<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.12.2">
</HEAD>
<BODY>
Greetings,<BR>
<BR>
I've tried configuring the Shrew Soft VPN client 2.0.1 to work with my zywall 1050 to no avail. I can't get pasted phase 1 it seems and the client is replying to the gateway with invalid spi. Am I missing something? Any help is welcomed.<BR>
<BR>
iked.log:<BR>
<BR>
<A : peer config add message<BR>
DB : peer ref increment ( ref count = 1, peer count = 0 )<BR>
DB : peer added<BR>
ii : local address 192.168.119.10:500 selected for peer<BR>
DB : tunnel ref increment ( ref count = 1, tunnel count = 0 )<BR>
DB : peer ref increment ( ref count = 2, peer count = 1 )<BR>
DB : tunnel added<BR>
<A : proposal config message<BR>
<A : proposal config message<BR>
<A : client config message<BR>
<A : remote id '[removed]' message<BR>
<A : preshared key message<BR>
<A : peer tunnel enable message<BR>
DB : new phase1 ( ISAKMP initiator )<BR>
DB : exchange type is aggressive<BR>
DB : 192.168.119.10:500 <-> 65.213.209.34:500<BR>
DB : bbdebab4f9553e7b:0000000000000000<BR>
DB : phase1 ref increment ( ref count = 1, phase1 count = 0 )<BR>
DB : tunnel ref increment ( ref count = 2, tunnel count = 1 )<BR>
DB : phase1 added<BR>
>> : security association payload<BR>
>> : - proposal #1 payload <BR>
>> : -- transform #1 payload <BR>
>> : key exchange payload<BR>
>> : nonce payload<BR>
>> : identification payload<BR>
>> : vendor id payload<BR>
>> : vendor id payload<BR>
>> : vendor id payload<BR>
-> : send IKE packet 192.168.119.10:500 -> 65.213.209.34:500 ( 344 bytes )<BR>
DB : phase1 ref increment ( ref count = 2, phase1 count = 1 )<BR>
DB : phase1 ref decrement ( ref count = 1, phase1 count = 1 )<BR>
<- : recv IKE packet 65.213.209.34:500 -> 192.168.119.10:500 ( 533 bytes )<BR>
DB : phase1 found<BR>
DB : phase1 ref increment ( ref count = 2, phase1 count = 1 )<BR>
<< : security association payload<BR>
<< : - propsal #1 payload <BR>
!! : invalid spi size of 8 for protocol isakmp <BR>
XX : warning, unprocessed payload data !!!<BR>
ii : sending peer INVALID-SPI notification<BR>
ii : - 192.168.119.10:500 -> 65.213.209.34:500<BR>
ii : - isakmp spi = bbdebab4f9553e7b:4e8270e2c1299bef<BR>
ii : - data size 0<BR>
>> : notification payload<BR>
-> : send IKE packet 192.168.119.10:500 -> 65.213.209.34:500 ( 84 bytes )<BR>
DB : phase1 resend event canceled ( ref count = 1 )<BR>
DB : phase1 deleted before expire time ( phase1 count = 0 )<BR>
DB : tunnel ref decrement ( ref count = 1, tunnel count = 1 )<BR>
DB : removing all tunnel refrences<BR>
DB : tunnel deleted ( tunnel count = 0 )<BR>
DB : peer ref decrement ( ref count = 1, peer count = 1 )<BR>
DB : peer deleted ( peer count = 0 )<BR>
<BR>
The zywall reports this in its own logs:<BR>
<BR>
22007-10-02 18:11:33 info IKE Recv:[NOTFY:INVALID_SPI]192.168.119.10:500 65.213.209.34:500 IKE_LOG<BR>
32007-10-02 18:11:33 info IKE Send:[SA][KE][NONCE][ID][HASH][VID][VID][VID][VID][VID][VID][VID][VID][VID][NOTFY:INITIAL_CONTACT] 65.213.209.34:500192.168.119.10:500 IKE_LOG<BR>
42007-10-02 18:11:33 info IKE The cookie pair is : 0x84861c1f4420a0d1 / 0x8bf99628ede70833 65.213.209.34:500 192.168.119.10:500 IKE_LOG<BR>
52007-10-02 18:11:33 info IKE Tunnel [ipsecGw_i:ipsecForL2TPConn] Recving IKE request 192.168.119.10:500 65.213.209.34:500 IKE_LOG<BR>
62007-10-02 18:11:33 info IKE Recv:[SA][KE][NONCE][ID][VID][VID][VID][VID]192.168.119.10:500 65.213.209.34:500 IKE_LOG<BR>
72007-10-02 18:11:33 info IKE The cookie pair is : 0x84861c1f4420a0d1 / 0x8bf99628ede70833 [count=3] 192.168.119.10:500 65.213.209.34:500 IKE_LOG<BR>
82007-10-02 18:11:33 info IKE Recv Aggressive Mode request from [192.168.119.10]192.168.119.10:500 65.213.209.34:500 IKE_LOG<BR>
92007-10-02 18:11:33 info IKE The cookie pair is : 0x84861c1f4420a0d1 / 0x0000000000000000 192.168.119.10:500 65.213.209.34:500 IKE_LOG<BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
<BR>
<BR>
Stephen Cohoon<BR>
Information Technology<BR>
Regulatory Affairs Professionals Society<BR>
email: <A HREF="mailto:scohoon@raps.org">scohoon@raps.org</A>; website: <A HREF="http://www.raps.org">www.raps.org</A>;<BR>
phone: 301.770.2920, ext. 236; fax: 301.770.2924<BR>
5635 Fishers Ln, Suite 550, Rockville, MD 20852<BR>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<BR>
RAPS—Advancing the Global Regulatory Profession
</TD>
</TR>
</TABLE>
</BODY>
</HTML>