Freeswan + Client Windows XP

par **mekano** » 14 Nov 2003 19:15

Bon voici mon problème. J'ai un serveur Linux sur lequel j'ai installer freeswan et un poste client qui tourne sous windows qui se connecte depuis l'extérieur du réseau sur ma passerelle Linux. J'utilise les certificats pour l'authentification. Du côté linux, le démarrage de Ipsec ne semble pas poser de problème. VOici la config du côté serveur: #### IPSEC.CONF ### # basic configuration config setup interfaces=%defaultroute klipsdebug=all plutodebug=all plutoload=%search plutostart=%search uniqueids=yes conn %default keyingtries=0 compress=yes disablearrivalcheck=no authby=rsasig leftrsasigkey=%cert rightrsasigkey=%cert conn distante right=%any #rightnexthop=192.168.0.2 left=%defaultroute leftsubnet=192.168.0.0/24 leftcert=router.pem auto=add pfs=yes #### IPSEC.SECRETS ### : RSA router.key "ab234s" ####Configuration du client roadwarrior### Fichier IPSEC.CONF conn distante left=%any right=64.228.217.20 ---> adresse publique de ma passerelle (ppp0) rightca="C=CA, ST=Quebec, L=Sherbrooke, O=DmInnovatech CN=innovatek Email=dany.fortier@sympatico.ca network=auto auto=start pfs=yes J'ai créer et installer les certificats autant du cöté serveur que du coté client. Ce qui ne m'a pas afficher d'erreurs . Mon autorité de certification est bien installée dans le dossier d'autorité de certification racine de confiance de ma machine windows et le certificat pour le poste client est lui aussi présent sur windows. Sur le poste client j'établit la connexion en entrant la commande ipsec. tout se déroule normalement. J'ai regarder le fichier c:/windows/debug/oakley.txt et voici le contenu : 11-14: 11:28:28:62:780 constructing ISAKMP Header 11-14: 11:28:28:62:780 constructing HASH (null) 11-14: 11:28:28:62:780 constructing DELETE. MM 0011A2A8 11-14: 11:28:28:62:780 constructing HASH (Notify/Delete) 11-14: 11:28:28:62:780 11-14: 11:28:28:62:780 Sending: SA = 0x0011A2A8 to 64.228.217.20:Type 1 11-14: 11:28:28:62:780 ISAKMP Header: (V1.0), len = 84 11-14: 11:28:28:62:780 I-COOKIE 5a1f2737aff8cdbb 11-14: 11:28:28:62:780 R-COOKIE 4aec10fafc254c4b 11-14: 11:28:28:62:780 exchange: ISAKMP Informational Exchange 11-14: 11:28:28:62:780 flags: 1 ( encrypted ) 11-14: 11:28:28:62:780 next payload: HASH 11-14: 11:28:28:62:780 message ID: 6a6594ba 11-14: 11:33:48:312:468 isadb_schedule_kill_oldPolicy_sas: 082732c5-306a-465c-9d56ab0a6138caf9 4 11-14: 11:33:48:312:468 isadb_schedule_kill_oldPolicy_sas: 017bd960-b990-4a48-a518ea3987f8b2c5 4 11-14: 11:33:48:312:468 isadb_schedule_kill_oldPolicy_sas: 3bc37bfd-55e7-4d4b-b5b2d4ba44f4def2 3 11-14: 11:33:48:312:468 isadb_schedule_kill_oldPolicy_sas: c4a8adc2-5a2c-4e93-8af97c7daf8bcbd8 3 11-14: 11:33:48:312:468 isadb_schedule_kill_oldPolicy_sas: c6fa88d3-1bc3-4a35-9c6ac054da1a3282 1 11-14: 11:33:48:312:468 isadb_schedule_kill_oldPolicy_sas: b71ea390-10f1-4fb5-aa1f8003dbdc17fa 2 11-14: 