09/11/24 12:12:20 == : cipher iv ( 8 bytes )
> 09/11/24 12:12:20 == : phase1 hash_i ( computed ) ( 20 bytes )
> 09/11/24 12:12:20 >> : hash payload
> 09/11/24 12:12:20 >> : nat discovery payload
> 09/11/24 12:12:20 >> : nat discovery payload
> 09/11/24 12:12:20 >= : cookies 56e1b7cb81389699:ff96e981de6ec185
> 09/11/24 12:12:20 >= : message 00000000
> 09/11/24 12:12:20 >= : encrypt iv ( 8 bytes )
> 09/11/24 12:12:20 == : encrypt packet ( 100 bytes )
> 09/11/24 12:12:20 == : stored iv ( 8 bytes )
> 09/11/24 12:12:20 DB : phase1 resend event canceled ( ref count = 1 )
> 09/11/24 12:12:20 -> : send NAT-T:IKE packet 172.16.60.12:4500 ->
> public_ip_gateway:4500 ( 132 bytes )
> 09/11/24 12:12:20 == : phase1 hash_r ( computed ) ( 20 bytes )
> 09/11/24 12:12:20 == : phase1 hash_r ( received ) ( 20 bytes )
> 09/11/24 12:12:20 ii : phase1 sa established
> 09/11/24 12:12:20 ii : public_ip_gateway:4500 <-> 172.16.60.12:4500
> 09/11/24 12:12:20 ii : 56e1b7cb81389699:ff96e981de6ec185
> 09/11/24 12:12:20 ii : sending peer INITIAL-CONTACT notification
> 09/11/24 12:12:20 ii : - 172.16.60.12:4500 -> public_ip_gateway:4500
> 09/11/24 12:12:20 ii : - isakmp spi = 56e1b7cb81389699:ff96e981de6ec185
> 09/11/24 12:12:20 ii : - data size 0
> 09/11/24 12:12:20 >> : hash payload
> 09/11/24 12:12:20 >> : notification payload
> 09/11/24 12:12:20 == : new informational hash ( 20 bytes )
> 09/11/24 12:12:20 == : new informational iv ( 8 bytes )
> 09/11/24 12:12:20 >= : cookies 56e1b7cb81389699:ff96e981de6ec185
> 09/11/24 12:12:20 >= : message 7606f5a3
> 09/11/24 12:12:20 >= : encrypt iv ( 8 bytes )
> 09/11/24 12:12:20 == : encrypt packet ( 80 bytes )
> 09/11/24 12:12:20 == : stored iv ( 8 bytes )
> 09/11/24 12:12:20 -> : send NAT-T:IKE packet 172.16.60.12:4500 ->
> public_ip_gateway:4500 ( 116 bytes )
> 09/11/24 12:12:20 DB : phase2 not found
> 09/11/24 12:12:20 <- : recv NAT-T:IKE packet public_ip_gateway:4500 ->
> 172.16.60.12:4500 ( 116 bytes )
> 09/11/24 12:12:20 DB : phase1 found
> 09/11/24 12:12:20 ii : processing config packet ( 116 bytes )
> 09/11/24 12:12:20 DB : config not found
> 09/11/24 12:12:20 DB : config added ( obj count = 1 )
> 09/11/24 12:12:20 == : new config iv ( 8 bytes )
> 09/11/24 12:12:20 =< : cookies 56e1b7cb81389699:ff96e981de6ec185
> 09/11/24 12:12:20 =< : message 0181be70
> 09/11/24 12:12:20 =< : decrypt iv ( 8 bytes )
> 09/11/24 12:12:20 == : decrypt packet ( 116 bytes )
> 09/11/24 12:12:20 <= : stored iv ( 8 bytes )
> 09/11/24 12:12:20 << : hash payload
> 09/11/24 12:12:20 << : attribute payload
> 09/11/24 12:12:20 == : configure hash_i ( computed ) ( 20 bytes )
> 09/11/24 12:12:20 == : configure hash_c ( computed ) ( 20 bytes )
> 09/11/24 12:12:20 ii : configure hash verified
> 09/11/24 12:12:20 ii : - xauth authentication type
> 09/11/24 12:12:20 ii : - xauth username
> 09/11/24 12:12:20 !! : warning, unhandled xauth attribute 16526
> 09/11/24 12:12:20 ii : - xauth password
> 09/11/24 12:12:20 ii : received basic xauth request - Enter Username,
> Password and Domain.
