<HTML>
<HEAD>
<TITLE>RE: [vpn-help] -12 against ipsec-tools 0.6.6</TITLE>
</HEAD>
<BODY>
<FONT FACE="Verdana"><SPAN STYLE='font-size:12.0px'><BR>
I’ll see if I can test some more configurations, but here is my simplest test. <BR>
<BR>
## : IPSEC Daemon, Aug 6 2006<BR>
## : Copyright 2005 Shrew Soft Inc.<BR>
## : This product linked OpenSSL 0.9.8a 11 Oct 2005<BR>
ii : rebuilding interface list ...<BR>
ii : interface IP=10.1.200.165, MTU=1500 active<BR>
ii : 1 adapter(s) active<BR>
ii : client ctrl thread begin ...<BR>
DB : tunnel added<BR>
DB : tunnel dereferenced ( ref count = 0, tunnel count = 1 )<BR>
ii : peer config message received<BR>
DB : ipsec peer not found<BR>
ii : local address selected for peer<BR>
ii : 10.1.200.165 ( CNet PRO200WL PCI Fast Ethernet Adapter - Packet Scheduler Miniport )<BR>
ii : user credentials message received<BR>
ii : client keyfile message received<BR>
ii : '\Documents and Settings\peter\Desktop\certs\ca.crt' loaded<BR>
ii : tunnel enable message received<BR>
DB : new phase1 sa ( ISAKMP initiator )<BR>
DB : exchange type is aggressive<BR>
DB : 10.1.200.165:500 <-> 10.1.101.26:500<BR>
DB : 43dc7d87141edc41:0000000000000000<BR>
DB : phase1 sa added<BR>
>> : security association payload<BR>
>> : key exchange payload<BR>
>> : nonce payload<BR>
>> : identification payload<BR>
>> : vendor id payload<BR>
>> : vendor id payload<BR>
>> : vendor id payload<BR>
>> : vendor id payload<BR>
>> : vendor id payload<BR>
-> : send IKE packet to 10.1.101.26:500 ( 344 bytes )<BR>
DB : phase1 sa dereferenced ( ref count = 0, phase1 count = 1 )<BR>
ii : vnet inf 'C:\Program Files\ShrewSoft\VPN Client\drivers\virtualnet.inf'<BR>
<- : recv IKE packet from 10.1.101.26:500 ( 548 bytes )<BR>
DB : ipsec peer found<BR>
DB : phase1 sa found<BR>
<< : fragment payload<BR>
ii : ike fragment received, waiting on complete packet<BR>
DB : phase1 sa dereferenced ( ref count = 0, phase1 count = 1 )<BR>
DB : tunnel dereferenced ( ref count = 1, tunnel count = 1 )<BR>
<- : recv IKE packet from 10.1.101.26:500 ( 548 bytes )<BR>
DB : ipsec peer found<BR>
DB : phase1 sa found<BR>
<< : fragment payload<BR>
ii : ike fragment received, waiting on complete packet<BR>
DB : phase1 sa dereferenced ( ref count = 0, phase1 count = 1 )<BR>
DB : tunnel dereferenced ( ref count = 1, tunnel count = 1 )<BR>
<- : recv IKE packet from 10.1.101.26:500 ( 548 bytes )<BR>
DB : ipsec peer found<BR>
DB : phase1 sa found<BR>
<< : fragment payload<BR>
ii : ike fragment received, waiting on complete packet<BR>
DB : phase1 sa dereferenced ( ref count = 0, phase1 count = 1 )<BR>
DB : tunnel dereferenced ( ref count = 1, tunnel count = 1 )<BR>
<- : recv IKE packet from 10.1.101.26:500 ( 396 bytes )<BR>
DB : ipsec peer found<BR>
DB : phase1 sa found<BR>
<< : fragment payload<BR>
ii : ike fragment received, processing complete packet<BR>
<< : security association payload<BR>
ii : matched phase1 proposal<BR>
ii : - protocol = isakmp<BR>
