Login or Register to Ask a Question and Join Our Community


Solaris

Connecting Solaris 10 to Cisco PIX with IPsec tunnel

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Operating Systems Solaris Connecting Solaris 10 to Cisco PIX with IPsec tunnel
# 1  
Old 01-15-2012
Error IPsec tunnel problem
I having problem connecting to a Cisco PIX

Log from IKE

Code:
# /usr/lib/inet/in.iked -f /etc/inet/ike/config -d
Jan 16 00:40:57: 2012 (+0800) *** in.iked started ***
Jan 16 00:40:57: Loading configuration...
Jan 16 00:40:57: Checking lifetimes in "nullrule"
Jan 16 00:40:57: Using default value for p2 lifetime: 28800 seconds.
Jan 16 00:40:57: p2 softlife too small.
Jan 16 00:40:57: Using default value for p2 soft lifetime: 25920 seconds.
Jan 16 00:40:57: Using default value for p2 idle lifetime: 14400 seconds.
Jan 16 00:40:57: Using default value for p2 byte lifetime: 134217728 kb
Jan 16 00:40:57: Using default value for p2 soft byte lifetime: 120795955 kb
Jan 16 00:40:57: Checking lifetimes in "myvpn"
Jan 16 00:40:57: Adding rule "myvpn" to IKE configuration;
Jan 16 00:40:57:   mode 256 (any), cookie 6, slot 0; total rules 1
Jan 16 00:40:57: Configuration update succeeded! Updating active databases.
Jan 16 00:40:57: Configuration ok.
Jan 16 00:40:57: Loading preshared keys...
Jan 16 00:40:57: Unique instance of in.iked started.
Jan 16 00:40:57: Adding certificates...
Jan 16 00:40:57: 0 certificates successfully added
Jan 16 00:40:57: Adding private keys...
Jan 16 00:40:57: 0 private keys successfully added.
Jan 16 00:40:57: Skipping lo0 address 127.0.0.1
Jan 16 00:40:57: Adding bnx0 address xxx.xxx.44.239 to in.iked service list...
Jan 16 00:40:57:   Adding entry #1; IP address = xxx.xxx.44.239, interface = bnx0.
Jan 16 00:40:57:   Now 1 addresses being serviced.
Jan 16 00:40:57: Adding bnx0:1 address xxx.xxx.44.245 to in.iked service list...
Jan 16 00:40:57:   Adding entry #2; IP address = xxx.xxx.44.245, interface = bnx0:1.
Jan 16 00:40:57:   Now 2 addresses being serviced.
Jan 16 00:40:57: Adding bnx0:2 address 10.1.1.239 to in.iked service list...
Jan 16 00:40:57:   Adding entry #3; IP address = 10.1.1.239, interface = bnx0:2.
Jan 16 00:40:57:   Now 3 addresses being serviced.
Jan 16 00:40:57: Adding ip.tun0 address xxx.xxx.44.245 to in.iked service list...
Jan 16 00:40:57:   Address already exists: now 2 users
Jan 16 00:40:57: Initializing PF_KEY socket...
Jan 16 00:40:57: ESP initial REGISTER with SADB...
Jan 16 00:40:57: Handling SADB register message from kernel...
Jan 16 00:40:57: AH initial REGISTER with SADB...
Jan 16 00:40:57: Handling SADB register message from kernel...


Jan 16 00:41:16: Handling data on PF_KEY socket:
                                         SADB msg: message type 6 (ACQUIRE), SA type 0 (UNSPEC),
                                         pid 0, sequence number 4294963042,
                                         error code 0 (Error 0), diag code 0 (No diagnostic), length 25
Jan 16 00:41:16: Inner addresses present,
Jan 16 00:41:16: Doing ACQUIRE....
Jan 16 00:41:16: Trying to get Phase 1 (by itself)...
Jan 16 00:41:16: Looking for an existing Phase 1 SA...
Jan 16 00:41:16:   Searching rulebase for src = xxx.xxx.44.239[0]
Jan 16 00:41:16:                          dst = xxx.xxx.11.24[0]
Jan 16 00:41:16:   Examining rule list.
Jan 16 00:41:16:   rule 'myvpn' 0x6;
Jan 16 00:41:16:                          local addr xxx.xxx.44.239[2824];
Jan 16 00:41:16:                          remote addr xxx.xxx.11.24[2824]
Jan 16 00:41:16:    [basic match]
Jan 16 00:41:16:   Selected rule: 'myvpn'