> 09/11/24 12:12:20 ii : - standard xauth username
> 09/11/24 12:12:20 ii : - standard xauth password
> 09/11/24 12:12:20 ii : sending xauth response for mathieu.ploton
> 09/11/24 12:12:20 >> : hash payload
> 09/11/24 12:12:20 >> : attribute payload
> 09/11/24 12:12:20 == : new configure hash ( 20 bytes )
> 09/11/24 12:12:20 >= : cookies 56e1b7cb81389699:ff96e981de6ec185
> 09/11/24 12:12:20 >= : message 0181be70
> 09/11/24 12:12:20 >= : encrypt iv ( 8 bytes )
> 09/11/24 12:12:20 == : encrypt packet ( 95 bytes )
> 09/11/24 12:12:20 == : stored iv ( 8 bytes )
> 09/11/24 12:12:20 -> : send NAT-T:IKE packet 172.16.60.12:4500 ->
> public_ip_gateway:4500 ( 132 bytes )
> 09/11/24 12:12:20 DB : config resend event scheduled ( ref count = 2 )
> 09/11/24 12:12:22 <- : recv NAT-T:IKE packet public_ip_gateway:4500 ->
> 172.16.60.12:4500 ( 68 bytes )
> 09/11/24 12:12:22 DB : phase1 found
> 09/11/24 12:12:22 ii : processing config packet ( 68 bytes )
> 09/11/24 12:12:22 DB : config found
> 09/11/24 12:12:22 == : new config iv ( 8 bytes )
> 09/11/24 12:12:22 =< : cookies 56e1b7cb81389699:ff96e981de6ec185
> 09/11/24 12:12:22 =< : message 28b9cd9c
> 09/11/24 12:12:22 =< : decrypt iv ( 8 bytes )
> 09/11/24 12:12:22 == : decrypt packet ( 68 bytes )
> 09/11/24 12:12:22 <= : trimmed packet padding ( 4 bytes )
> 09/11/24 12:12:22 <= : stored iv ( 8 bytes )
> 09/11/24 12:12:22 << : hash payload
> 09/11/24 12:12:22 << : attribute payload
> 09/11/24 12:12:22 == : configure hash_i ( computed ) ( 20 bytes )
> 09/11/24 12:12:22 == : configure hash_c ( computed ) ( 20 bytes )
> 09/11/24 12:12:22 ii : configure hash verified
> 09/11/24 12:12:22 ii : received xauth result -
> 09/11/24 12:12:22 ii : user mathieu.ploton authentication succeeded
> 09/11/24 12:12:22 ii : sending xauth acknowledge
> 09/11/24 12:12:22 >> : hash payload
> 09/11/24 12:12:22 >> : attribute payload
> 09/11/24 12:12:22 == : new configure hash ( 20 bytes )
> 09/11/24 12:12:22 >= : cookies 56e1b7cb81389699:ff96e981de6ec185
> 09/11/24 12:12:22 >= : message 28b9cd9c
> 09/11/24 12:12:22 >= : encrypt iv ( 8 bytes )
> 09/11/24 12:12:22 == : encrypt packet ( 60 bytes )
> 09/11/24 12:12:22 == : stored iv ( 8 bytes )
> 09/11/24 12:12:22 DB : config resend event canceled ( ref count = 1 )
> 09/11/24 12:12:22 -> : send NAT-T:IKE packet 172.16.60.12:4500 ->
> public_ip_gateway:4500 ( 92 bytes )
> 09/11/24 12:12:22 DB : config resend event scheduled ( ref count = 2 )
> 09/11/24 12:12:22 ii : building config attribute list
> 09/11/24 12:12:22 ii : - IP4 Address
> 09/11/24 12:12:22 ii : - Address Expiry
> 09/11/24 12:12:22 ii : - IP4 Netamask
> 09/11/24 12:12:22 ii : - IP4 DNS Server
> 09/11/24 12:12:22 ii : - IP4 WINS Server
> 09/11/24 12:12:22 ii : - DNS Suffix
> 09/11/24 12:12:22 ii : - IP4 Split Network Include
> 09/11/24 12:12:22 ii : - IP4 Split Network Exclude
> 09/11/24 12:12:22 ii : - Login Banner
> 09/11/24 12:12:22 ii : - PFS Group
> 09/11/24 12:12:22 ii : - Save Password
> 09/11/24 12:12:22 == : new config iv ( 8 bytes )