ii : - transform = ike<BR>
ii : - key length = default<BR>
ii : - cipher type = 3des<BR>
ii : - hash type = md5<BR>
ii : - dh group = modp-1024<BR>
ii : - auth type = hybrid-initiator-rsa<BR>
ii : - life seconds = 86400<BR>
ii : - life kbytes = 0<BR>
<< : key exchange payload<BR>
<< : nonce payload<BR>
<< : identification payload<BR>
<< : certificate payload<BR>
<< : signature payload<BR>
<< : vendor id payload<BR>
ii : peer supports XAUTH<BR>
<< : vendor id payload<BR>
ii : peer supports UNITY<BR>
<< : cert request payload<BR>
<< : vendor id payload<BR>
ii : peer supports NAT-T RFC<BR>
<< : nat discovery payload<BR>
<< : nat discovery payload<BR>
== : DH shared secret ( 128 bytes )<BR>
== : SETKEYID ( 16 bytes )<BR>
== : SETKEYID_d ( 16 bytes )<BR>
== : SETKEYID_a ( 16 bytes )<BR>
== : SETKEYID_e ( 16 bytes )<BR>
== : cipher key ( 32 bytes )<BR>
== : cipher iv ( 8 bytes )<BR>
== : phase1 hash_i ( computed ) ( 16 bytes )<BR>
>> : hash payload<BR>
>> : nat discovery payload<BR>
>= : encrypt iv ( 8 bytes )<BR>
=> : encrypt packet ( 68 bytes )<BR>
== : stored iv ( 8 bytes )<BR>
-> : send IKE packet to 10.1.101.26:500 ( 68 bytes )<BR>
ii : unable to get certificate CRL(3) at depth:0<BR>
ii : subject :/C=US/ST=Minnesota/L=Minneapolis/O=VisionShare, Inc./OU=Managed Services/CN=cow.visionshareinc.com/emailAddress=peter.eisch@visionshareinc.com<BR>
ii : unable to get certificate CRL(3) at depth:1<BR>
ii : subject :/C=US/ST=Minnesota/L=Minneapolis/O=VisionShare, Inc./OU=Managed Services/CN=vpnca.visionshareinc.com/emailAddress=peter.eisch@visionshareinc.com<BR>
== : phase1 hash_r ( computed ) ( 16 bytes )<BR>
== : phase1 hash_r ( received ) ( 16 bytes )<BR>
II | phase1 sa established<BR>
II | 10.1.200.165:500 <-> 10.1.101.26:500<BR>
II | 43dc7d87141edc41:df266e207a5fc429<BR>
>> : hash payload<BR>
>> : notification payload<BR>
== : new informational hash ( 16 bytes )<BR>
== : new phase2 iv ( 8 bytes )<BR>
>= : encrypt iv ( 8 bytes )<BR>
=> : encrypt packet ( 76 bytes )<BR>
== : stored iv ( 8 bytes )<BR>
-> : send IKE packet to 10.1.101.26:500 ( 76 bytes )<BR>
II | sent peer notification, INITIAL-CONTACT<BR>
II | 10.1.200.165 -> 10.1.101.26<BR>
II | isakmp spi = 43dc7d87141edc41:df266e207a5fc429<BR>
DB : phase1 sa dereferenced ( ref count = 0, phase1 count = 1 )<BR>
DB : tunnel dereferenced ( ref count = 1, tunnel count = 1 )<BR>
<- : recv IKE packet from 10.1.101.26:500 ( 76 bytes )<BR>
DB : ipsec peer found<BR>
DB : phase1 sa found<BR>
DB : config not found<BR>
DB : config added<BR>
== : new phase2 iv ( 8 bytes )<BR>
=< : decrypt iv ( 8 bytes )<BR>
<= : decrypt packet ( 76 bytes )<BR>
== : stored iv ( 8 bytes )<BR>
<< : hash payload<BR>
<< : attribute payload<BR>
ii : received xauth request<BR>
>> : hash payload<BR>
>> : attribute payload<BR>
== : new configure hash ( 16 bytes )<BR>
>= : encrypt iv ( 8 bytes )<BR>
=> : encrypt packet ( 80 bytes )<BR>
== : stored iv ( 8 bytes )<BR>