Jan 16 00:41:16: Updating p2_lifetime to 28800 seconds.
Jan 16 00:41:16: Checking lifetimes in "myvpn"
Jan 16 00:41:16: Starting Phase 1 negotiation...
Jan 16 00:41:16: Constructing local identity payload...
Jan 16 00:41:16:   Local ID type: ipv4(any:0,[0..3]=xxx.xxx.44.239)
Jan 16 00:41:16: Constructing Phase 1 Transforms:
        Our Proposal:
        Rule: "myvpn" ; transform 0
        auth_method = 1 (Pre-shared)
        hash_alg = 1 (md5)
        encr_alg = 5 (3des-cbc)
        oakley_group = 2
Jan 16 00:41:16: Phase 1 exchange type=2 (IP), 1 transform(s).
Jan 16 00:41:16: Looking for xxx.xxx.44.239[0] in IKE daemon context...
Jan 16 00:41:16: Sending out Vendor IDs, if needed: NAT-T state 0 (INIT)
Jan 16 00:41:16:   New Phase 1 negotiation!
Jan 16 00:41:16:   Waiting for IKE results.
Jan 16 00:41:16: IKE library: Using default remote port for NAT-T, if active.
Jan 16 00:41:16: Determining P1 nonce data length.
Jan 16 00:41:16:   NAT-T state 0 (INIT)
Jan 16 00:41:17: IKE library: Using default remote port for NAT-T, if active.
Jan 16 00:41:17: IKE library: Doing port jump in case we need NAT-T. Current NAT-T state -1
Jan 16 00:41:17: Vendor ID from peer:
Jan 16 00:41:17:   0x09002689dfd6b712
Jan 16 00:41:17:   XAUTH
Jan 16 00:41:17: Vendor ID from peer:
Jan 16 00:41:17:   0xafcad71368a1f1c96b8696fc77570100
Jan 16 00:41:17:   Detecting Dead IKE Peers (RFC 3706)
Jan 16 00:41:17:   Using Dead Peer Detection (RFC 3706)
Jan 16 00:41:17: Vendor ID from peer:
Jan 16 00:41:17:   0x12f5f28c457168a9702d9fe274cc0100
Jan 16 00:41:17:   Cisco-Unity
Jan 16 00:41:17: Vendor ID from peer:
Jan 16 00:41:17:   0x1bbeeea30f37d3ccd73e1cd102c84809
Jan 16 00:41:17:   Could not find VID description
Jan 16 00:41:17: Finding preshared key...
Jan 16 00:41:17: IKE library: Using default remote port for NAT-T, if active.
Jan 16 00:41:17: Finishing P1 negotiation: NAT-T state -1 (NEVER)
Jan 16 00:41:17: Looking for xxx.xxx.44.239[0] in IKE daemon context...
Jan 16 00:41:17: Phase 1 negotiation done.
Jan 16 00:41:17: Getting ready for phase 2 (quick mode).
Jan 16 00:41:17:   Tunnel mode [ACQUIRE]
Jan 16 00:41:17: PF_KEY message contents:
Timestamp: Mon Jan 16 00:41:17 2012
Base message (version 2) type ACQUIRE, SA type <unspecified/all>.
Message length 200 bytes, seq=4294963042, pid=0.
INS: Inner source address (proto=0)
INS: AF_INET: port 0, 0.0.0.0.
IND: Inner destination address (proto=0)
IND: AF_INET: port 0, 0.0.0.0.
SRC: Source address (proto=4)
SRC: AF_INET: port 0, xxx.xxx.44.239.
DST: Destination address (proto=4)
DST: AF_INET: port 0, xxx.xxx.11.24.
EPR: Extended Proposal, replay counter = 32, number of combinations = 1.
EPR:  Extended combination #1:
EPR:  HARD: alloc=0, bytes=0, post-add secs=28800, post-use secs=0
EPR:  SOFT: alloc=0, bytes=0, post-add secs=24000, post-use secs=0
EPR:  Alg #1 for AH Authentication = hmac-md5  minbits=128, maxbits=128.
EPR:  Alg #2 for ESP Encryption = 3des-cbc  minbits=192, maxbits=192.
Jan 16 00:41:17: Allocating SPI for Phase 2.
Jan 16 00:41:17: SADB GETSPI type == "ah"
Jan 16 00:41:17:   local xxx.xxx.44.239[0]
Jan 16 00:41:17:   remote xxx.xxx.11.24[0]
Jan 16 00:41:17: PF_KEY request:
                                         queueing sequence number 5, message type 1 (GETSPI),
                                         SA type 2 (AH)
Jan 16 00:41:17: PF_KEY transmit request:
                                         posting sequence number 5, message type 1 (GETSPI),
                                         SA type 2 (AH)
Jan 16 00:41:17: Handling data on PF_KEY socket:
                                         SADB msg: message type 1 (GETSPI), SA type 2 (AH),
                                         pid 2978, sequence number 5,
                                         error code 0 (Error 0), diag code 0 (No diagnostic), length 10
Jan 16 00:41:17: SADB message reply handler:
                                         got sequence number 5, message type 1 (GETSPI),
                                         SA type 2 (AH)
Jan 16 00:41:17: Allocating SPI for Phase 2.
Jan 16 00:41:17: SADB GETSPI type == "esp"
Jan 16 00:41:17:   local xxx.xxx.44.239[0]
Jan 16 00:41:17:   remote xxx.xxx.11.24[0]
Jan 16 00:41:17: PF_KEY request:
                                         queueing sequence number 6, message type 1 (GETSPI),
                                         SA type 3 (ESP)
Jan 16 00:41:17: PF_KEY transmit request:
                                         posting sequence number 6, message type 1 (GETSPI),
                                         SA type 3 (ESP)
Jan 16 00:41:17: Handling data on PF_KEY socket:
                                         SADB msg: message type 1 (GETSPI), SA type 3 (ESP),
                                         pid 2978, sequence number 6,
                                         error code 0 (Error 0), diag code 0 (No diagnostic), length 10
Jan 16 00:41:17: SADB message reply handler:
                                         got sequence number 6, message type 1 (GETSPI),
                                         SA type 3 (ESP)
Jan 16 00:41:17: Allocating SPI for Phase 2.
Jan 16 00:41:17: Looking for xxx.xxx.44.239[0] in IKE daemon context...
Jan 16 00:41:17: Starting Phase 2 negotiation...
Jan 16 00:41:17: Setting QM nonce data length to 32 bytes.
Jan 16 00:41:17: IKE library: Using default remote port for NAT-T, if active.
Jan 16 00:41:17: IKE error: type 10 (Invalid protocol ID), decrypted 1, received 1
Jan 16 00:41:17: Policy Manager phase 1 info not found! (message type 10 (Invalid protocol ID))
Jan 16 00:41:17: Notifying library that P2 SA is freed.
Jan 16 00:41:17:   Local IP = xxx.xxx.44.239, Remote IP = xxx.xxx.11.24,

