First of all I love this product! This was one of the last things I needed to ditch Windows, now if VMware would just get with the program. Thats another topic.
We are using the shrew vpn client 2.14 linux (ubuntu and fedora core 12) and windows 7 to connect to Netscreen SSG 520. Our setup is nearly the same as the guide on the Shrew page accept we are using Wikid two factor tokens for authentication and freeradius for IP assignments. We can connect with no problems initially. The problem: We get kicked off every hour. The logs below shows what happens on both the firewall and the local linux client. I haven't logged a Windows 7 box but the exact problem exists. When using the standard Netscreen client (on XP since there is no linux or windows 7 client) we stay connected for 12 hrs. before getting kicked off by the time limit setting we have set. I've scoured the settings on the Netscreen client and do not see anything different. I browsed around the mailing lists but didn't find much info on this topic. Questions: 1. Does the Shrew VPN client even support Wikid two factor authentication? 2. Does the shrew VPN client suppot any other two factor solutions? 3. Are there any setting on either the Firewall or the Shrew VPN client that may correct this? Thanks for your help and for a great product. ------------------------------------------------------------------------- Firewall logs 2010-03-25 12:53:03 info IKE XXX.XXX.XXX Phase 1: Retransmission limit has been reached. 2010-03-25 12:52:49 notif The system clock was updated from primary NTP server type XXX.XXX.XXX with an adjustment of 16 ms. Authentication was None. Update mode was Automatic 2010-03-25 12:52:29 info IKE xxx.xxx.xxx: XAuth login expired and was terminated for username XXX at 0.0.0.0/0.0.0.0. 2010-03-25 12:52:19 info IKE xxx.xxx.xxx: XAuth login was aborted for gateway VRF-MGT-GATEWAY, username xxx, retry: 1. 2010-03-25 12:52:12 info IKE xxx.xxx.xxx Phase 1: Completed Aggressive mode negotiations with a 28800-second lifetime. 2010-03-25 12:52:12 info IKE xxx.xxx.xxx Phase 1: Completed for user xxx-vrf. 2010-03-25 12:52:12 info IKE<xxx.xxx.xxx> Phase 1: IKE responder has detected NAT in front of the remote device. 2010-03-25 12:52:12 info IKE xxx.xxx.xxx Phase 1: Responder starts AGGRESSIVE mode negotiations. Output from Ubuntu 9.10 client in debug mode 10/03/25 12:52:14 DB : phase1 found 10/03/25 12:52:14 ii : processing config packet ( 76 bytes ) 10/03/25 12:52:14 DB : config found 10/03/25 12:52:14 == : new config iv ( 8 bytes ) 10/03/25 12:52:14 =< : cookies b8067ea5e4002a6c:3556df8bd2dfda4c 10/03/25 12:52:14 =< : message 544e220a 10/03/25 12:52:14 =< : decrypt iv ( 8 bytes ) 10/03/25 12:52:14 == : decrypt packet ( 76 bytes ) 10/03/25 12:52:14 <= : trimmed packet padding ( 4 bytes ) 10/03/25 12:52:14 <= : stored iv ( 8 bytes ) 10/03/25 12:52:14 << : hash payload 10/03/25 12:52:14 << : attribute payload 10/03/25 12:52:14 == : configure hash_i ( computed ) ( 20 bytes ) 10/03/25 12:52:14 == : configure hash_c ( computed ) ( 20 bytes ) 10/03/25 12:52:14 ii : configure hash verified 10/03/25 12:52:14 !! : duplicate xauth request, authentication failed 10/03/25 12:52:14 DB : phase1 soft event