Ok so I previously had an issue with v1.8.5 where I couldn't connect L2TP/IPSEC so I was hoping the 1.9.0 would fix this. Which it did, however now straight IPSEC tunnels do not work. You can see my previous thread and configs over at: http://community.ubnt.com/t5/EdgeMAX/Ipsec-L2tp-wont-connect/m-p/1615966#M118159
When I try to connect using IPSEC the only difference I see when I do a show vpn debug is this:
V1.9.0: peer-haven2.ignorelist.com-tunnel-1[1]: CONNECTING, 1.2.3.4[1.2.3.4]...5.6.7.8[%any]
V1.8.5: peer-haven2.ignorelist.com-tunnel-1[1]: CONNECTING, 1.2.3.4[1.2.3.4]...5.6.7.8[5.6.7.8]
There seems to be something in 1.9.0 that is not resolving and doing %any causing the connection to hang up?
Here is my IPSEC Config they are both exactly the same from the 1.8.5 version. If I revert the the old 1.8.5 system image the ipsec connection comes up no problem.
ch@ubnt# show vpn ipsec auto-update 600 auto-firewall-nat-exclude disable esp-group FOO0 { compression disable lifetime 3600 mode tunnel pfs enable proposal 1 { encryption aes128 hash sha1 } } ike-group FOO0 { dead-peer-detection { action restart interval 30 timeout 120 } ikev2-reauth no key-exchange ikev1 lifetime 7800 proposal 1 { dh-group 2 encryption aes256 hash sha1 } } ipsec-interfaces { interface eth0 } nat-networks { allowed-network 0.0.0.0/0 { } } nat-traversal enable site-to-site { peer haven2.ignorelist.com { authentication { mode pre-shared-secret pre-shared-secret ******* } connection-type respond ike-group FOO0 ikev2-reauth inherit local-address any tunnel 1 { allow-nat-networks disable allow-public-networks disable esp-group FOO0 local { prefix 192.168.11.0/24 } remote { prefix 192.168.1.0/24 } } tunnel 2 { allow-nat-networks disable allow-public-networks disable esp-group FOO0 local { prefix 192.168.11.0/24 } remote { prefix 192.168.0.0/24 } } } }
Did something change in IPSEC between 1.8.5 and 1.9.0 that causes my config not to work?
Also if it helps here is what the initiating side log is saying to the 1.9.0 ERL:
2016:08:25-18:33:30 sophos pluto[6183]: packet from 1.2.3.4:500: Main Mode message is part of an unknown exchange 2016:08:25-18:34:46 sophos pluto[6183]: "S_Townhouse" #2621: next payload type of ISAKMP Identification Payload has an unknown value: 104 2016:08:25-18:34:46 sophos pluto[6183]: "S_Townhouse" #2621: malformed payload in packet. Probable authentication failure (mismatch of preshared secrets?) 2016:08:25-18:34:46 sophos pluto[6183]: "S_Townhouse" #2621: sending encrypted notification PAYLOAD_MALFORMED to 1.2.3.4:500
I know the password is correct. I even changed it on both ends incase the ERL corrupted the entry or something stupid no luck.
Thanks,
Chris