11:33:48:312:468 isadb_schedule_kill_oldPolicy_sas: 2add04e8-798a-4b94-bc0c090dd2dc2bf7 2 11-14: 11:33:48:312:128 entered kill_old_policy_sas 11-14: 11:33:48:312:128 entered kill_old_policy_sas 11-14: 11:33:48:312:128 entered kill_old_policy_sas 11-14: 11:33:48:312:128 entered kill_old_policy_sas 11-14: 11:33:48:312:780 entered kill_old_policy_sas 11-14: 11:33:48:312:128 entered kill_old_policy_sas 11-14: 11:33:48:312:780 entered kill_old_policy_sas 11-14: 11:34:09:984:4c4 Acquire from driver: op=82247598 src=206.172.253.48.0 dst=64.228.217.20.0 proto = 0, SrcMask=255.255.255.255, DstMask=255.255.255.255, Tunnel 1, TunnelEndpt=64.228.217.20 Inbound TunnelEndpt=206.172.253.48 11-14: 11:34:09:984:780 Filter to match: Src 64.228.217.20 Dst 206.172.253.48 11-14: 11:34:09:984:780 MM PolicyName: 16 11-14: 11:34:09:984:780 MMPolicy dwFlags 2 SoftSAExpireTime 28800 11-14: 11:34:09:984:780 MMOffer[0] LifetimeSec 28800 QMLimit 1 DHGroup 2 11-14: 11:34:09:984:780 MMOffer[0] Encrypt: Triple DES CBC Hash: SHA 11-14: 11:34:09:984:780 MMOffer[1] LifetimeSec 28800 QMLimit 1 DHGroup 2 11-14: 11:34:09:984:780 MMOffer[1] Encrypt: Triple DES CBC Hash: MD5 11-14: 11:34:09:984:780 MMOffer[2] LifetimeSec 28800 QMLimit 1 DHGroup 1 11-14: 11:34:09:984:780 MMOffer[2] Encrypt: DES CBC Hash: SHA 11-14: 11:34:09:984:780 MMOffer[3] LifetimeSec 28800 QMLimit 1 DHGroup 1 11-14: 11:34:09:984:780 MMOffer[3] Encrypt: DES CBC Hash: MD5 11-14: 11:34:09:984:780 Auth[0]:RSA Sig C=CA, S=Quebec, L=Sherbrooke, O="DmInnovatech CN=innovatek Email=dany.fortier@sympatico.ca" 11-14: 11:34:09:984:780 QM PolicyName: Host-distante filter action dwFlags 1 11-14: 11:34:09:984:780 QMOffer[0] LifetimeKBytes 50000 LifetimeSec 3600 11-14: 11:34:09:984:780 QMOffer[0] dwFlags 0 dwPFSGroup 268435456 11-14: 11:34:09:984:780 Algo[0] Operation: ESP Algo: Triple DES CBC HMAC: MD5 11-14: 11:34:09:984:780 Starting Negotiation: src = 206.172.253.48.0000, dst = 64.228.217.20.0500, proto = 00, context = 82247598, ProxySrc = 206.172.253.48.0000, ProxyDst = 64.228.217.20.0000 SrcMask = 255.255.255.255 DstMask = 255.255.255.255 11-14: 11:34:09:984:780 constructing ISAKMP Header 11-14: 11:34:09:984:780 constructing SA (ISAKMP) 11-14: 11:34:09:984:780 Constructing Vendor 11-14: 11:34:09:984:780 11-14: 11:34:09:984:780 Sending: SA = 0x0011A2A8 to 64.228.217.20:Type 2 11-14: 11:34:09:984:780 ISAKMP Header: (V1.0), len = 216 11-14: 11:34:09:984:780 I-COOKIE 765d63a5e4795cbe 11-14: 11:34:09:984:780 R-COOKIE 0000000000000000 11-14: 11:34:09:984:780 exchange: Oakley Main Mode 11-14: 11:34:09:984:780 flags: 0 11-14: 11:34:09:984:780 next payload: SA 11-14: 11:34:09:984:780 message ID: 00000000 11-14: 11:34:10:281:780 11-14: 11:34:10:281:780 Receive: (get) SA = 0x0011a2a8 from 64.228.217.20 11-14: 11:34:10:281:780 ISAKMP Header: (V1.0), len = 84 11-14: 11:34:10:281:780 I-COOKIE 765d63a5e4795cbe 11-14: 11:34:10:281:780 R-COOKIE 57235ac0f2a59e4f 