-> : send IKE packet to 10.1.101.26:500 ( 84 bytes )<BR>
DB : config dereferenced ( ref count = 0, config count = 1 )<BR>
ii : sent xauth reply with 'rocky' credentials<BR>
DB : config deleted<BR>
DB : tunnel dereferenced ( ref count = 2, tunnel count = 1 )<BR>
DB : phase1 sa dereferenced ( ref count = 0, phase1 count = 1 )<BR>
DB : tunnel dereferenced ( ref count = 1, tunnel count = 1 )<BR>
<- : recv IKE packet from 10.1.101.26:500 ( 68 bytes )<BR>
DB : ipsec peer found<BR>
DB : phase1 sa found<BR>
DB : config not found<BR>
DB : config added<BR>
== : new phase2 iv ( 8 bytes )<BR>
=< : decrypt iv ( 8 bytes )<BR>
<= : decrypt packet ( 68 bytes )<BR>
== : stored iv ( 8 bytes )<BR>
<< : hash payload<BR>
<< : attribute payload<BR>
ii : received xauth result<BR>
ii : user authentication succeeded<BR>
>> : hash payload<BR>
>> : attribute payload<BR>
== : new configure hash ( 16 bytes )<BR>
>= : encrypt iv ( 8 bytes )<BR>
=> : encrypt packet ( 56 bytes )<BR>
== : stored iv ( 8 bytes )<BR>
-> : send IKE packet to 10.1.101.26:500 ( 60 bytes )<BR>
DB : config dereferenced ( ref count = 0, config count = 1 )<BR>
DB : config added<BR>
== : new phase2 iv ( 8 bytes )<BR>
ii : determining required modecfg attributes<BR>
ii : - IP4 Address<BR>
ii : - IP4 Netamask<BR>
ii : - IP4 DNS Server<BR>
ii : - IP4 DNS Suffix<BR>
ii : - Split DNS Domains<BR>
ii : - IP4 WINS Server<BR>
ii : - IP4 Split Network Include List<BR>
ii : - IP4 Split Network Exclude List<BR>
ii : sending isakmp config request<BR>
>> : hash payload<BR>
>> : attribute payload<BR>
== : new configure hash ( 16 bytes )<BR>
>= : encrypt iv ( 8 bytes )<BR>
=> : encrypt packet ( 88 bytes )<BR>
== : stored iv ( 8 bytes )<BR>
-> : send IKE packet to 10.1.101.26:500 ( 92 bytes )<BR>
DB : config dereferenced ( ref count = 0, config count = 2 )<BR>
DB : config deleted<BR>
DB : tunnel dereferenced ( ref count = 3, tunnel count = 1 )<BR>
DB : phase1 sa dereferenced ( ref count = 0, phase1 count = 1 )<BR>
DB : tunnel dereferenced ( ref count = 2, tunnel count = 1 )<BR>
<- : recv IKE packet from 10.1.101.26:500 ( 92 bytes )<BR>
DB : ipsec peer found<BR>
DB : phase1 sa found<BR>
DB : config found<BR>
=< : decrypt iv ( 8 bytes )<BR>
<= : decrypt packet ( 92 bytes )<BR>
== : stored iv ( 8 bytes )<BR>
<< : hash payload<BR>
<< : attribute payload<BR>
ii : received isakmp config reply<BR>
ii : - IP4 Address = 10.1.202.0<BR>
ii : - IP4 Netmask = 255.255.255.0<BR>
ii : - IP4 DNS Server = 10.1.100.126<BR>
ii : - IP4 WINS Server = 10.1.100.126<BR>
DB : config dereferenced ( ref count = 0, config count = 1 )<BR>
DB : phase1 sa dereferenced ( ref count = 0, phase1 count = 1 )<BR>
DB : tunnel dereferenced ( ref count = 2, tunnel count = 1 )<BR>
ii : resending ip packet<BR>
<- : recv IKE packet from 10.1.101.26:500 ( 92 bytes )<BR>
DB : ipsec peer found<BR>
DB : phase1 sa found<BR>
DB : config found<BR>
=< : decrypt iv ( 8 bytes )<BR>
<= : decrypt packet ( 92 bytes )<BR>
