<div dir="ltr"><div><div>Hi,<br><br>Do you have check the logs of FritzBox ?<br></div><br></div>Regards,<br><div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Sep 4, 2013 at 2:44 PM, F. Schmitt <span dir="ltr"><<a href="mailto:vpn-help@florian-schmitt.net" target="_blank">vpn-help@florian-schmitt.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
i'm trying to connect from a linux client (Mint MATE 14, 64bit, Kernel<br>
3.5.0-39) to a FritzBox (6360 Cable) using VPN. Connecting from within<br>
Win7 to the FritzBox works perfectly, but using linux, i receive a<br>
"negotiation timeout". I've followed the guide mentioned in the FritzBox<br>
howto:<br>
<br>
<a href="https://www.shrew.net/support/Howto_Fritzbox" target="_blank">https://www.shrew.net/support/Howto_Fritzbox</a><br>
<br>
but it doesn't work:<br>
<br>
---------------------------------------------------------------------<br>
config loaded for site 'xyz'<br>
attached to key daemon ...<br>
peer configured<br>
iskamp proposal configured<br>
esp proposal configured<br>
ipcomp proposal configured<br>
client configured<br>
local id configured<br>
remote id configured<br>
pre-shared key configured<br>
bringing up tunnel ...<br>
negotiation timout occurred<br>
tunnel disabled<br>
detached from key daemon<br>
-------------------------------------------------------------------<br>
<br>
Maybe anyone can tell me how to connect successfully? I've tried to set<br>
the net.ipv4.conf.default.rp_filter and net.ipv4.conf.all.rp_filter in<br>
/etc/sysctl.conf to 0, but that didn't change anything.<br>
<br>
Output of uname -a:<br>
<br>
--------------------------------------------------------------------<br>
Linux <hostname> 3.5.0-39-generic #60-Ubuntu SMP Tue Aug 13 18:33:05 UTC<br>
2013 x86_64 x86_64 x86_64 GNU/Linux<br>
--------------------------------------------------------------------<br>
<br>
Content of /var/log/iked.log: (yyy and zzz are the correct IP adresses<br>
of the linux client and the FritzBox respectively)<br>
--------------------------------------------------------------------<br>
13/09/04 14:10:00 ## : IKE Daemon, ver 2.2.1<br>
13/09/04 14:10:00 ## : Copyright 2013 Shrew Soft Inc.<br>
13/09/04 14:10:00 ## : This product linked OpenSSL 1.0.1c 10 May 2012<br>
13/09/04 14:10:00 ii : opened '/var/log/iked.log'<br>
13/09/04 14:10:00 ii : opened '/var/log/ike-encrypt.pcap'<br>
13/09/04 14:10:00 ii : opened '/var/log/ike-decrypt.pcap'<br>
13/09/04 14:10:00 ii : network process thread begin ...<br>
13/09/04 14:10:00 ii : pfkey process thread begin ...<br>
13/09/04 14:10:00 ii : ipc server process thread begin ...<br>
13/09/04 14:10:00 K< : recv pfkey REGISTER AH message<br>
13/09/04 14:10:00 K< : recv pfkey REGISTER ESP message<br>
13/09/04 14:10:00 K< : recv pfkey REGISTER IPCOMP message<br>
13/09/04 14:10:00 K! : recv X_SPDDUMP message failure ( errno = 2 )<br>
13/09/04 14:10:21 ii : ipc client process thread begin ...<br>
13/09/04 14:10:21 <A : peer config add message<br>
13/09/04 14:10:21 <A : proposal config message<br>
13/09/04 14:10:21 <A : proposal config message<br>
13/09/04 14:10:21 <A : proposal config message<br>
13/09/04 14:10:21 <A : client config message<br>
13/09/04 14:10:21 <A : local id '<localid removed>' message<br>
13/09/04 14:10:21 <A : preshared key message<br>
13/09/04 14:10:21 <A : remote resource message<br>
13/09/04 14:10:21 <A : peer tunnel enable message<br>
13/09/04 14:10:21 DB : peer ref increment ( ref count = 1, obj count = 0 )<br>
13/09/04 14:10:21 DB : peer added ( obj count = 1 )<br>
13/09/04 14:10:21 ii : local address yyy.yyy.yyy.yyy selected for peer<br>
13/09/04 14:10:21 DB : peer ref increment ( ref count = 2, obj count = 1 )<br>
13/09/04 14:10:21 DB : tunnel ref increment ( ref count = 1, obj count = 0 )<br>
13/09/04 14:10:21 DB : tunnel added ( obj count = 1 )<br>
13/09/04 14:10:21 DB : tunnel ref increment ( ref count = 2, obj count = 1 )<br>
13/09/04 14:10:21 DB : new phase1 ( ISAKMP initiator )<br>
13/09/04 14:10:21 DB : exchange type is aggressive<br>
13/09/04 14:10:21 DB : yyy.yyy.yyy.yyy:500 <-> zzz.zzz.zzz.zzz:500<br>
13/09/04 14:10:21 DB : 346e917cd24fe0e3:0000000000000000<br>
13/09/04 14:10:21 DB : phase1 ref increment ( ref count = 1, obj count = 0 )<br>
13/09/04 14:10:21 DB : phase1 added ( obj count = 1 )<br>
13/09/04 14:10:21 >> : security association payload<br>
13/09/04 14:10:21 >> : - proposal #1 payload<br>