11-14: 11:34:10:281:780 exchange: Oakley Main Mode 11-14: 11:34:10:281:780 flags: 0 11-14: 11:34:10:281:780 next payload: SA 11-14: 11:34:10:281:780 message ID: 00000000 11-14: 11:34:10:281:780 processing payload SA 11-14: 11:34:10:281:780 Received Phase 1 Transform 1 11-14: 11:34:10:281:780 Encryption Alg Triple DES CBC(5) 11-14: 11:34:10:281:780 Hash Alg SHA(2) 11-14: 11:34:10:281:780 Oakley Group 2 11-14: 11:34:10:281:780 Auth Method Signature RSA avec les certificats(3) 11-14: 11:34:10:281:780 Life type in Seconds 11-14: 11:34:10:281:780 Life duration of 28800 11-14: 11:34:10:281:780 Phase 1 SA accepted: transform=1 11-14: 11:34:10:281:780 SA - Oakley proposal accepted 11-14: 11:34:10:281:780 constructing ISAKMP Header 11-14: 11:34:10:312:780 constructing KE 11-14: 11:34:10:312:780 constructing NONCE (ISAKMP) 11-14: 11:34:10:312:780 11-14: 11:34:10:312:780 Sending: SA = 0x0011A2A8 to 64.228.217.20:Type 2 11-14: 11:34:10:312:780 ISAKMP Header: (V1.0), len = 184 11-14: 11:34:10:312:780 I-COOKIE 765d63a5e4795cbe 11-14: 11:34:10:312:780 R-COOKIE 57235ac0f2a59e4f 11-14: 11:34:10:312:780 exchange: Oakley Main Mode 11-14: 11:34:10:312:780 flags: 0 11-14: 11:34:10:312:780 next payload: KE 11-14: 11:34:10:312:780 message ID: 00000000 11-14: 11:34:10:734:780 11-14: 11:34:10:734:780 Receive: (get) SA = 0x0011a2a8 from 64.228.217.20 11-14: 11:34:10:734:780 ISAKMP Header: (V1.0), len = 188 11-14: 11:34:10:734:780 I-COOKIE 765d63a5e4795cbe 11-14: 11:34:10:734:780 R-COOKIE 57235ac0f2a59e4f 11-14: 11:34:10:734:780 exchange: Oakley Main Mode 11-14: 11:34:10:734:780 flags: 0 11-14: 11:34:10:734:780 next payload: KE 11-14: 11:34:10:734:780 message ID: 00000000 11-14: 11:34:10:734:780 processing payload KE 11-14: 11:34:10:750:780 processing payload NONCE 11-14: 11:34:10:750:780 processing payload CRP 11-14: 11:34:10:750:780 constructing ISAKMP Header 11-14: 11:34:10:750:780 constructing ID 11-14: 11:34:10:750:780 Received no valid CRPs. Using all configured 11-14: 11:34:10:750:780 Looking for IPSec only cert 11-14: 11:34:10:750:780 failed to get chain 80092004 11-14: 11:34:10:750:780 Received no valid CRPs. Using all configured 11-14: 11:34:10:750:780 Looking for any cert 11-14: 11:34:10:750:780 failed to get chain 80092004 11-14: 11:34:10:750:780 ProcessFailure: sa:0011A2A8 centry:00000000 status:35ee 11-14: 11:34:10:750:780 isadb_set_status sa:0011A2A8 centry:00000000 status 35ee 11-14: 11:34:10:750:780 Mode d'échange de clés (Mode principal) 11-14: 11:34:10:750:780 Adresse IP source206.172.253.48 Masque d'adresse IP source 255.255.255.255 Adresse IP de destination 64.228.217.20 Masque d'adresse IP de destination 255.255.255.255 Protocole 0 Port source 0 Port de destination 0 Adresse locale IKE Adresse homologue IKE 11-14: 11:34:10:750:780 Identité basé sur le certificat. Adresse IP homologue : 64.228.217.20 11-14: 11:34:10:750:780 Moi 11-14: 11:34:10:750:780 IKE n'a pas