> 09/11/24 12:12:22 ii : sending config pull request
> 09/11/24 12:12:22 >> : hash payload
> 09/11/24 12:12:22 >> : attribute payload
> 09/11/24 12:12:22 == : new configure hash ( 20 bytes )
> 09/11/24 12:12:22 >= : cookies 56e1b7cb81389699:ff96e981de6ec185
> 09/11/24 12:12:22 >= : message 2be9d912
> 09/11/24 12:12:22 >= : encrypt iv ( 8 bytes )
> 09/11/24 12:12:22 == : encrypt packet ( 104 bytes )
> 09/11/24 12:12:22 == : stored iv ( 8 bytes )
> 09/11/24 12:12:22 DB : config resend event canceled ( ref count = 1 )
> 09/11/24 12:12:22 -> : send NAT-T:IKE packet 172.16.60.12:4500 ->
> public_ip_gateway:4500 ( 140 bytes )
> 09/11/24 12:12:22 DB : config resend event scheduled ( ref count = 2 )
> 09/11/24 12:12:22 <- : recv NAT-T:IKE packet public_ip_gateway:4500 ->
> 172.16.60.12:4500 ( 252 bytes )
> 09/11/24 12:12:22 DB : phase1 found
> 09/11/24 12:12:22 ii : processing config packet ( 252 bytes )
> 09/11/24 12:12:22 DB : config found
> 09/11/24 12:12:22 =< : cookies 56e1b7cb81389699:ff96e981de6ec185
> 09/11/24 12:12:22 =< : message 2be9d912
> 09/11/24 12:12:22 =< : decrypt iv ( 8 bytes )
> 09/11/24 12:12:22 == : decrypt packet ( 252 bytes )
> 09/11/24 12:12:22 <= : trimmed packet padding ( 4 bytes )
> 09/11/24 12:12:22 <= : stored iv ( 8 bytes )
> 09/11/24 12:12:22 << : hash payload
> 09/11/24 12:12:22 << : attribute payload
> 09/11/24 12:12:22 == : configure hash_i ( computed ) ( 20 bytes )
> 09/11/24 12:12:22 == : configure hash_c ( computed ) ( 20 bytes )
> 09/11/24 12:12:22 ii : configure hash verified
> 09/11/24 12:12:22 ii : received config pull response
> 09/11/24 12:12:22 ii : - IP4 Address = 192.168.3.1
> 09/11/24 12:12:22 ii : - IP4 DNS Server = 172.21.10.10
> 09/11/24 12:12:22 ii : - IP4 DNS Server = 172.24.10.31
> 09/11/24 12:12:22 ii : - IP4 WINS Server = 172.21.10.10
> 09/11/24 12:12:22 ii : - IP4 WINS Server = 172.24.10.31
> 09/11/24 12:12:22 ii : - Login Banner = Welcome in the  ...
> 09/11/24 12:12:22 ii : - Save Password = 0
> 09/11/24 12:12:22 ii : - PFS Group = 1
> 09/11/24 12:12:22 DB : config resend event canceled ( ref count = 1 )
> 09/11/24 12:12:22 !! : invalid private netmask, defaulting to class c
> 09/11/24 12:12:26 ii : VNET adapter MTU is 1500
> 09/11/24 12:12:26 ii : enabled adapter ROOT\VNET\0000
> 09/11/24 12:12:26 ii : creating NONE INBOUND policy ANY:public_ip_gateway:*
> -> ANY:172.16.60.12:*
> 09/11/24 12:12:26 DB : policy added ( obj count = 1 )
> 09/11/24 12:12:26 K> : send pfkey X_SPDADD UNSPEC message
> 09/11/24 12:12:26 ii : creating NONE OUTBOUND policy ANY:172.16.60.12:* ->
> ANY:public_ip_gateway:*
> 09/11/24 12:12:26 K< : recv pfkey X_SPDADD UNSPEC message
> 09/11/24 12:12:26 DB : policy found
> 09/11/24 12:12:26 ii : created NONE policy route for public_ip_gateway/32
> 09/11/24 12:12:26 DB : policy added ( obj count = 2 )
> 09/11/24 12:12:26 K> : send pfkey X_SPDADD UNSPEC message
> 09/11/24 12:12:26 ii : creating IPSEC INBOUND policy ANY:0.0.0.0/0:* ->
> ANY:192.168.1.1:*
> 09/11/24 12:12:26 DB : policy added ( obj count = 3 )
