<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jul 2, 2015 at 12:46 AM, Michael Schler <span dir="ltr"><<a href="mailto:mailabo@blatten.com" target="_blank">mailabo@blatten.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello,<br>
<br>
I've set up a connection between a Windows 2012 R2 Server (40.40.40.40)<br>
using Shrew VPN Client (version 2.2.2) and a SonicWALL (and for tests<br>
also with a FortiGate) (50.50.50.50).<br>
<br>
The initial VPN tunnel comes up with either firewall.<br>
When the softlimit timeout for the phase2 is reached the VPN Client<br>
starts the renewal of phase2. With the SonicWALL this renewal shows two<br>
errors (!!:) towards its end. While the tunnel as such seems to fire up<br>
again it is not possible to reach the final destination server<br>
(10.10.10.10) behind the SonicWALL for some time (using Test-Connection<br>
i.e. pings). Only after the hardlimit timeout for phase2 is reached the<br>
pings go through again.<br>
<br>
The identical setup (VPN Client wise) with a FortiGate does not have<br>
this problem. Here the phase2 renewal produces no erros and the<br>
destination server can be reached by pings all times.<br>
<br>
Shrew VPN Client setup<br>
<br>
n:version:4<br>
n:network-ike-port:500<br>
n:network-mtu-size:1380<br>
n:client-addr-auto:0<br>
n:network-natt-port:4500<br>
n:network-natt-rate:15<br>
n:network-frag-size:540<br>
n:network-dpd-enable:1<br>
n:client-banner-enable:0<br>
n:network-notify-enable:1<br>
n:client-dns-used:0<br>
n:client-dns-auto:0<br>
n:client-dns-suffix-auto:0<br>
n:client-splitdns-used:0<br>
n:client-splitdns-auto:0<br>
n:client-wins-used:0<br>
n:client-wins-auto:1<br>
n:phase1-dhgroup:5<br>
n:phase1-life-secs:28800<br>
n:phase1-life-kbytes:0<br>
n:vendor-chkpt-enable:0<br>
n:phase2-life-secs:1800<br>
n:phase2-life-kbytes:0<br>
n:policy-nailed:1<br>
n:policy-list-auto:0<br>
s:network-host:40.40.40.40<br>
s:client-auto-mode:disabled<br>
s:client-iface:virtual<br>
s:client-ip-addr:192.168.1.1<br>
s:client-ip-mask:255.255.255.255<br>
s:network-natt-mode:enable<br>
s:network-frag-mode:enable<br>
s:auth-method:mutual-psk<br>
s:ident-client-type:address<br>
s:ident-server-type:address<br>
b:auth-mutual-psk:(secret)<br>
s:phase1-exchange:aggressive<br>
s:phase1-cipher:3des<br>
s:phase1-hash:sha1<br>
s:phase2-transform:esp-3des<br>
s:phase2-hmac:sha1<br>
s:ipcomp-transform:disabled<br>
n:phase2-pfsgroup:5<br>
s:policy-level:require<br>
s:policy-list-include:50.50.50.50 / 255.255.255.255,10.10.10.10 /<br>
255.255.255.255<br>
<br>
Connection with the SonicWALL phase 2 renewal last part (VPN Client log)<br>
<- : recv IKE packet <a href="http://50.50.50.50:500" rel="noreferrer" target="_blank">50.50.50.50:500</a> -> <a href="http://40.40.40.40:500" rel="noreferrer" target="_blank">40.40.40.40:500</a> ( 76 bytes )<br>
DB : phase1 found<br>
ii : processing informational packet ( 76 bytes )<br>
== : new informational iv ( 8 bytes )<br>
=< : cookies 915d9ca44709a15b:e77b80b9c572d32d<br>
=< : message 552fc103<br>
=< : decrypt iv ( 8 bytes )<br>
== : decrypt packet ( 76 bytes )<br>
<= : trimmed packet padding ( 4 bytes )<br>
<= : stored iv ( 8 bytes )<br>
<< : hash payload<br>
<< : delete payload<br>
!! : unprocessed payload data !!!<br>
== : informational hash_i ( computed ) ( 20 bytes )<br>
== : informational hash_c ( received ) ( 20 bytes )<br>
!! : informational hash verification failed<br>
ii : received peer DELETE message<br>
ii : - <a href="http://50.50.50.50:500" rel="noreferrer" target="_blank">50.50.50.50:500</a> -> <a href="http://40.40.40.40:500" rel="noreferrer" target="_blank">40.40.40.40:500</a><br>
ii : - ipsec-esp spi = 0x5347bf9c<br>
no further entries until a few minutes later<br>
ii : phase2 sa is dead<br>
ii : phase2 removal after expire time<br>
DB : phase2 deleted ( obj count = 1 )<br>
<br>
Connection with the SonicWALL phase 2 renewal last part (VPN Client log)<br>
<- : recv IKE packet <a href="http://50.50.50.50:500" rel="noreferrer" target="_blank">50.50.50.50:500</a> -> <a href="http://40.40.40.40:500" rel="noreferrer" target="_blank">40.40.40.40:500</a> ( 76 bytes )<br>
DB : phase1 found<br>
ii : processing informational packet ( 76 bytes )<br>
== : new informational iv ( 8 bytes )<br>
=< : cookies 30319e5309693dd8:33dfc550c179a81b<br>
=< : message 2db6a00f<br>
=< : decrypt iv ( 8 bytes )<br>
== : decrypt packet ( 76 bytes )<br>
<= : trimmed packet padding ( 8 bytes )<br>
<= : stored iv ( 8 bytes )<br>
<< : hash payload<br>
<< : delete payload<br>
== : informational hash_i ( computed ) ( 20 bytes )<br>
== : informational hash_c ( received ) ( 20 bytes )<br>
ii : informational hash verified<br>
ii : received peer DELETE message<br>
ii : - <a href="http://50.50.50.50:500" rel="noreferrer" target="_blank">50.50.50.50:500</a> -> <a href="http://40.40.40.40:500" rel="noreferrer" target="_blank">40.40.40.40:500</a><br>
ii : - ipsec-esp spi = 0xb9b142e9<br>
DB : phase2 found<br>
DB : cleanup, marked phase2 0xb9b142e9 for removal<br>
DB : phase2 hard event canceled ( ref count = 1 )<br>
K> : send pfkey DELETE ESP message<br>
K< : recv pfkey DELETE ESP message<br>
K> : send pfkey DELETE ESP message<br>
K< : recv pfkey DELETE ESP message<br>
ii : phase2 removal before expire time<br>
DB : phase2 deleted ( obj count = 1 )<br>
<br>
Has anyone an idea why the phase2 renewal with the SonicWALL produces the<br>
!! : unprocessed payload data !!!<br>
!! : informational hash verification failed<br>
errors?<br>
Even setting the log level to "loud" I could see nothing in the logs why<br>
the pings don't go through for some minutes and afterwards go again through.<br>
<br>
Thank You!<br></blockquote><div>Hi Michael,<br><br></div><div>Can you enable debug and attach on this mail <br><a href="https://www.shrew.net/support/VPN_Bug_Report_Windows">https://www.shrew.net/support/VPN_Bug_Report_Windows</a><br><br></div><div>Regards,<br> <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
_______________________________________________<br>
vpn-help mailing list<br>
<a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
<a href="https://lists.shrew.net/mailman/listinfo/vpn-help" rel="noreferrer" target="_blank">https://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
</blockquote></div><br></div></div>