canceled ( ref count = 3 ) 10/03/25 12:52:14 DB : phase1 hard event canceled ( ref count = 2 ) 10/03/25 12:52:14 DB : phase1 dead event canceled ( ref count = 1 ) 10/03/25 12:52:14 ii : sending peer DELETE message 10/03/25 12:52:14 ii : - xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 10/03/25 12:52:14 ii : - isakmp spi = b8067ea5e4002a6c:3556df8bd2dfda4c 10/03/25 12:52:14 ii : - data size 0 10/03/25 12:52:14 >> : hash payload 10/03/25 12:52:14 >> : delete payload 10/03/25 12:52:14 == : new informational hash ( 20 bytes ) 10/03/25 12:52:14 == : new informational iv ( 8 bytes ) 10/03/25 12:52:14 >= : cookies b8067ea5e4002a6c:3556df8bd2dfda4c 10/03/25 12:52:14 >= : message 27292501 10/03/25 12:52:14 >= : encrypt iv ( 8 bytes ) 10/03/25 12:52:14 == : encrypt packet ( 80 bytes ) 10/03/25 12:52:14 == : stored iv ( 8 bytes ) 10/03/25 12:52:14 -> : send NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 116 bytes ) 10/03/25 12:52:14 DB : config resend event canceled ( ref count = 1 ) 10/03/25 12:52:14 DB : config deleted ( obj count = 1 ) 10/03/25 12:52:14 ii : phase1 removal before expire time 10/03/25 12:52:14 DB : phase1 deleted ( obj count = 1 ) 10/03/25 12:52:14 DB : policy found 10/03/25 12:52:14 ii : removing IPSEC INBOUND policy ANY:xxx.xxx.xxx.xxx:* -> ANY:xxx.xxx.xxx.xxx:* 10/03/25 12:52:14 K> : send pfkey X_SPDDELETE2 UNSPEC message 10/03/25 12:52:14 DB : policy found 10/03/25 12:52:14 ii : removing IPSEC OUTBOUND policy ANY:xxx.xxx.xxx.xxx:* -> ANY:xxx.xxx.xxx.xxx:* 10/03/25 12:52:14 K> : send pfkey X_SPDDELETE2 UNSPEC message 10/03/25 12:52:14 ii : removed IPSEC policy route for ANY:xxx.xxx.xxx.xxx:* 10/03/25 12:52:14 K< : recv pfkey X_SPDDELETE2 UNSPEC message 10/03/25 12:52:14 DB : policy found 10/03/25 12:52:14 DB : policy deleted ( obj count = 1 ) 10/03/25 12:52:14 K< : recv pfkey X_SPDDELETE2 UNSPEC message 10/03/25 12:52:14 DB : policy found 10/03/25 12:52:14 DB : policy deleted ( obj count = 0 ) 10/03/25 12:52:15 ii : closed tap device tap0 10/03/25 12:52:15 DB : tunnel dpd event canceled ( ref count = 6 ) 10/03/25 12:52:15 DB : tunnel natt event canceled ( ref count = 5 ) 10/03/25 12:52:15 DB : tunnel stats event canceled ( ref count = 4 ) 10/03/25 12:52:15 DB : removing tunnel config references 10/03/25 12:52:15 DB : config deleted ( obj count = 0 ) 10/03/25 12:52:15 DB : removing tunnel phase2 references 10/03/25 12:52:15 DB : phase2 hard event canceled ( ref count = 1 ) 10/03/25 12:52:15 DB : phase1 found 10/03/25 12:52:15 ii : sending peer DELETE message 10/03/25 12:52:15 ii : - xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 10/03/25 12:52:15 ii : - ipsec-esp spi = 0x06fc982e 10/03/25 12:52:15 ii : - data size 0 10/03/25 12:52:15 >> : hash payload 10/03/25 12:52:15 >> : delete payload 10/03/25 12:52:15 == : new informational hash ( 20 bytes ) 10/03/25 12:52:15 == : new informational iv ( 8 bytes ) 10/03/25 12:52:15 >= : cookies 5bcf3ec13c9e7e15:df48cad9327c7c42 10/03/25 12:52:15 >= : message 15eb182e 10/03/25 12:52:15 >= : encrypt iv ( 8 bytes ) 10/03/25 12:52:15 == : encrypt packet ( 68 bytes ) 10/03/25 12:52:15 == : stored iv ( 8 bytes ) 10/03/25 12:52:15 -> : send NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 