I have site to site VPN between a Pix-Endian at the moment. I have read
where if you use certain non-standard characters in the PFS you will get the
Payload_Malformed error. If it is not already change the key to a simple
alphanumeric one. If it is already, try dumbing the encryption down to
simple DES to see what you get. I can not remember the exact error but I did
once have an issue where the current config would not work with 3DES-AES, I
had to do DES and build up from there. This was a few years ago and my
memory is not too good, but anyways currently I do have AES-256 enabled now.
A PIX will site-to-site with an Endian. With that said, in my past
experience I found that either using FreeBSD, FreeBSD based firewalls
(Monowall/PFSense) worked much better than Endian. I never tried IPCOP, but
have used several other Linux based firewalls. My main problem with Endian
is the VPN is not stable, meaning the connection dies out too randomly. DPD
does give an incorrect error message in that the "R_U_THERE_ACK has invalid
icookie" that can be ignored. Supposedly this is Cisco not adhering to
standards in regards to DPD, what ever the case the Openswan list told me
long ago that this is a non-issue.
What I have found is that editing the ipsec.conf to try and change logging
level to all made no difference. The best advice I was able to get was to
insure there was a minimal constant flow of traffic through the tunnel. So I
added some machines on the Endian site to be monitored via SNMP at different
intervals along with using these machines to use NTP service from behind the
PIX side. This had no effect.
Below is the config for one of the VPNS which may or may not be of
assistance.
version 2
config setup
interfaces=%defaultroute
klipsdebug=all
plutodebug=all
uniqueids=yes
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.2.0/255.255.255.0,%v4:!/,%v4:!/,%v4:!192.168.1.0/255.255.255.0
conn %default
keyingtries=0
disablearrivalcheck=no
conn EFW
right=6x.xx.xxx.xxx
rightsubnet=192.168.2.0/255.255.255.0
rightnexthop=%defaultroute
left=6x.xxx.xxx.xx
leftsubnet=192.168.1.0/255.255.255.0
leftnexthop=%defaultroute
ike=aes256-md5-modp1024
esp=aes256-md5
ikelifetime=1h
keylife=8h
dpddelay=30
dpdtimeout=120
dpdaction=hold
authby=secret
auto=start
conn EFWRemote
left=6x.xx.xxx.xxx
leftnexthop=%defaultroute
leftsubnet=192.168.2.0/255.255.255.0
right=%any
rightsubnet=vhost:%no,%priv
dpddelay=30
dpdtimeout=120
dpdaction=clear
authby=secret
auto=add
conn block
auto=ignore
conn private
auto=ignore
conn private-or-clear
auto=ignore
conn clear-or-private
auto=ignore
conn clear
auto=ignore
conn packetdefault
auto=ignore
Sean Waite
-----Original Message-----
From: Daniel Barnett <[EMAIL PROTECTED]>
To: "'[email protected]'" <[email protected]>
Date: Sun, 25 Mar 2007 11:55:00 -0500
Subject: [Efw-user] Endian to Pix Site to Site VPN.
Has anyone site to site VPN’d a pix and the Endian
firewall?
I keep getting PAYLOAD_MALFORMED errors on my pix.
I also get a few with “invalid payloads” errors.
The pix seems to say the pre shared keys don’t match
but they are EXACTLY the same on both units.
--Daniel
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Efw-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/efw-user
