<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">Hello,</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">I can‘t establish an IPSec session between WinXP shrewsoft client 2.1.5 and Cisco 2611 (12.4-1a IOS). Unable to negotiate phase 1 pre-shared key authentication parameter. I configured Cisco to use isakmp client configuration group „VPN“ and dynamic ipsec tunnels. Phase 1 parameters are:</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">Encryption: 3des</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">DH Group: 2</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">Hash: md5</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">Authentication: pre-shared key</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">Lifetime: 28800 s</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">(see cisco config below)</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">The same was configured on the client. I set the Key ID String as „VPN“ in Local Identity, IP address as an identification type in Remote Identity field and a pre-shared key in Credentials.</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">There‘s something wrong with pre-shared key authentication. I checked phase 1 parameters on both cisco and client side and they match. </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">Shrewsoft trace:</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:52 ## : IKE Daemon, ver 2.1.5</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:52 ## : Copyright 2009 Shrew Soft Inc.</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:52 ## : This product linked OpenSSL 0.9.8h 28 May 2008</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:52 ii : opened 'C:\Program Files\ShrewSoft\VPN Client\debug\iked.log'</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:52 ii : opened 'C:\Program Files\ShrewSoft\VPN Client/debug/dump-ike-decrypt.cap'</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:52 ii : opened 'C:\Program Files\ShrewSoft\VPN Client/debug/dump-ike-encrypt.cap'</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:52 ii : rebuilding vnet device list ...</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:52 ii : device ROOT\VNET\0000 disabled</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:52 ii : network process thread begin ...</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:52 ii : pfkey process thread begin ...</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:52 ii : ipc server process thread begin ...</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 ii : ipc client process thread begin ...</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 <A : peer config add message</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : peer ref increment ( ref count = 1, obj count = 0 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : peer added ( obj count = 1 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 ii : local address 192.168.0.2 selected for peer</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : peer ref increment ( ref count = 2, obj count = 1 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : tunnel ref increment ( ref count = 1, obj count = 0 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : tunnel added ( obj count = 1 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 <A : proposal config message</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 <A : proposal config message</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 <A : client config message</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 <A : local id 'VPN' message</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 <A : preshared key message</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 <A : peer tunnel enable message</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : tunnel ref increment ( ref count = 2, obj count = 1 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : new phase1 ( ISAKMP initiator )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : exchange type is aggressive</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : <a href="http://192.168.0.2:500">192.168.0.2:500</a> <-> <a href="http://172.16.0.1:500">172.16.0.1:500</a></span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : 8c9d42b1ad3ab4f4:0000000000000000</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : phase1 ref increment ( ref count = 1, obj count = 0 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : phase1 added ( obj count = 1 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 >> : security association payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 >> : - proposal #1 payload </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 >> : -- transform #1 payload </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 >> : key exchange payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 >> : nonce payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 >> : identification payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 >> : vendor id payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 ii : local supports FRAGMENTATION</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 >> : vendor id payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 ii : local is SHREW SOFT compatible</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 >> : vendor id payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 ii : local is NETSCREEN compatible</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 >> : vendor id payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 ii : local is SIDEWINDER compatible</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 >> : vendor id payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 ii : local is CISCO UNITY compatible</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 >= : cookies 8c9d42b1ad3ab4f4:0000000000000000</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 >= : message 00000000</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 -> : send IKE packet <a href="http://192.168.0.2:500">192.168.0.2:500</a> -> <a href="http://172.16.0.1:500">172.16.0.1:500</a> ( 387 bytes )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : phase1 resend event scheduled ( ref count = 2 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : phase1 ref decrement ( ref count = 1, obj count = 1 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : tunnel ref increment ( ref count = 3, obj count = 1 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 <- : recv IKE packet <a href="http://172.16.0.1:500">172.16.0.1:500</a> -> <a href="http://192.168.0.2:500">192.168.0.2:500</a> ( 96 bytes )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : phase1 found</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : phase1 ref increment ( ref count = 2, obj count = 1 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 ii : processing informational packet ( 96 bytes )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 =< : cookies 8c9d42b1ad3ab4f4:127c53b687dc01a1</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 =< : message 00000000</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 << : notification payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 ii : received peer NO-PROPOSAL-CHOSEN notification</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 ii : - <a href="http://172.16.0.1:500">172.16.0.1:500</a> -> <a href="http://192.168.0.2:500">192.168.0.2:500</a></span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 ii : - isakmp spi = none</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 ii : - data size 56</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:37:57 DB : phase1 ref decrement ( ref count = 1, obj count = 1 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:02 -> : resend 1 phase1 packet(s) <a href="http://192.168.0.2:500">192.168.0.2:500</a> -> <a href="http://172.16.0.1:500">172.16.0.1:500</a></span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:07 -> : resend 1 phase1 packet(s) <a href="http://192.168.0.2:500">192.168.0.2:500</a> -> <a href="http://172.16.0.1:500">172.16.0.1:500</a></span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:12 -> : resend 1 phase1 packet(s) <a href="http://192.168.0.2:500">192.168.0.2:500</a> -> <a href="http://172.16.0.1:500">172.16.0.1:500</a></span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:16 <A : peer tunnel disable message</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:16 ii : removing IPsec over DHCP policies</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:16 DB : policy not found</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:16 DB : policy not found</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:16 DB : tunnel stats event canceled ( ref count = 2 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:16 DB : removing tunnel config references</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:16 DB : removing tunnel phase2 references</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:16 DB : removing tunnel phase1 references</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:16 DB : phase1 ref increment ( ref count = 2, obj count = 1 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:16 DB : phase1 resend event canceled ( ref count = 1 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:16 ii : phase1 removal before expire time</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:16 DB : phase1 deleted ( obj count = 0 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:16 DB : tunnel ref decrement ( ref count = 1, obj count = 1 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:16 DB : tunnel deleted ( obj count = 0 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:17 DB : peer ref decrement ( ref count = 1, obj count = 1 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:17 DB : removing all peer tunnel refrences</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:17 DB : peer deleted ( obj count = 0 )</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">10/03/13 17:38:17 ii : ipc client process thread exit ...</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">Cisco 2611 debug:</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.407: ISAKMP (0:0): received packet from 192.168.0.2 dport 500 sport 500 Global (N) NEW SA</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.407: ISAKMP: Created a peer struct for 192.168.0.2, peer port 500</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.411: ISAKMP: New peer created peer = 0x82D7B14C peer_handle = 0x80000012</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.411: ISAKMP: Locking peer struct 0x82D7B14C, IKE refcount 1 for crypto_isakmp_process_block</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.411: ISAKMP: local port 500, remote port 500</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.415: insert sa successfully sa = 833DFB98</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.415: ISAKMP:(0:0:N/A:0): processing SA payload. message ID = 0</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.415: ISAKMP:(0:0:N/A:0): processing ID payload. message ID = 0</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.415: ISAKMP (0:0): ID payload </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> next-payload : 13</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> type : 11 </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> group id : VPN </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> protocol : 0 </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> port : 0 </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> length : 11</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.419: ISAKMP:(0:0:N/A:0):: peer matches TEST profile</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.419: ISAKMP:(0:0:N/A:0):Looking for a matching key for 192.168.0.2 in default</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.419: ISAKMP:(0:0:N/A:0):Setting client config settings 8297826C</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.423: ISAKMP:(0:0:N/A:0): Profile TEST assigned peer the group named VPN</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.423: ISAKMP:(0:0:N/A:0): processing vendor id payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.423: ISAKMP:(0:0:N/A:0): vendor ID seems Unity/DPD but major 194 mismatch</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.423: ISAKMP:(0:0:N/A:0): processing vendor id payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.427: ISAKMP:(0:0:N/A:0): vendor ID seems Unity/DPD but major 237 mismatch</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.427: ISAKMP:(0:0:N/A:0): processing vendor id payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.427: ISAKMP:(0:0:N/A:0): vendor ID seems Unity/DPD but major 19 mismatch</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.427: ISAKMP:(0:0:N/A:0): processing vendor id payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.431: ISAKMP:(0:0:N/A:0): vendor ID seems Unity/DPD but major 83 mismatch</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.431: ISAKMP:(0:0:N/A:0): processing vendor id payload</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.431: ISAKMP:(0:0:N/A:0): vendor ID is Unity</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.431: ISAKMP : Looking for xauth in profile TEST</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.435: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 1 against priority 1 policy</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.435: ISAKMP: encryption 3DES-CBC</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.435: ISAKMP: hash MD5</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.435: ISAKMP: default group 2</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.435: ISAKMP: auth pre-share</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.435: ISAKMP: life type in seconds</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.435: ISAKMP: life duration (VPI) of 0x0 0x0 0x70 0x80 </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.439: ISAKMP:(0:0:N/A:0):Preshared authentication offered but does not match policy!