Problem between Cisco PIX 520 6.3(3) and FreeSwan 2.0.6

[rene.schmid]

hi,

i have troubles with a lan2lan vpn connection between my cisco pix 520 and a linux freeswan 2.0.6 firewall. kernel version 2.6.8

phase I is ok. i get the message QM_Idle

but phase II is not finished correctly.

on both sides we have no spi connection.

we want to encrypt the traffic between 2 private networks. on the linux box i get the message

ag-weid-fw:/etc# ipsec auto --up sitexs

104 "sitexs" #1: STATE_MAIN_I1: initiate

106 "sitexs" #1: STATE_MAIN_I2: sent MI2, expecting MR2

108 "sitexs" #1: STATE_MAIN_I3: sent MI3, expecting MR3

003 "sitexs" #1: protocol/port in Phase 1 ID Payload must be 0/0 or 17/500 but are 17/0

218 "sitexs" #1: STATE_MAIN_I3: INVALID_ID_INFORMATION

003 "sitexs" #1: encrypted Informational Exchange message is invalid because it is for incomplete ISAKMP SA

010 "sitexs" #1: STATE_MAIN_I3: retransmission; will wait 20s for response

010 "sitexs" #1: STATE_MAIN_I3: retransmission; will wait 40s for response

031 "sitexs" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message

any ideas ???

please help..

rene

[Patrick Iseli]

1.) Could be PFS:

Unselect "PFS" on the /etc/ipsec.secrets file on the Freeswan. Also disable pfs /etc/ipsec.conf

conn %default

type=tunnel

pfs=NO

If PFS os on then you have to also set DH Group 5 on the FreeSwan

2.) Verify that the access-list for the interesting traffic, encryption domains are identic !!!

on pix:

PIX(config)# access-list VPN permit ip Internalnet ISubnet Externalnet ESubnet

PIX(config)# crypto map REMOTE 10 match address VPN

check also

PIX(config)# nat (inside) 0 access-list NONAT

PIX(config)# access-list NONAT permit ip Internalnet ISubnet Externalnet Esubnet

Check the debugg output on the PIX and compare it with that document:

IP Security Troubleshooting - Understanding and Using debug Commands:

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a00800949c5.shtml

sincerley

Patrick

[rene.schmid]

hi patrick,

thanks for reply, the access-list's on the systems are correct. pfs is not enabled.

rene