trouvé de certificat ordinateur valide 11-14: 11:34:10:750:780 0x80092004 0x0 11-14: 11:34:10:750:780 ProcessFailure: sa:0011A2A8 centry:00000000 status:35ee 11-14: 11:34:10:750:780 constructing ISAKMP Header 11-14: 11:34:10:750:780 constructing HASH (null) 11-14: 11:34:10:750:780 constructing NOTIFY 28 11-14: 11:34:10:750:780 constructing HASH (Notify/Delete) 11-14: 11:34:10:750:780 11-14: 11:34:10:750:780 Sending: SA = 0x0011A2A8 to 64.228.217.20:Type 1 11-14: 11:34:10:750:780 ISAKMP Header: (V1.0), len = 84 11-14: 11:34:10:750:780 I-COOKIE 765d63a5e4795cbe 11-14: 11:34:10:750:780 R-COOKIE 57235ac0f2a59e4f 11-14: 11:34:10:750:780 exchange: ISAKMP Informational Exchange 11-14: 11:34:10:750:780 flags: 1 ( encrypted ) 11-14: 11:34:10:750:780 next payload: HASH 11-14: 11:34:10:750:780 message ID: 95746d5d 11-14: 11:34:20:984:780 11-14: 11:34:20:984:780 Receive: (get) SA = 0x0011a2a8 from 64.228.217.20 11-14: 11:34:20:984:780 ISAKMP Header: (V1.0), len = 188 11-14: 11:34:20:984:780 I-COOKIE 765d63a5e4795cbe 11-14: 11:34:20:984:780 R-COOKIE 57235ac0f2a59e4f 11-14: 11:34:20:984:780 exchange: Oakley Main Mode 11-14: 11:34:20:984:780 flags: 0 11-14: 11:34:20:984:780 next payload: KE 11-14: 11:34:20:984:780 message ID: 00000000 11-14: 11:34:20:984:780 received an unencrypted packet when crypto active 11-14: 11:34:20:984:780 GetPacket failed 35ec 11-14: 11:34:40:984:780 11-14: 11:34:40:984:780 Receive: (get) SA = 0x0011a2a8 from 64.228.217.20 11-14: 11:34:40:984:780 ISAKMP Header: (V1.0), len = 188 11-14: 11:34:40:984:780 I-COOKIE 765d63a5e4795cbe 11-14: 11:34:40:984:780 R-COOKIE 57235ac0f2a59e4f 11-14: 11:34:40:984:780 exchange: Oakley Main Mode 11-14: 11:34:40:984:780 flags: 0 11-14: 11:34:40:984:780 next payload: KE 11-14: 11:34:40:984:780 message ID: 00000000 11-14: 11:34:40:984:780 received an unencrypted packet when crypto active 11-14: 11:34:40:984:780 GetPacket failed 35ec 11-14: 11:35:58:62:780 SA Dead. sa:0011A2A8 status:35f0 11-14: 11:35:58:62:780 constructing ISAKMP Header 11-14: 11:35:58:62:780 constructing HASH (null) 11-14: 11:35:58:62:780 constructing DELETE. MM 0011A2A8 11-14: 11:35:58:62:780 constructing HASH (Notify/Delete) 11-14: 11:35:58:62:780 11-14: 11:35:58:62:780 Sending: SA = 0x0011A2A8 to 64.228.217.20:Type 1 11-14: 11:35:58:62:780 ISAKMP Header: (V1.0), len = 84 11-14: 11:35:58:62:780 I-COOKIE 765d63a5e4795cbe 11-14: 11:35:58:62:780 R-COOKIE 57235ac0f2a59e4f 11-14: 11:35:58:62:780 exchange: ISAKMP Informational Exchange 11-14: 11:35:58:62:780 flags: 1 ( encrypted ) 11-14: 11:35:58:62:780 next payload: HASH 11-14: 11:35:58:62:780 message ID: a9ed2acc On voit bien que les 2 postes communiquent entrent eux. Ce que je ne comprends pas c'est cette ligne la : 11-14: 11:34:10:750:780 IKE n'a pas trouvé de certificat ordinateur valide. Ca doit etre a cause de ca que ca ne fonctionne pas ..mais comment régler ce proibleme ?? Quelqu'un a une idée ???