== : stored iv ( 8 bytes )<BR>
<< : hash payload<BR>
!! : invalid hash size ( -11753 != 16 )<BR>
DB : config dereferenced ( ref count = 0, config count = 1 )<BR>
DB : phase1 sa dereferenced ( ref count = 0, phase1 count = 1 )<BR>
DB : tunnel dereferenced ( ref count = 2, tunnel count = 1 )<BR>
ii : resending ip packet<BR>
<- : recv IKE packet from 10.1.101.26:500 ( 92 bytes )<BR>
DB : ipsec peer found<BR>
DB : phase1 sa found<BR>
DB : config found<BR>
=< : decrypt iv ( 8 bytes )<BR>
<= : decrypt packet ( 92 bytes )<BR>
== : stored iv ( 8 bytes )<BR>
<< : hash payload<BR>
!! : invalid hash size ( 15762 != 16 )<BR>
DB : config dereferenced ( ref count = 0, config count = 1 )<BR>
DB : phase1 sa dereferenced ( ref count = 0, phase1 count = 1 )<BR>
DB : tunnel dereferenced ( ref count = 2, tunnel count = 1 )<BR>
ii : resending ip packet<BR>
<- : recv IKE packet from 10.1.101.26:500 ( 92 bytes )<BR>
DB : ipsec peer found<BR>
DB : phase1 sa found<BR>
DB : config found<BR>
=< : decrypt iv ( 8 bytes )<BR>
<= : decrypt packet ( 92 bytes )<BR>
== : stored iv ( 8 bytes )<BR>
<< : hash payload<BR>
!! : invalid hash size ( 18079 != 16 )<BR>
DB : config dereferenced ( ref count = 0, config count = 1 )<BR>
DB : phase1 sa dereferenced ( ref count = 0, phase1 count = 1 )<BR>
DB : tunnel dereferenced ( ref count = 2, tunnel count = 1 )<BR>
ii : resending ip packet<BR>
<- : recv IKE packet from 10.1.101.26:500 ( 92 bytes )<BR>
DB : ipsec peer found<BR>
DB : phase1 sa found<BR>
DB : config found<BR>
=< : decrypt iv ( 8 bytes )<BR>
<= : decrypt packet ( 92 bytes )<BR>
== : stored iv ( 8 bytes )<BR>
<< : hash payload<BR>
!! : invalid hash size ( 30324 != 16 )<BR>
DB : config dereferenced ( ref count = 0, config count = 1 )<BR>
DB : phase1 sa dereferenced ( ref count = 0, phase1 count = 1 )<BR>
DB : tunnel dereferenced ( ref count = 2, tunnel count = 1 )<BR>
ii : created vnet device 'ROOT\VNET\0000'<BR>
ii : client recv thread begin ...<BR>
ii : re-costed existing default route<BR>
!! : unable to locate adapter index.<BR>
!! : unable to locate adapter index.<BR>
!! : unable to locate adapter index.<BR>
DB : phase1 sa found<BR>
DB : phase1 sa dereferenced ( ref count = 0, phase1 count = 1 )<BR>
ii : ip packet resend timed out<BR>
ii : inspecting VNet DHCP packet ...<BR>
ii : - message type DHCP discover<BR>
ii : responding to VNet DHCP packet ...<BR>
ii : - message type DHCP offer<BR>
ii : inspecting VNet DHCP packet ...<BR>
ii : - message type DHCP request<BR>
ii : responding to VNet DHCP packet ...<BR>
ii : - message type DHCP acknowledge<BR>
ii : added host route for remote peer<BR>
ii : inspecting VNet ARP request ...<BR>
ii : inspecting VNet ARP request ...<BR>
ii : inspecting VNet ARP request ...<BR>
ii : inspecting VNet DHCP packet ...<BR>
!! : DHCP message type is invalid ( 8 )<BR>
ii : inspecting VNet DHCP packet ...<BR>
!! : DHCP message type is invalid ( 8 )<BR>
<BR>
