I try to setup an Ipsec vpn between and Draytek 2960 and my own ER-lite.
Both modems are set in bridge mode. My edgerouter is running the 1.9 firmware. A vpn to another Edgerouter works fine. There is a NAT rule for the vpns.
I can't get it running. My own config is:
vpn {
ipsec {
auto-firewall-nat-exclude disable
}
esp-group FOO1 {
proposal 1 {
encryption aes128
hash sha1
}
}
ike-group FOO1 {
proposal 1 {
dh-group 2
encryption aes128
hash sha1
}
}
site-to-site {
peer friendip {
authentication {
mode pre-shared-secret
pre-shared-secret ****************
}
connection-type initiate
description Martijn
ike-group FOO1
local-address myownip
tunnel 1 {
esp-group FOO1
local {
prefix 172.20.92.0/24
}
remote {
prefix 172.16.4.0/24
}
}
}
}
}
The other side (draytek)
Image may be NSFW.
Clik here to view.
Image may be NSFW.
Clik here to view.
Image may be NSFW.
Clik here to view.
Image may be NSFW.
Clik here to view.
When I do a swanctl --log i get the following errors:
05[ENC] generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
05[NET] sending packet: from myownip[500] to friendip[500] (236 bytes)
16[NET] received packet: from friendip[500] to myownip[500] (60 bytes)
16[ENC] invalid ID_V1 payload length, decryption failed?
16[ENC] could not decrypt payloads
16[IKE] message parsing failed
16[ENC] generating INFORMATIONAL_V1 request 3437709852 [ HASH N(PLD_MAL) ]
16[NET] sending packet: from myownip[500] to friendip[500] (76 bytes)
16[IKE] ID_PROT request with message ID 0 processing failed
15[NET] received packet: from friendip[500] to myownip[500] (40 bytes)
15[ENC] parsed INFORMATIONAL_V1 request 1737192136 [ N(PLD_MAL) ]
15[ENC] ignoring unprotected INFORMATIONAL from friendip
15[IKE] message verification failed
15[IKE] ignore malformed INFORMATIONAL request
15[IKE] INFORMATIONAL_V1 request with message ID 1737192136 processing failed
11[JOB] deleting half open IKE_SA after timeout
03[NET] received packet: from friendip[500] to myownip[500] (60 bytes)
03[ENC] invalid ID_V1 payload length, decryption failed?
03[ENC] could not decrypt payloads
03[IKE] message parsing failed
03[ENC] generating INFORMATIONAL_V1 request 1731319519 [ HASH N(PLD_MAL) ]
03[NET] sending packet: from myownip[500] to friendip[500] (76 bytes)
03[IKE] ID_PROT request with message ID 0 processing failed
09[NET] received packet: from friendip[500] to myownip[500] (40 bytes)
09[ENC] parsed INFORMATIONAL_V1 request 1755395298 [ N(PLD_MAL) ]
09[ENC] ignoring unprotected INFORMATIONAL from friendip
09[IKE] message verification failed
09[IKE] ignore malformed INFORMATIONAL request
09[IKE] INFORMATIONAL_V1 request with message ID 1755395298 processing failed
04[NET] received packet: from friendip[500] to myownip[500] (60 bytes)
04[ENC] invalid ID_V1 payload length, decryption failed?
04[ENC] could not decrypt payloads
04[IKE] message parsing failed
04[ENC] generating INFORMATIONAL_V1 request 1155512890 [ HASH N(PLD_MAL) ]
04[NET] sending packet: from myownip[500] to friendip[500] (76 bytes)
04[IKE] ID_PROT request with message ID 0 processing failed
05[NET] received packet: from friendip[500] to myownip[500] (40 bytes)
05[ENC] parsed INFORMATIONAL_V1 request 512819685 [ N(PLD_MAL) ]
05[ENC] ignoring unprotected INFORMATIONAL from friendip
05[IKE] message verification failed
05[IKE] ignore malformed INFORMATIONAL request
05[IKE] INFORMATIONAL_V1 request with message ID 512819685 processing failed
03[JOB] deleting half open IKE_SA after timeout
09[NET] received packet: from friendip[500] to myownip[500] (292 bytes)
09[ENC] parsed ID_PROT request 0 [ SA V V V V V V V ]
09[ENC] received unknown vendor ID: 4f:45:7d:78:54:60:50:75:7b:70:72:45
09[IKE] received DPD vendor ID
09[IKE] received NAT-T (RFC 3947) vendor ID
09[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID
09[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID
09[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
09[IKE] received draft-ietf-ipsec-nat-t-ike-00 vendor ID
09[IKE] friendip is initiating a Main Mode IKE_SA
09[ENC] generating ID_PROT response 0 [ SA V V V ]
09[NET] sending packet: from myownip[500] to friendip[500] (136 bytes)
07[NET] received packet: from friendip[500] to myownip[500] (220 bytes)
07[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
07[ENC] generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
07[NET] sending packet: from myownip[500] to friendip[500] (236 bytes)
14[NET] received packet: from friendip[500] to myownip[500] (60 bytes)
14[ENC] invalid ID_V1 payload length, decryption failed?
14[ENC] could not decrypt payloads
14[IKE] message parsing failed
14[ENC] generating INFORMATIONAL_V1 request 3088244074 [ HASH N(PLD_MAL) ]
14[NET] sending packet: from myownip[500] to friendip[500] (76 bytes)
14[IKE] ID_PROT request with message ID 0 processing failed
09[NET] received packet: from friendip[500] to myownip[500] (40 bytes)
09[ENC] parsed INFORMATIONAL_V1 request 2803791549 [ N(PLD_MAL) ]
09[ENC] ignoring unprotected INFORMATIONAL from friendip
09[IKE] message verification failed
09[IKE] ignore malformed INFORMATIONAL request
I doublechecked the psk and everything seems fine so does anybody has a clue what is going wrong?