Last edited by conandor; 01-15-2012 at 02:17 PM.. Reason: update log
Login or Register to Ask a Question

Previous Thread | Next Thread

5 More Discussions You Might Find Interesting

1. IP Networking

Does cisco 1921 router support site to site VPNs using IPSec?

Q: "Does Cisco 1921 router support,, act as an endpoint for, site to site VPNs using IPSec? If so, how many? " A: If you get the Cisco 1921/k9 with the security services bundle then it will have built in security features. Cisco, typically includes IP Sec tunnels I believe as part of that... (0 Replies)
Discussion started by: Ayaerlee
0 Replies

2. Solaris

Clients for Solaris IPSEC tunnel

Hi all, I'm running solaris x86_64 as a home server and am quite happy with it. Currently I'm working with Solaris 10 and 11 express. Typically I tunnel traffic to it via ssh with port forwards, but I'm interested in using the built in IPSEC features that Solaris has. I've setup a solaris... (1 Reply)
Discussion started by: vectox
1 Replies

3. Shell Programming and Scripting

continue after connecting to cisco vpn

Hi all, This will save me a tremendous amount of time if i can get this script working. I have alot of sites i need to connect to using cisco vpn and then ssh onto servers to retrieve some info. Its all repetitative and it needs scripted. what i have done so far is put this into a script. ... (0 Replies)
Discussion started by: borderblaster
0 Replies

4. Solaris

Solaris 10 IPSec peformance

Hi, does anyone have an experience how many IPSec tunnels Solaris 10 is able manage. A rough estimation would be great. I know it's hardly dependent on the hardware used, so if anyone says on a 490 with 2 CPUs and 4GB RAM a maximum of 1000 IPSec tunnels is possible, that would be great. I... (1 Reply)
Discussion started by: blombo
1 Replies

5. UNIX for Dummies Questions & Answers

Connecting to cisco devices via console

I use configure cisco devices daily using hyper terminal in windows via the serial port. Is there an alternative solution in unix that I can connect to a cisco console port via serial port? What application do I need?? (1 Reply)
Discussion started by: dgroove3
1 Replies
Login or Register to Ask a Question