***** At this point the client shows: <BR>
<IMG src="cid:3237968244_36396736" > <IMG src="cid:3237968245_36451124" ><BR>
<BR>
***** The logs on the server report:<BR>
<BR>
cow# /etc/rc.d/racoon start<BR>
Starting racoon.<BR>
Aug 9 11:25:33 cow racoon: INFO: @(#)ipsec-tools 0.6.6 (<a href="http://ipsec-tools.sourceforge.net)">http://ipsec-tools.sourceforge.net)</a> <BR>
Aug 9 11:25:33 cow racoon: INFO: @(#)This product linked OpenSSL 0.9.7d 17 Mar 2004 (<a href="http://www.openssl.org/)">http://www.openssl.org/)</a> <BR>
cow# Aug 9 11:25:33 cow racoon: INFO: 10.1.101.26[4500] used as isakmp port (fd=8) <BR>
Aug 9 11:25:33 cow racoon: INFO: 10.1.101.26[4500] used for NAT-T <BR>
Aug 9 11:25:33 cow racoon: INFO: 10.1.101.26[500] used as isakmp port (fd=9) <BR>
Aug 9 11:25:33 cow racoon: INFO: 10.1.101.26[500] used for NAT-T <BR>
Aug 9 11:28:02 cow racoon: INFO: respond new phase 1 negotiation: 10.1.101.26[500]<=>10.1.200.165[500] <BR>
Aug 9 11:28:02 cow racoon: INFO: begin Aggressive mode. <BR>
Aug 9 11:28:02 cow racoon: INFO: received Vendor ID: CISCO-UNITY <BR>
Aug 9 11:28:02 cow racoon: INFO: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt <BR>
Aug 9 11:28:02 cow racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02 <BR>
Aug 9 11:28:02 cow racoon: INFO: received Vendor ID: RFC 3947 <BR>
Aug 9 11:28:02 cow racoon: INFO: received broken Microsoft ID: FRAGMENTATION <BR>
Aug 9 11:28:02 cow racoon: INFO: Selected NAT-T version: RFC 3947 <BR>
Aug 9 11:28:02 cow racoon: oakley_dh_generate(MODP1024): 0.017753<BR>
Aug 9 11:28:02 cow racoon: oakley_dh_compute(MODP1024): 0.020346<BR>
Aug 9 11:28:02 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=128): 0.000087<BR>
Aug 9 11:28:02 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=145): 0.000020<BR>
Aug 9 11:28:02 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=161): 0.000021<BR>
Aug 9 11:28:02 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=161): 0.000021<BR>
Aug 9 11:28:02 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=1): 0.000019<BR>
Aug 9 11:28:02 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=16): 0.000020<BR>
Aug 9 11:28:02 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=521): 0.000023<BR>
Aug 9 11:28:02 cow racoon: alg_oakley_encdef_decrypt(3des klen=192 size=40): 0.000144<BR>
Aug 9 11:28:02 cow racoon: INFO: NAT not detected <BR>
Aug 9 11:28:02 cow racoon: INFO: No SIG was passed, but hybrid auth is enabled <BR>
Aug 9 11:28:02 cow racoon: phase1(???): 0.000897<BR>
Aug 9 11:28:02 cow racoon: phase1(Aggressive): 0.562699<BR>
Aug 9 11:28:02 cow racoon: INFO: Sending Xauth request <BR>
Aug 9 11:28:02 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=24): 0.000024<BR>
Aug 9 11:28:02 cow racoon: alg_oakley_encdef_encrypt(3des klen=192 size=48): 0.000068<BR>
Aug 9 11:28:02 cow racoon: INFO: ISAKMP-SA established 10.1.101.26[500]-10.1.200.165[500] spi:43dc7d87141edc41:df266e207a5fc429 <BR>
