On 7/10/2010 1:50 AM, Aaron Sarazan wrote: > ModeConfig + xAuth > Shrew Linux v2.1.5->2.1.6-b10 (compiled from source) > Ubuntu Linux 10.04 LTS 2.6.32-22-generic > FVS338 (v2.0.6-25) > > Hey guys, sorry I've been on a bit of a rash of problems lately, > hopefully this will be the last, as I recently got the windows config > steady and stable. All I'm trying to do now is get the linux client to > behave as well. Below you'll find all the logs I was able to gather (for > some reason the pcap stuff never actually put anything in the dump file). > > Basically the connection never completes, and I see a lot of 0000000's > that look like they're probably not supposed to be 0's. Let me know if > you really need the pcap dump file, and I'll take another crack at > getting it together. >
Aaron, I just built 4 Ubuntu 10.04 VMs. Two 32bit VMs for Qt3 testing and two on 64bit VMs for Qt4 testing. All four VMs compiled the 2.1.6 or head branches and connected to our netgear appliance without any issue. The only special changes I made were to set the rp_filter to 0 for all sysctl values ... http://lists.shrew.net/mailman/htdig/vpn-help/2008-November/001827.html ... and made sure the policy level is set to unique in the policy tab. This is required as the netgear ike daemon is ipsec-tools raccon which advertises itself as Cisco compatible. Besides that, I'm not sure why your connection is failing. Here is some output for comparison ... Linux ubuntu-10 2.6.32-23-generic #37-Ubuntu SMP Fri Jun 11 07:54:58 UTC 2010 i686 GNU/Linu 10/07/10 14:41:19 ii : generating IPSEC security policies at UNIQUE level 10/07/10 14:41:19 ii : creating NONE INBOUND policy ANY:10.1.1.25:* -> ANY:10.22.200.90:* 10/07/10 14:41:19 DB : policy added ( obj count = 1 ) 10/07/10 14:41:19 K> : send pfkey X_SPDADD UNSPEC message 10/07/10 14:41:19 ii : creating NONE OUTBOUND policy ANY:10.22.200.90:* -> ANY:10.1.1.25:* 10/07/10 14:41:19 ii : created NONE policy route for 10.1.1.25/32 10/07/10 14:41:19 DB : policy added ( obj count = 2 ) 10/07/10 14:41:19 K> : send pfkey X_SPDADD UNSPEC message 10/07/10 14:41:19 ii : creating IPSEC INBOUND policy ANY:10.1.2.0/24:* -> ANY:10.2.25.1:* 10/07/10 14:41:19 DB : policy added ( obj count = 3 ) 10/07/10 14:41:19 K> : send pfkey X_SPDADD UNSPEC message 10/07/10 14:41:19 ii : creating IPSEC OUTBOUND policy ANY:10.2.25.1:* -> ANY:10.1.2.0/24:* 10/07/10 14:41:19 ii : created IPSEC policy route for 10.1.2.0/24 10/07/10 14:41:19 DB : policy added ( obj count = 4 ) 10/07/10 14:41:19 K> : send pfkey X_SPDADD UNSPEC message 10/07/10 14:41:19 K< : recv pfkey X_SPDADD UNSPEC message 10/07/10 14:41:19 DB : policy found 10/07/10 14:41:19 K< : recv pfkey X_SPDADD UNSPEC message 10/07/10 14:41:19 DB : policy found 10/07/10 14:41:19 ii : calling init phase2 for initial policy 10/07/10 14:41:19 DB : policy found 10/07/10 14:41:19 DB : policy not found 10/07/10 14:41:19 !! : unable to locate inbound policy for init phase2 10/07/10 14:41:19 