par **mekano** » 14 Nov 2003 23:22

J'ai regénérer et réinstaller mon certificat sur ma machine windows et je n'ai maintenant plus l'erreur comme quoi il ne trouve pas de certificat valide. Je démarre la connection sur la machine windows et je lance des ping vers une machine qui est situé sur le réseau distant --> aucune réponse. Je lance alors un ping vers l'adresse publique de ma machie qui a freeswan d'installer et j'ai des messages disant négociating ip security. Je l'ai laisser aller comme ca un bon bout, mais rien ne se passe ensuite. VOici maintenantce quoi a l'air mon fichier de log sur windows oakley.txt. 1-14: 16:09:12:703:8cc Receive: (get) SA = 0x000be890 from 64.228.217.20 11-14: 16:09:12:703:8cc ISAKMP Header: (V1.0), len = 84 11-14: 16:09:12:703:8cc I-COOKIE 97bf71c8a0064960 11-14: 16:09:12:703:8cc R-COOKIE 71486174e301bd6b 11-14: 16:09:12:703:8cc exchange: ISAKMP Informational Exchange 11-14: 16:09:12:703:8cc flags: 1 ( encrypted ) 11-14: 16:09:12:703:8cc next payload: HASH 11-14: 16:09:12:703:8cc message ID: 1993ff4f 11-14: 16:09:12:703:8cc processing HASH (Notify/Delete) 11-14: 16:09:12:703:8cc processing payload DELETE 11-14: 16:09:12:718:8cc 11-14: 16:09:12:718:8cc Receive: (get) SA = 0x0011a2a8 from 64.228.217.20 11-14: 16:09:12:718:8cc ISAKMP Header: (V1.0), len = 84 11-14: 16:09:12:718:8cc I-COOKIE 21610e67cf569fb9 11-14: 16:09:12:718:8cc R-COOKIE 7a89a5182bc99124 11-14: 16:09:12:718:8cc exchange: ISAKMP Informational Exchange 11-14: 16:09:12:718:8cc flags: 1 ( encrypted ) 11-14: 16:09:12:718:8cc next payload: HASH 11-14: 16:09:12:718:8cc message ID: f2e304e8 11-14: 16:09:12:718:8cc processing HASH (Notify/Delete) 11-14: 16:09:12:718:8cc processing payload DELETE 11-14: 16:10:53:640:4c4 Acquire from driver: op=81DB56D8 src=216.209.130.95.0 dst=64.228.217.20.0 proto = 0, SrcMask=255.255.255.255, DstMask=255.255.255.255, Tunnel 1, TunnelEndpt=64.228.217.20 Inbound TunnelEndpt=216.209.130.95 11-14: 16:10:53:640:780 Filter to match: Src 64.228.217.20 Dst 216.209.130.95 11-14: 16:10:53:640:780 MM PolicyName: 19 11-14: 16:10:53:640:780 MMPolicy dwFlags 2 SoftSAExpireTime 28800 11-14: 16:10:53:640:780 MMOffer[0] LifetimeSec 28800 QMLimit 1 DHGroup 2 11-14: 16:10:53:640:780 MMOffer[0] Encrypt: Triple DES CBC Hash: SHA 11-14: 16:10:53:640:780 MMOffer[1] LifetimeSec 28800 QMLimit 1 DHGroup 2 11-14: 16:10:53:640:780 MMOffer[1] Encrypt: Triple DES CBC Hash: MD5 11-14: 16:10:53:640:780 MMOffer[2] LifetimeSec 28800 QMLimit 1 DHGroup 1 11-14: 16:10:53:640:780 MMOffer[2] Encrypt: DES CBC Hash: SHA 11-14: 16:10:53:640:780 MMOffer[3] LifetimeSec 28800 QMLimit 1 DHGroup 1 11-14: 16:10:53:640:780 MMOffer[3] Encrypt: DES CBC Hash: MD5 11-14: 16:10:53:640:780 Auth[0]:RSA Sig C=CA, S=Quebec, L=Sherbrooke, O=DmInnovatech, CN=Router, E=dany.fortier@sympatico.ca 