> 09/11/24 12:12:26 K> : send pfkey X_SPDADD UNSPEC message
> 09/11/24 12:12:26 ii : creating IPSEC OUTBOUND policy ANY:192.168.1.1:* ->
> ANY:0.0.0.0/0:*
> 09/11/24 12:12:26 K< : recv pfkey X_SPDADD UNSPEC message
> 09/11/24 12:12:26 DB : policy found
> 09/11/24 12:12:26 ii : calling init phase2 for nailed policy
> 09/11/24 12:12:26 DB : policy found
> 09/11/24 12:12:26 DB : policy not found
> 09/11/24 12:12:26 !! : unable to locate inbound policy for init phase2
> 09/11/24 12:12:26 ii : calling init phase2 for initial policy
> 09/11/24 12:12:26 DB : policy found
> 09/11/24 12:12:26 DB : policy not found
> 09/11/24 12:12:26 !! : unable to locate inbound policy for init phase2
> 09/11/24 12:12:26 K< : recv pfkey X_SPDADD UNSPEC message
> 09/11/24 12:12:26 DB : policy found
> 09/11/24 12:12:29 ii : created IPSEC policy route for 0.0.0.0
> 09/11/24 12:12:29 DB : policy added ( obj count = 4 )
> 09/11/24 12:12:29 K> : send pfkey X_SPDADD UNSPEC message
> 09/11/24 12:12:29 ii : split DNS is disabled
> 09/11/24 12:12:29 K< : recv pfkey X_SPDADD UNSPEC message
> 09/11/24 12:12:29 DB : policy found
> 09/11/24 12:12:29 ii : calling init phase2 for nailed policy
> 09/11/24 12:12:29 DB : policy found
> 09/11/24 12:12:29 DB : policy found
> 09/11/24 12:12:29 DB : tunnel found
> 09/11/24 12:12:29 DB : new phase2 ( IPSEC initiator )
> 09/11/24 12:12:29 DB : phase2 added ( obj count = 1 )
> 09/11/24 12:12:29 K> : send pfkey GETSPI ESP message
> 09/11/24 12:12:29 K< : recv pfkey ACQUIRE UNSPEC message
> 09/11/24 12:12:29 DB : policy found
> 09/11/24 12:12:29 ii : ignoring init phase2 by acquire, tunnel is nailed
> 09/11/24 12:12:29 K< : recv pfkey GETSPI ESP message
> 09/11/24 12:12:29 DB : phase2 found
> 09/11/24 12:12:29 ii : updated spi for 1 ipsec-esp proposal
> 09/11/24 12:12:29 DB : phase1 found
> 09/11/24 12:12:29 >> : hash payload
> 09/11/24 12:12:29 >> : security association payload
> 09/11/24 12:12:29 >> : - proposal #1 payload
> 09/11/24 12:12:29 >> : -- transform #1 payload
> 09/11/24 12:12:29 >> : -- transform #2 payload
> 09/11/24 12:12:29 >> : -- transform #3 payload
> 09/11/24 12:12:29 >> : -- transform #4 payload
> 09/11/24 12:12:29 >> : -- transform #5 payload
> 09/11/24 12:12:29 >> : -- transform #6 payload
> 09/11/24 12:12:29 >> : -- transform #7 payload
> 09/11/24 12:12:29 >> : -- transform #8 payload
> 09/11/24 12:12:29 >> : -- transform #9 payload
> 09/11/24 12:12:29 >> : -- transform #10 payload
> 09/11/24 12:12:29 >> : -- transform #11 payload
> 09/11/24 12:12:29 >> : -- transform #12 payload
> 09/11/24 12:12:29 >> : -- transform #13 payload
> 09/11/24 12:12:29 >> : -- transform #14 payload
> 09/11/24 12:12:29 >> : -- transform #15 payload
> 09/11/24 12:12:29 >> : -- transform #16 payload
> 09/11/24 12:12:29 >> : -- transform #17 payload
> 09/11/24 12:12:29 >> : -- transform #18 payload
> 09/11/24 12:12:29 >> : nonce payload
> 09/11/24 12:12:29 >> : key exchange payload
> 09/11/24 12:12:29 >> : identification payload
> 09/11/24 12:12:29 >> : identification payload