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.439: ISAKMP:(0:0:N/A:0):atts are not acceptable. Next payload is 0</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.439: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 1 against priority 65535 policy</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.443: ISAKMP: encryption 3DES-CBC</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.443: ISAKMP: hash MD5</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.443: ISAKMP: default group 2</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.443: ISAKMP: auth pre-share</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.443: ISAKMP: life type in seconds</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.443: ISAKMP: life duration (VPI) of 0x0 0x0 0x70 0x80 </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.447: ISAKMP:(0:0:N/A:0):Encryption algorithm offered does not match policy!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.447: ISAKMP:(0:0:N/A:0):atts are not acceptable. Next payload is 0</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.447: ISAKMP:(0:0:N/A:0):no offers accepted!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.451: ISAKMP:(0:0:N/A:0): phase 1 SA policy not acceptable! (local 172.16.0.1 remote 192.168.0.2)</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.451: ISAKMP:(0:0:N/A:0):incrementing error counter on sa: construct_fail_ag_init</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.451: ISAKMP:(0:0:N/A:0): sending packet to 192.168.0.2 my_port 500 peer_port 500 (R) AG_NO_STATE</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.455: ISAKMP:(0:0:N/A:0):peer does not do paranoid keepalives.</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.455: ISAKMP:(0:0:N/A:0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) AG_NO_STATE (peer 192.168.0.2)</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.455: ISAKMP:(0:0:N/A:0): processing KE payload. message ID = 0</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.455: ISAKMP:(0:0:N/A:0): group size changed! Should be 0, is 128</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.459: ISAKMP (0:0): Unknown Input IKE_MESG_FROM_PEER, IKE_AM_EXCH: state = IKE_READY</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.459: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_PEER, IKE_AM_EXCH</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.459: ISAKMP:(0:0:N/A:0):Old State = IKE_READY New State = IKE_READY </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.459: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Aggressive mode failed with peer at 192.168.0.2 </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.467: ISAKMP:(0:0:N/A:0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) AG_NO_STATE (peer 192.168.0.2) </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.467: ISAKMP: Unlocking IKE struct 0x82D7B14C for isadb_mark_sa_deleted(), count 0</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.467: ISAKMP: Deleting peer node by peer_reap for <a href="http://192.168.0.2">192.168.0.2</a>: 82D7B14C</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.471: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.471: ISAKMP:(0:0:N/A:0):Old State = IKE_READY New State = IKE_DEST_SA </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:06.471: IPSEC(key_engine): got a queue event with 1 kei messages</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:11.403: ISAKMP (0:0): received packet from 192.168.0.2 dport 500 sport 500 Global (R) MM_NO_STATE</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">*Mar 31 02:52:16.407: ISAKMP (0:0): received packet from 192.168.0.2 dport 500 sport 500 Global (R) MM_NO_STATE </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">Cisco 2611 IPSec config:</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">username cisco privilege 15 password 0 cisco</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">! </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">crypto isakmp policy 1</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> encr 3des</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> hash md5</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> authentication pre-share</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> group 2</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> lifetime 28800</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">crypto isakmp client configuration group VPN</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> key 6 cisco</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> dns 192.168.10.20</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> pool vpn</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">crypto isakmp profile TEST</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> match identity group VPN</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> client configuration address respond</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> client configuration group VPN</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> virtual-template 1</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">crypto ipsec transform-set XXX esp-3des esp-md5-hmac </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">crypto ipsec profile TEST</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> set transform-set XXX </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">interface Ethernet0/0</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> ip address 192.168.10.1 255.255.255.0</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> half-duplex</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">interface Serial0/0</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> ip address 172.16.0.1 255.255.255.252</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> no fair-queue</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">interface Virtual-Template1 type tunnel</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> no ip address</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> tunnel mode ipsec ipv4</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> tunnel protection ipsec profile TEST</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">!</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">ip local pool vpn 192.168.10.5 192.168.10.10</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">I also tried configuring shrewsoft without specifying a VPN group parameter, and it passed the phase 1 successfully, but could not pass phase 2. Is it something wrong with Cisco or Client config?</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt">Nikolaj</span></font></p>
<p class="MsoPlainText"><font size="2" face="Courier New"><span style="FONT-SIZE: 10pt"> </span></font></p>