100 bytes ) 10/03/25 12:52:15 K> : send pfkey DELETE ESP message 10/03/25 12:52:15 K> : send pfkey DELETE ESP message 10/03/25 12:52:15 ii : phase2 removal before expire time 10/03/25 12:52:15 DB : phase2 deleted ( obj count = 0 ) 10/03/25 12:52:15 DB : removing tunnel phase1 references 10/03/25 12:52:15 DB : phase1 hard event canceled ( ref count = 2 ) 10/03/25 12:52:15 DB : phase1 dead event canceled ( ref count = 1 ) 10/03/25 12:52:15 ii : sending peer DELETE message 10/03/25 12:52:15 ii : - xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 10/03/25 12:52:15 ii : - isakmp spi = 5bcf3ec13c9e7e15:df48cad9327c7c42 10/03/25 12:52:15 ii : - data size 0 10/03/25 12:52:15 >> : hash payload 10/03/25 12:52:15 >> : delete payload 10/03/25 12:52:15 == : new informational hash ( 20 bytes ) 10/03/25 12:52:15 == : new informational iv ( 8 bytes ) 10/03/25 12:52:15 >= : cookies 5bcf3ec13c9e7e15:df48cad9327c7c42 10/03/25 12:52:15 >= : message caab1d21 10/03/25 12:52:15 >= : encrypt iv ( 8 bytes ) 10/03/25 12:52:15 == : encrypt packet ( 80 bytes ) 10/03/25 12:52:15 == : stored iv ( 8 bytes ) 10/03/25 12:52:15 -> : send NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 116 bytes ) 10/03/25 12:52:15 ii : phase1 removal before expire time 10/03/25 12:52:15 DB : phase1 deleted ( obj count = 0 ) 10/03/25 12:52:15 DB : tunnel deleted ( obj count = 0 ) 10/03/25 12:52:15 DB : removing all peer tunnel refrences 10/03/25 12:52:15 DB : peer deleted ( obj count = 0 ) 10/03/25 12:52:15 ii : ipc client process thread exit ... 10/03/25 12:52:15 K< : recv pfkey DELETE ESP message 10/03/25 12:52:15 K< : recv pfkey DELETE ESP message 10/03/25 12:52:15 <- : recv NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 408 bytes ) 10/03/25 12:52:15 DB : phase1 not found 10/03/25 12:52:15 ii : attempting to locate tunnel for peer xxx.xxx.xxx.xxx 10/03/25 12:52:15 DB : tunnel not found 10/03/25 12:52:15 DB : peer not found 10/03/25 12:52:15 ww : ike packet from xxx.xxx.xxx.xxx ignored, no matching definition for peer 10/03/25 12:52:19 <- : recv NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 408 bytes ) 10/03/25 12:52:19 DB : phase1 not found 10/03/25 12:52:19 ii : attempting to locate tunnel for peer xxx.xxx.xxx.xxx 10/03/25 12:52:19 DB : tunnel not found 10/03/25 12:52:19 DB : peer not found 10/03/25 12:52:19 ww : ike packet from xxx.xxx.xxx.xxx ignored, no matching definition for peer 10/03/25 12:52:23 <- : recv NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 408 bytes ) 10/03/25 12:52:23 DB : phase1 not found 10/03/25 12:52:23 ii : attempting to locate tunnel for peer xxx.xxx.xxx.xxx 10/03/25 12:52:23 DB : tunnel not found 10/03/25 12:52:23 DB : peer not found 10/03/25 12:52:23 ww : ike packet from xxx.xxx.xxx.xxx ignored, no matching definition for peer 10/03/25 12:52:27 <- : recv NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 408 bytes ) 10/03/25 12:52:27 DB : phase1 not found 10/03/25 12:52:27 ii : attempting to locate tunnel for peer xxx.xxx.xxx.xxx 10/03/25 12:52:27 DB : tunnel not found 10/03/25 12:52:27 DB : peer not found 10/03/25 12:52:27 ww : ike packet from xxx.xxx.xxx.xxx ignored, no matching definition for peer 10/03/25 12:52:31 <- : recv NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 408 bytes ) 10/03/25 12:52:31 DB : phase1 not found 10/03/25 12:52:31 ii : attempting to locate tunnel for peer xxx.xxx.xxx.xxx 10/03/25 12:52:31 DB : tunnel not found 10/03/25 12:52:31 DB : peer not found 10/03/25 12:52:31 ww : ike packet from xxx.xxx.xxx.xxx ignored, no matching definition for peer 10/03/25 12:52:35 <- : recv NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 408 bytes ) 10/03/25 12:52:35 DB : phase1 not found 10/03/25 12:52:35 ii : attempting to locate tunnel for peer xxx.xxx.xxx.xxx 10/03/25 12:52:35 DB : tunnel not found 10/03/25 12:52:35 DB : peer not found 10/03/25 12:52:35 ww : ike packet from xxx.xxx.xxx.xxx ignored, no matching definition for peer 10/03/25 12:52:39 <- : recv NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 408 bytes ) 10/03/25 12:52:39 DB : phase1 not found 10/03/25 12:52:39 ii : attempting to locate tunnel for peer xxx.xxx.xxx.xxx 10/03/25 12:52:39 DB : tunnel not found 10/03/25 12:52:39 DB : peer not found 10/03/25 12:52:39 ww : ike packet from xxx.xxx.xxx.xxx ignored, no matching definition for peer 10/03/25 12:52:43 <- : recv NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 408 bytes ) 10/03/25 12:52:43 DB : phase1 not found 10/03/25 12:52:43 ii : attempting to locate tunnel for peer xxx.xxx.xxx.xxx 10/03/25 12:52:43 DB : tunnel not found 10/03/25 12:52:43 DB : peer not found 10/03/25 12:52:43 ww : ike packet from xxx.xxx.xxx.xxx ignored, no matching definition for peer 10/03/25 12:52:47 <- : recv NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 408 bytes ) 10/03/25 12:52:47 DB : phase1 not found 10/03/25 12:52:47 ii : attempting to locate tunnel for peer xxx.xxx.xxx.xxx 10/03/25 12:52:47 DB : tunnel not found 10/03/25 12:52:47 DB : peer not found 10/03/25 12:52:47 ww : ike packet from xxx.xxx.xxx.xxx ignored, no matching definition for peer 10/03/25 12:52:51 <- : recv NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 408 bytes ) 10/03/25 12:52:51 DB : phase1 not found 10/03/25 12:52:51 ii : attempting to locate tunnel for peer xxx.xxx.xxx.xxx 10/03/25 12:52:51 DB : tunnel not found 10/03/25 12:52:51 DB : peer not found 10/03/25 12:52:51 ww : ike packet from xxx.xxx.xxx.xxx ignored, no matching definition for peer 10/03/25 12:52:55 <- : recv NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 408 bytes ) 10/03/25 12:52:55 DB : phase1 not found 10/03/25 12:52:55 ii : attempting to locate tunnel for peer xxx.xxx.xxx.xxx 10/03/25 12:52:55 DB : tunnel not found 10/03/25 12:52:55 DB : peer not found 10/03/25 12:52:55 ww : ike packet from xxx.xxx.xxx.xxx ignored, no matching definition for peer 10/03/25 12:52:59 <- : recv NAT-T:IKE packet xxx.xxx.xxx.xxx:4500 -> xxx.xxx.xxx.xxx:4500 ( 408 bytes ) 10/03/25 12:52:59 DB : phase1 not found 10/03/25 12:52:59 ii : attempting to locate tunnel for peer xxx.xxx.xxx.xxx 10/03/25 12:52:59 DB : tunnel not found 10/03/25 12:52:59 DB : peer not found 10/03/25 12:52:59 ww : ike packet from xxx.xxx.xxx.xxx ignored, no matching definition for peer _______________________________________________ vpn-help mailing list [email protected] http://lists.shrew.net/mailman/listinfo/vpn-help