K< : recv pfkey X_SPDADD UNSPEC message 10/07/10 14:41:19 DB : policy found 10/07/10 14:41:19 K< : recv pfkey X_SPDADD UNSPEC message 10/07/10 14:41:19 DB : policy found 10/07/10 14:41:20 K< : recv pfkey ACQUIRE ESP message 10/07/10 14:41:20 DB : policy found 10/07/10 14:41:20 DB : policy found 10/07/10 14:41:20 DB : tunnel found 10/07/10 14:41:20 DB : new phase2 ( IPSEC initiator ) 10/07/10 14:41:20 DB : phase2 added ( obj count = 1 ) 10/07/10 14:41:20 K> : send pfkey GETSPI ESP message 10/07/10 14:41:20 K< : recv pfkey GETSPI ESP message 10/07/10 14:41:20 DB : phase2 found 10/07/10 14:41:20 ii : updated spi for 1 ipsec-esp proposal 10/07/10 14:41:20 DB : phase1 found 10/07/10 14:41:20 >> : hash payload 10/07/10 14:41:20 >> : security association payload 10/07/10 14:41:20 >> : - proposal #1 payload 10/07/10 14:41:20 >> : -- transform #1 payload 10/07/10 14:41:20 >> : -- transform #2 payload 10/07/10 14:41:20 >> : -- transform #3 payload 10/07/10 14:41:20 >> : -- transform #4 payload 10/07/10 14:41:20 >> : -- transform #5 payload 10/07/10 14:41:20 >> : -- transform #6 payload 10/07/10 14:41:20 >> : -- transform #7 payload 10/07/10 14:41:20 >> : -- transform #8 payload 10/07/10 14:41:20 >> : -- transform #9 payload 10/07/10 14:41:20 >> : nonce payload 10/07/10 14:41:20 >> : key exchange payload 10/07/10 14:41:20 >> : identification payload 10/07/10 14:41:20 >> : identification payload 10/07/10 14:41:20 == : phase2 hash_i ( input ) ( 524 bytes ) 10/07/10 14:41:20 == : phase2 hash_i ( computed ) ( 20 bytes ) 10/07/10 14:41:20 == : new phase2 iv ( 8 bytes ) 10/07/10 14:41:20 >= : cookies cf77c9371178b5e8:0b1187277d31f103 10/07/10 14:41:20 >= : message 1b8b06c8 10/07/10 14:41:20 >= : encrypt iv ( 8 bytes ) 10/07/10 14:41:20 == : encrypt packet ( 572 bytes ) 10/07/10 14:41:20 == : stored iv ( 8 bytes ) 10/07/10 14:41:20 -> : send NAT-T:IKE packet 10.22.200.90:4500 -> 10.1.1.25:4500 ( 604 bytes ) 10/07/10 14:41:20 DB : phase2 resend event scheduled ( ref count = 2 ) 10/07/10 14:41:20 <- : recv NAT-T:IKE packet 10.1.1.25:4500 -> 10.22.200.90:4500 ( 292 bytes ) 10/07/10 14:41:20 DB : phase1 found 10/07/10 14:41:20 ii : processing phase2 packet ( 292 bytes ) 10/07/10 14:41:20 DB : phase2 found 10/07/10 14:41:20 =< : cookies cf77c9371178b5e8:0b1187277d31f103 10/07/10 14:41:20 =< : message 1b8b06c8 10/07/10 14:41:20 =< : decrypt iv ( 8 bytes ) 10/07/10 14:41:20 == : decrypt packet ( 292 bytes ) 10/07/10 14:41:20 <= : trimmed packet padding ( 4 bytes ) 10/07/10 14:41:20 <= : stored iv ( 8 bytes ) 10/07/10 14:41:20 << : hash payload 10/07/10 14:41:20 << : security association payload 10/07/10 14:41:20 << : - propsal #1 payload 10/07/10 14:41:20 << : -- transform #7 payload 10/07/10 14:41:20 << : nonce payload 10/07/10 14:41:20 << : key exchange payload 10/07/10 14:41:20 << : identification payload 10/07/10 14:41:20 << : identification payload 10/07/10 14:41:20 == : phase2 hash_r ( input ) ( 260 bytes ) 10/07/10 14:41:20 == : phase2 hash_r ( computed ) ( 20 bytes ) 10/07/10 14:41:20 == : phase2 hash_r ( received ) ( 20 bytes ) 10/07/10 14:41:20 ii : unmatched ipsec-esp proposal/transform 10/07/10 14:41:20 ii : crypto transform type ( esp-3des != esp-aes ) 10/07/10 14:41:20 ii : unmatched ipsec-esp proposal/transform 10/07/10 14:41:20 ii : crypto transform type ( esp-3des != esp-aes ) 10/07/10 14:41:20 ii : unmatched ipsec-esp proposal/transform 10/07/10 14:41:20 ii : crypto transform type ( esp-3des != esp-aes ) 10/07/10 14:41:20 ii : unmatched ipsec-esp proposal/transform 10/07/10 14:41:20 ii : crypto transform type ( esp-3des != esp-blowfish ) 10/07/10 14:41:20 ii : unmatched ipsec-esp proposal/transform 10/07/10 14:41:20 ii : crypto transform type ( esp-3des != esp-blowfish ) 10/07/10 14:41:20 ii : unmatched ipsec-esp proposal/transform 10/07/10 14:41:20 ii : crypto transform type ( esp-3des != esp-blowfish ) 10/07/10 14:41:20 ii : matched ipsec-esp proposal #1 transform #7 10/07/10 14:41:20 ii : - transform = esp-3des 10/07/10 14:41:20 ii : - key length = default 10/07/10 14:41:20 ii : - encap mode = udp-tunnel ( draft ) 10/07/10 14:41:20 ii : - msg auth = hmac-sha 10/07/10 14:41:20 ii : - pfs dh group = modp-1024 10/07/10 14:41:20 ii : - life seconds = 3600 10/07/10 14:41:20 ii : - life kbytes = 0 10/07/10 14:41:20 DB : policy found 10/07/10 14:41:20 K> : send pfkey GETSPI ESP message 10/07/10 14:41:20 K< : recv pfkey GETSPI ESP message 10/07/10 14:41:20 DB : phase2 found 10/07/10 14:41:20 ii : phase2 ids accepted 10/07/10 14:41:20 ii : - loc ANY:10.2.25.1:* -> ANY:10.1.2.0/24:* 10/07/10 14:41:20 ii : - rmt ANY:10.1.2.0/24:* -> ANY:10.2.25.1:* 10/07/10 14:41:20 ii : phase2 sa established 10/07/10 14:41:20 ii : 10.22.200.90:4500 <-> 10.1.1.25:4500 10/07/10 14:41:20 == : phase2 hash_p ( input ) ( 41 bytes ) 10/07/10 14:41:20 == : phase2 hash_p ( computed ) ( 20 bytes ) 10/07/10 14:41:20 >> : hash payload 10/07/10 14:41:20 >= : cookies cf77c9371178b5e8:0b1187277d31f103 10/07/10 14:41:20 >= : message 1b8b06c8 10/07/10 14:41:20 >= : encrypt iv ( 8 bytes ) 10/07/10 14:41:20 == : encrypt packet ( 52 bytes ) 10/07/10 14:41:20 == : stored iv ( 8 bytes ) 10/07/10 14:41:20 DB : phase2 resend event canceled ( ref count = 1 ) 10/07/10 14:41:20 -> : send NAT-T:IKE packet 10.22.200.90:4500 -> 10.1.1.25:4500 ( 84 bytes ) 10/07/10 14:41:20 == : PFS DH shared secret ( 128 bytes ) 10/07/10 14:41:20 == : spi cipher key data ( 24 bytes ) 10/07/10 14:41:20 == : spi hmac key data ( 20 bytes ) 10/07/10 14:41:20 K> : send pfkey UPDATE ESP message 10/07/10 14:41:20 == : spi cipher key data ( 24 bytes ) 10/07/10 14:41:20 == : spi hmac key data ( 20 bytes ) 10/07/10 14:41:20 K> : send pfkey UPDATE ESP message 10/07/10 14:41:20 K< : recv pfkey UPDATE ESP message 10/07/10 14:41:20 K< : recv pfkey UPDATE ESP message -Matthew _______________________________________________ vpn-help mailing list [email protected] http://lists.shrew.net/mailman/listinfo/vpn-help
