Quantcast
Channel: EdgeRouter topics
Viewing all articles
Browse latest Browse all 20028

IPSEC v1.9.0 wont come up

$
0
0

Ok so I previously had an issue with v1.8.5 where I couldn't connect L2TP/IPSEC so I was hoping the 1.9.0 would fix this. Which it did, however now straight IPSEC tunnels do not work. You can see my previous thread and configs over at: http://community.ubnt.com/t5/EdgeMAX/Ipsec-L2tp-wont-connect/m-p/1615966#M118159

 

When I try to connect using IPSEC the only difference I see when I do a show vpn debug is this:

 

V1.9.0: peer-haven2.ignorelist.com-tunnel-1[1]: CONNECTING, 1.2.3.4[1.2.3.4]...5.6.7.8[%any]

V1.8.5: peer-haven2.ignorelist.com-tunnel-1[1]: CONNECTING, 1.2.3.4[1.2.3.4]...5.6.7.8[5.6.7.8]

 

There seems to be something in 1.9.0 that is not resolving and doing %any causing the connection to hang up?

 

Here is my IPSEC Config they are both exactly the same from the 1.8.5 version. If I revert the the old 1.8.5 system image the ipsec connection comes up no problem.

 

ch@ubnt# show vpn ipsec
 auto-update 600
 auto-firewall-nat-exclude disable
 esp-group FOO0 {
     compression disable
     lifetime 3600
     mode tunnel
     pfs enable
     proposal 1 {
         encryption aes128
         hash sha1
     }
 }
 ike-group FOO0 {
     dead-peer-detection {
         action restart
         interval 30
         timeout 120
     }
     ikev2-reauth no
     key-exchange ikev1
     lifetime 7800
     proposal 1 {
         dh-group 2
         encryption aes256
         hash sha1
     }
 }
 ipsec-interfaces {
     interface eth0
 }
 nat-networks {
     allowed-network 0.0.0.0/0 {
     }
 }
 nat-traversal enable
 site-to-site {
     peer haven2.ignorelist.com {
         authentication {
             mode pre-shared-secret
             pre-shared-secret *******
         }
         connection-type respond
         ike-group FOO0
         ikev2-reauth inherit
         local-address any
         tunnel 1 {
             allow-nat-networks disable
             allow-public-networks disable
             esp-group FOO0
             local {
                 prefix 192.168.11.0/24
             }
             remote {
                 prefix 192.168.1.0/24
             }
         }
         tunnel 2 {
             allow-nat-networks disable
             allow-public-networks disable
             esp-group FOO0
             local {
                 prefix 192.168.11.0/24
             }
             remote {
                 prefix 192.168.0.0/24
             }
         }
     }
 }

Did something change in IPSEC between 1.8.5 and 1.9.0 that causes my config not to work?

 

Also if it helps here is what the initiating side log is saying to the 1.9.0 ERL:

2016:08:25-18:33:30 sophos pluto[6183]: packet from 1.2.3.4:500: Main Mode message is part of an unknown exchange

2016:08:25-18:34:46 sophos pluto[6183]: "S_Townhouse" #2621: next payload type of ISAKMP Identification Payload has an unknown value: 104
2016:08:25-18:34:46 sophos pluto[6183]: "S_Townhouse" #2621: malformed payload in packet. Probable authentication failure (mismatch of preshared secrets?)
2016:08:25-18:34:46 sophos pluto[6183]: "S_Townhouse" #2621: sending encrypted notification PAYLOAD_MALFORMED to 1.2.3.4:500

I know the password is correct. I even changed it on both ends incase the ERL corrupted the entry or something stupid no luck.

 

Thanks,
Chris


Viewing all articles
Browse latest Browse all 20028

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>