> 09/11/24 12:12:29 == : phase2 hash_i ( input ) ( 804 bytes )
> 09/11/24 12:12:29 == : phase2 hash_i ( computed ) ( 20 bytes )
> 09/11/24 12:12:29 == : new phase2 iv ( 8 bytes )
> 09/11/24 12:12:29 >= : cookies 56e1b7cb81389699:ff96e981de6ec185
> 09/11/24 12:12:29 >= : message 68cb6858
> 09/11/24 12:12:29 >= : encrypt iv ( 8 bytes )
> 09/11/24 12:12:29 == : encrypt packet ( 852 bytes )
> 09/11/24 12:12:29 == : stored iv ( 8 bytes )
> 09/11/24 12:12:29 -> : send NAT-T:IKE packet 172.16.60.12:4500 ->
> public_ip_gateway:4500 ( 884 bytes )
> 09/11/24 12:12:29 DB : phase2 resend event scheduled ( ref count = 2 )
> 09/11/24 12:12:29 <- : recv NAT-T:IKE packet public_ip_gateway:4500 ->
> 172.16.60.12:4500 ( 84 bytes )
> 09/11/24 12:12:29 DB : phase1 found
> 09/11/24 12:12:29 ii : processing informational packet ( 84 bytes )
> 09/11/24 12:12:29 == : new informational iv ( 8 bytes )
> 09/11/24 12:12:29 =< : cookies 56e1b7cb81389699:ff96e981de6ec185
> 09/11/24 12:12:29 =< : message 43d5efde
> 09/11/24 12:12:29 =< : decrypt iv ( 8 bytes )
> 09/11/24 12:12:29 == : decrypt packet ( 84 bytes )
> 09/11/24 12:12:29 <= : trimmed packet padding ( 4 bytes )
> 09/11/24 12:12:29 <= : stored iv ( 8 bytes )
> 09/11/24 12:12:29 << : hash payload
> 09/11/24 12:12:29 << : delete payload
> 09/11/24 12:12:29 == : informational hash_i ( computed ) ( 20 bytes )
> 09/11/24 12:12:29 == : informational hash_c ( received ) ( 20 bytes )
> 09/11/24 12:12:29 ii : informational hash verified
> *09/11/24 12:12:29 ii : received peer DELETE message
> 09/11/24 12:12:29 ii : - public_ip_gateway:4500 -> 172.16.60.12:4500
> 09/11/24 12:12:29 ii : - isakmp spi = 56e1b7cb81389699:ff96e981de6ec185
> 09/11/24 12:12:29 DB : phase1 found
> 09/11/24 12:12:29 ii : cleanup, marked phase1
> 56e1b7cb81389699:ff96e981de6ec185 for removal
> 09/11/24 12:12:29 DB : phase1 soft event canceled ( ref count = 4 )
> 09/11/24 12:12:29 DB : phase1 hard event canceled ( ref count = 3 )
> 09/11/24 12:12:29 DB : phase1 dead event canceled ( ref count = 2 )
> 09/11/24 12:12:29 DB : config deleted ( obj count = 0 )
> 09/11/24 12:12:29 ii : phase1 removal before expire time
> 09/11/24 12:12:29 DB : phase1 not found
> 09/11/24 12:12:29 DB : phase1 deleted ( obj count = 0 )
> 09/11/24 12:12:29 DB : policy found
> 09/11/24 12:12:29 ii : removing IPSEC INBOUND policy ANY:0.0.0.0/0:* ->
> ANY:192.168.1.1:*
> 09/11/24 12:12:29 K> : send pfkey X_SPDDELETE2 UNSPEC message
> 09/11/24 12:12:29 DB : policy found
> 09/11/24 12:12:29 ii : removing IPSEC OUTBOUND policy ANY:192.168.1.1:* ->
> ANY:0.0.0.0/0:*
> 09/11/24 12:12:29 K> : send pfkey X_SPDDELETE2 UNSPEC message
> 09/11/24 12:12:29 K< : recv pfkey X_SPDDELETE2 UNSPEC message
> 09/11/24 12:12:29 ii : removed IPSEC policy route for ANY:0.0.0.0/0:*
> 09/11/24 12:12:29 DB : policy found
> 09/11/24 12:12:29 ii : removing NONE INBOUND policy ANY:public_ip_gateway:*
> -> ANY:172.16.60.12:*
> 09/11/24 12:12:29 K> : send pfkey X_SPDDELETE2 UNSPEC message
> 09/11/24 12:12:29 DB : policy found