11-14: 16:10:53:640:780 QM PolicyName: Host-distante filter action dwFlags 1 11-14: 16:10:53:640:780 QMOffer[0] LifetimeKBytes 50000 LifetimeSec 3600 11-14: 16:10:53:640:780 QMOffer[0] dwFlags 0 dwPFSGroup 268435456 11-14: 16:10:53:640:780 Algo[0] Operation: ESP Algo: Triple DES CBC HMAC: MD5 11-14: 16:10:53:640:780 Starting Negotiation: src = 216.209.130.95.0000, dst = 64.228.217.20.0500, proto = 00, context = 81DB56D8, ProxySrc = 216.209.130.95.0000, ProxyDst = 64.228.217.20.0000 SrcMask = 255.255.255.255 DstMask = 255.255.255.255 11-14: 16:10:53:640:780 constructing ISAKMP Header 11-14: 16:10:53:640:780 constructing SA (ISAKMP) 11-14: 16:10:53:640:780 Constructing Vendor 11-14: 16:10:53:640:780 11-14: 16:10:53:640:780 Sending: SA = 0x0011A2A8 to 64.228.217.20:Type 2 11-14: 16:10:53:640:780 ISAKMP Header: (V1.0), len = 216 11-14: 16:10:53:640:780 I-COOKIE a0abc08261101e9f 11-14: 16:10:53:640:780 R-COOKIE 0000000000000000 11-14: 16:10:53:640:780 exchange: Oakley Main Mode 11-14: 16:10:53:640:780 flags: 0 11-14: 16:10:53:640:780 next payload: SA 11-14: 16:10:53:640:780 message ID: 00000000 11-14: 16:10:53:875:780 11-14: 16:10:53:875:780 Receive: (get) SA = 0x0011a2a8 from 64.228.217.20 11-14: 16:10:53:875:780 ISAKMP Header: (V1.0), len = 84 11-14: 16:10:53:875:780 I-COOKIE a0abc08261101e9f 11-14: 16:10:53:875:780 R-COOKIE 57c59456b9cb9075 11-14: 16:10:53:875:780 exchange: Oakley Main Mode 11-14: 16:10:53:875:780 flags: 0 11-14: 16:10:53:875:780 next payload: SA 11-14: 16:10:53:875:780 message ID: 00000000 11-14: 16:10:53:875:780 processing payload SA 11-14: 16:10:53:875:780 Received Phase 1 Transform 1 11-14: 16:10:53:875:780 Encryption Alg Triple DES CBC(5) 11-14: 16:10:53:875:780 Hash Alg SHA(2) 11-14: 16:10:53:875:780 Oakley Group 2 11-14: 16:10:53:875:780 Auth Method Signature RSA avec les certificats(3) 11-14: 16:10:53:875:780 Life type in Seconds 11-14: 16:10:53:875:780 Life duration of 28800 11-14: 16:10:53:875:780 Phase 1 SA accepted: transform=1 11-14: 16:10:53:875:780 SA - Oakley proposal accepted 11-14: 16:10:53:875:780 constructing ISAKMP Header 11-14: 16:10:53:906:780 constructing KE 11-14: 16:10:53:906:780 constructing NONCE (ISAKMP) 11-14: 16:10:53:906:780 11-14: 16:10:53:906:780 Sending: SA = 0x0011A2A8 to 64.228.217.20:Type 2 11-14: 16:10:53:906:780 ISAKMP Header: (V1.0), len = 184 11-14: 16:10:53:906:780 I-COOKIE a0abc08261101e9f 11-14: 16:10:53:906:780 R-COOKIE 57c59456b9cb9075 11-14: 16:10:53:906:780 exchange: Oakley Main Mode 11-14: 16:10:53:906:780 flags: 0 11-14: 16:10:53:906:780 next payload: KE 11-14: 16:10:53:906:780 message ID: 00000000 11-14: 16:10:54:328:780 11-14: 16:10:54:328:780 Receive: (get) SA = 0x0011a2a8 from 64.228.217.20 11-14: 16:10:54:328:780 ISAKMP Header: (V1.0), len = 188 11-14: 16:10:54:328:780 I-COOKIE a0abc08261101e9f 