13/09/04 14:10:21 >> : -- transform #1 payload<br>
13/09/04 14:10:21 >> : -- transform #2 payload<br>
13/09/04 14:10:21 >> : -- transform #3 payload<br>
13/09/04 14:10:21 >> : -- transform #4 payload<br>
13/09/04 14:10:21 >> : -- transform #5 payload<br>
13/09/04 14:10:21 >> : -- transform #6 payload<br>
13/09/04 14:10:21 >> : key exchange payload<br>
13/09/04 14:10:21 >> : nonce payload<br>
13/09/04 14:10:21 >> : identification payload<br>
13/09/04 14:10:21 >> : vendor id payload<br>
13/09/04 14:10:21 ii : local supports nat-t ( draft v00 )<br>
13/09/04 14:10:21 >> : vendor id payload<br>
13/09/04 14:10:21 ii : local supports nat-t ( draft v01 )<br>
13/09/04 14:10:21 >> : vendor id payload<br>
13/09/04 14:10:21 ii : local supports nat-t ( draft v02 )<br>
13/09/04 14:10:21 >> : vendor id payload<br>
13/09/04 14:10:21 ii : local supports nat-t ( draft v03 )<br>
13/09/04 14:10:21 >> : vendor id payload<br>
13/09/04 14:10:21 ii : local supports nat-t ( rfc )<br>
13/09/04 14:10:21 >> : vendor id payload<br>
13/09/04 14:10:21 ii : local supports FRAGMENTATION<br>
13/09/04 14:10:21 >> : vendor id payload<br>
13/09/04 14:10:21 >> : vendor id payload<br>
13/09/04 14:10:21 ii : local supports DPDv1<br>
13/09/04 14:10:21 >> : vendor id payload<br>
13/09/04 14:10:21 ii : local is SHREW SOFT compatible<br>
13/09/04 14:10:21 >> : vendor id payload<br>
13/09/04 14:10:21 ii : local is NETSCREEN compatible<br>
13/09/04 14:10:21 >> : vendor id payload<br>
13/09/04 14:10:21 ii : local is SIDEWINDER compatible<br>
13/09/04 14:10:21 >> : vendor id payload<br>
13/09/04 14:10:21 ii : local is CISCO UNITY compatible<br>
13/09/04 14:10:21 >> : vendor id payload<br>
13/09/04 14:10:21 ii : local is CHECKPOINT compatible<br>
13/09/04 14:10:21 >= : cookies 346e917cd24fe0e3:0000000000000000<br>
13/09/04 14:10:21 >= : message 00000000<br>
13/09/04 14:10:21 -> : send IKE packet yyy.yyy.yyy.yyy:500 -><br>
zzz.zzz.zzz.zzz:500 ( 796 bytes )<br>
13/09/04 14:10:21 DB : phase1 resend event scheduled ( ref count = 2 )<br>
13/09/04 14:10:21 DB : phase1 ref decrement ( ref count = 1, obj count = 1 )<br>
13/09/04 14:10:31 -> : resend 1 phase1 packet(s) [0/2]<br>
yyy.yyy.yyy.yyy:500 -> zzz.zzz.zzz.zzz:500<br>
13/09/04 14:10:41 -> : resend 1 phase1 packet(s) [1/2]<br>
yyy.yyy.yyy.yyy:500 -> zzz.zzz.zzz.zzz:500<br>
13/09/04 14:10:51 -> : resend 1 phase1 packet(s) [2/2]<br>
yyy.yyy.yyy.yyy:500 -> zzz.zzz.zzz.zzz:500<br>
13/09/04 14:11:01 ii : resend limit exceeded for phase1 exchange<br>
13/09/04 14:11:01 ii : phase1 removal before expire time<br>
13/09/04 14:11:01 DB : phase1 deleted ( obj count = 0 )<br>
13/09/04 14:11:01 DB : policy not found<br>
13/09/04 14:11:01 DB : tunnel ref decrement ( ref count = 1, obj count = 1 )<br>
13/09/04 14:11:01 DB : policy not found<br>
13/09/04 14:11:01 DB : policy not found<br>
13/09/04 14:11:01 DB : policy not found<br>
13/09/04 14:11:01 DB : removing tunnel config references<br>
13/09/04 14:11:01 DB : removing tunnel phase2 references<br>
13/09/04 14:11:01 DB : removing tunnel phase1 references<br>
13/09/04 14:11:01 DB : tunnel deleted ( obj count = 0 )<br>
13/09/04 14:11:01 DB : peer ref decrement ( ref count = 1, obj count = 1 )<br>
13/09/04 14:11:01 DB : removing all peer tunnel references<br>
13/09/04 14:11:01 DB : peer deleted ( obj count = 0 )<br>
13/09/04 14:11:01 ii : ipc client process thread exit ...<br>
--------------------------------------------------------------------<br>
<br>
My iked.conf file has the default values:<br>
--------------------------------------------------------------------<br>
daemon<br>
{<br>
# bind to ports<br>
socket ike 500;<br>
socket natt 4500;<br>
<br>
# log output<br>
log_level loud;<br>
log_file "/var/log/iked.log";<br>
pcap_decrypt "/var/log/ike-decrypt.pcap";<br>
pcap_encrypt "/var/log/ike-encrypt.pcap";<br>
<br>
# retry settings<br>
retry_delay 10;<br>
retry_count 2;<br>
}<br>
--------------------------------------------------------------------<br>
<br>
The file /var/log/ike-decrypt.pcap is empty.<br>
<br>
Any help would be greatly appreciated!<br>
<br>
<br>
Thanks in advance<br>
florian<br>
_______________________________________________<br>
vpn-help mailing list<br>
<a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
<a href="https://lists.shrew.net/mailman/listinfo/vpn-help" target="_blank">https://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
</blockquote></div><br></div></div></div></div></div>