> 09/11/24 12:12:29 ii : removing NONE OUTBOUND policy ANY:172.16.60.12:* ->
> ANY:public_ip_gateway:*
> 09/11/24 12:12:29 K> : send pfkey X_SPDDELETE2 UNSPEC message
> 09/11/24 12:12:29 ii : removed NONE policy route for ANY:public_ip_gateway:*
> 09/11/24 12:12:29 DB : policy found
> 09/11/24 12:12:29 DB : policy deleted ( obj count = 3 )
> 09/11/24 12:12:29 K< : recv pfkey X_SPDDELETE2 UNSPEC message
> 09/11/24 12:12:29 DB : policy found
> 09/11/24 12:12:29 K< : recv pfkey X_SPDDELETE2 UNSPEC message
> 09/11/24 12:12:29 DB : policy found*
> 09/11/24 12:12:29 DB : policy deleted ( obj count = 2 )
> 09/11/24 12:12:29 ii : disabled adapter ROOT\VNET\0000
> 09/11/24 12:12:29 DB : tunnel dpd event canceled ( ref count = 4 )
> 09/11/24 12:12:29 DB : tunnel natt event canceled ( ref count = 3 )
> 09/11/24 12:12:29 DB : tunnel stats event canceled ( ref count = 2 )
> 09/11/24 12:12:29 DB : removing tunnel config references
> 09/11/24 12:12:29 DB : removing tunnel phase2 references
> 09/11/24 12:12:29 DB : phase2 resend event canceled ( ref count = 1 )
> 09/11/24 12:12:29 ii : phase2 removal before expire time
> 09/11/24 12:12:29 DB : phase2 deleted ( obj count = 0 )
> 09/11/24 12:12:29 DB : removing tunnel phase1 references
> 09/11/24 12:12:29 DB : tunnel deleted ( obj count = 0 )
> 09/11/24 12:12:29 K< : recv pfkey X_SPDDELETE2 UNSPEC message
> 09/11/24 12:12:29 DB : policy found
> 09/11/24 12:12:29 DB : policy deleted ( obj count = 1 )
> 09/11/24 12:12:29 DB : removing all peer tunnel refrences
> 09/11/24 12:12:29 DB : peer deleted ( obj count = 0 )
> 09/11/24 12:12:29 ii : ipc client process thread exit ...
> 09/11/24 12:12:33 ii : halt signal received, shutting down
> 09/11/24 12:12:33 ii : pfkey process thread exit ...
> 09/11/24 12:12:33 ii : ipc server process thread exit ...
> 09/11/24 12:12:33 ii : network process thread exit ...
>
>
>
>
>
> And the Shrew Profile :
>
>
>
> n:version:3
> n:network-ike-port:500
> n:network-mtu-size:1380
> n:client-addr-auto:1
> n:network-natt-port:4500
> n:network-natt-rate:15
> n:network-frag-size:540
> n:network-dpd-enable:1
> n:network-notify-enable:1
> n:client-banner-enable:1
> n:phase1-dhgroup:2
> n:phase1-life-secs:86400
> n:client-dns-used:1
> n:client-dns-auto:1
> n:client-dns-suffix-auto:1
> n:client-splitdns-used:0
> n:client-splitdns-auto:0
> n:client-wins-used:1
> n:client-wins-auto:1
> n:phase2-life-secs:3600
> n:phase2-life-kbytes:0
> n:policy-nailed:1
> n:policy-list-auto:1
> s:client-saved-username:user
> n:phase1-life-kbytes:0
> n:vendor-chkpt-enable:0
> s:network-host:gateway_ip_adress
> s:client-auto-mode:pull
> s:client-iface:virtual
> s:network-natt-mode:enable
> s:network-frag-mode:disable
> s:auth-method:mutual-psk-xauth
> s:ident-client-type:keyid
> s:ident-server-type:any
> s:ident-client-data:vg-domain
> b:auth-mutual-psk:pass
> s:phase1-exchange:aggressive
> s:phase1-cipher:auto
> s:phase1-hash:auto
> s:phase2-transform:auto
> s:phase2-hmac:auto
> s:ipcomp-transform:disabled
> n:phase2-pfsgroup:0
>
>
>
> Thank you for your help !
>   