Aug 9 11:28:03 cow racoon: alg_oakley_encdef_decrypt(3des klen=192 size=48): 0.000068<BR>
Aug 9 11:28:03 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=32): 0.000026<BR>
Aug 9 11:28:03 cow racoon: alg_oakley_encdef_decrypt(3des klen=192 size=56): 0.000072<BR>
Aug 9 11:28:03 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=36): 0.000026<BR>
Aug 9 11:28:03 cow racoon: INFO: Using port 0 <BR>
Aug 9 11:28:03 cow racoon: INFO: login succeeded for user "rocky" <BR>
Aug 9 11:28:03 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=16): 0.000023<BR>
Aug 9 11:28:03 cow racoon: alg_oakley_encdef_encrypt(3des klen=192 size=40): 0.000069<BR>
Aug 9 11:28:04 cow racoon: alg_oakley_encdef_decrypt(3des klen=192 size=32): 0.000071<BR>
Aug 9 11:28:04 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=12): 0.000027<BR>
Aug 9 11:28:04 cow racoon: alg_oakley_encdef_decrypt(3des klen=192 size=64): 0.000070<BR>
Aug 9 11:28:04 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=44): 0.000025<BR>
Aug 9 11:28:04 cow racoon: WARNING: Ignored attribute 28678 <BR>
Aug 9 11:28:04 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=44): 0.000020<BR>
Aug 9 11:28:04 cow racoon: alg_oakley_encdef_encrypt(3des klen=192 size=64): 0.000055<BR>
Aug 9 11:28:09 cow racoon: alg_oakley_encdef_decrypt(3des klen=192 size=64): 0.000080<BR>
Aug 9 11:28:09 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=44): 0.000026<BR>
Aug 9 11:28:09 cow racoon: WARNING: Ignored attribute 28678 <BR>
Aug 9 11:28:09 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=44): 0.000019<BR>
Aug 9 11:28:09 cow racoon: alg_oakley_encdef_encrypt(3des klen=192 size=64): 0.000060<BR>
Aug 9 11:28:15 cow racoon: alg_oakley_encdef_decrypt(3des klen=192 size=64): 0.000076<BR>
Aug 9 11:28:15 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=44): 0.000029<BR>
Aug 9 11:28:15 cow racoon: WARNING: Ignored attribute 28678 <BR>
Aug 9 11:28:15 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=44): 0.000020<BR>
Aug 9 11:28:15 cow racoon: alg_oakley_encdef_encrypt(3des klen=192 size=64): 0.000056<BR>
Aug 9 11:28:21 cow racoon: alg_oakley_encdef_decrypt(3des klen=192 size=64): 0.000074<BR>
Aug 9 11:28:21 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=44): 0.000025<BR>
Aug 9 11:28:21 cow racoon: WARNING: Ignored attribute 28678 <BR>
Aug 9 11:28:21 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=44): 0.000020<BR>
Aug 9 11:28:21 cow racoon: alg_oakley_encdef_encrypt(3des klen=192 size=64): 0.000109<BR>
Aug 9 11:28:27 cow racoon: alg_oakley_encdef_decrypt(3des klen=192 size=64): 0.000088<BR>
Aug 9 11:28:27 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=44): 0.000027<BR>
Aug 9 11:28:27 cow racoon: WARNING: Ignored attribute 28678 <BR>
Aug 9 11:28:27 cow racoon: alg_oakley_hmacdef_one(hmac_md5 size=44): 0.000020<BR>
Aug 9 11:28:27 cow racoon: alg_oakley_encdef_encrypt(3des klen=192 size=64): 0.000064<BR>
<BR>
<BR>
<BR>
<BR>
</SPAN></FONT>
</BODY>
</HTML>