11-14: 16:10:54:328:780 R-COOKIE 57c59456b9cb9075 11-14: 16:10:54:328:780 exchange: Oakley Main Mode 11-14: 16:10:54:328:780 flags: 0 11-14: 16:10:54:328:780 next payload: KE 11-14: 16:10:54:328:780 message ID: 00000000 11-14: 16:10:54:328:780 processing payload KE 11-14: 16:10:54:343:780 processing payload NONCE 11-14: 16:10:54:343:780 processing payload CRP 11-14: 16:10:54:343:780 constructing ISAKMP Header 11-14: 16:10:54:343:780 constructing ID 11-14: 16:10:54:343:780 Received no valid CRPs. Using all configured 11-14: 16:10:54:343:780 Looking for IPSec only cert 11-14: 16:10:54:343:780 Cert Trustes. 0 100 11-14: 16:10:54:343:780 CertFindExtenstion failed with 0 11-14: 16:10:54:343:780 Entered CRL check 11-14: 16:10:54:343:780 Left CRL check 11-14: 16:10:54:343:780 Cert SHA Thumbprint f6ce2f9befaa58161378791be9093681 11-14: 16:10:54:343:780 f94e4c6e 11-14: 16:10:54:343:780 SubjectName: C=CA, S=Quebec, L=Sherbrooke, O=DmInnovatech, CN=Dany, E=dany.fortier@sympatico.ca 11-14: 16:10:54:343:780 Cert Serialnumber 02 11-14: 16:10:54:343:780 Cert SHA Thumbprint f6ce2f9befaa58161378791be9093681 11-14: 16:10:54:343:780 f94e4c6e 11-14: 16:10:54:343:780 SubjectName: C=CA, S=Quebec, L=Sherbrooke, O=DmInnovatech, CN=Router, E=dany.fortier@sympatico.ca 11-14: 16:10:54:343:780 Cert Serialnumber 00 11-14: 16:10:54:343:780 Cert SHA Thumbprint 58c0aa1d44a0a76ccf6a57507d3c008c 11-14: 16:10:54:343:780 1d55b0c6 11-14: 16:10:54:343:780 constructing CERT 11-14: 16:10:54:343:780 Construct SIG 11-14: 16:10:54:375:780 Constructing Cert Request 11-14: 16:10:54:375:780 C=CA, S=Quebec, L=Sherbrooke, O=DmInnovatech, CN=Router, E=dany.fortier@sympatico.ca 11-14: 16:10:54:375:780 11-14: 16:10:54:375:780 Sending: SA = 0x0011A2A8 to 64.228.217.20:Type 2 11-14: 16:10:54:375:780 ISAKMP Header: (V1.0), len = 1756 11-14: 16:10:54:375:780 I-COOKIE a0abc08261101e9f 11-14: 16:10:54:375:780 R-COOKIE 57c59456b9cb9075 11-14: 16:10:54:375:780 exchange: Oakley Main Mode 11-14: 16:10:54:375:780 flags: 1 ( encrypted ) 11-14: 16:10:54:375:780 next payload: ID 11-14: 16:10:54:375:780 message ID: 00000000 11-14: 16:10:55:375:4cc retransmit: sa = 0011A2A8 centry 00000000 , count = 1 11-14: 16:10:55:375:4cc 11-14: 16:10:55:375:4cc Sending: SA = 0x0011A2A8 to 64.228.217.20:Type 2 11-14: 16:10:55:375:4cc ISAKMP Header: (V1.0), len = 1756 11-14: 16:10:55:375:4cc I-COOKIE a0abc08261101e9f 11-14: 16:10:55:375:4cc R-COOKIE 57c59456b9cb9075 11-14: 16:10:55:375:4cc exchange: Oakley Main Mode 11-14: 16:10:55:375:4cc flags: 1 ( encrypted ) 11-14: 16:10:55:375:4cc next payload: ID 11-14: 16:10:55:375:4cc message ID: 00000000 11-14: 16:10:55:843:780 11-14: 16:10:55:843:780 Receive: (get) SA = 0x0011a2a8 from 64.228.217.20 11-14: 16:10:55:843:780 ISAKMP Header: (V1.0), len = 1620 11-14: 16:10:55:843:780 I-COOKIE a0abc08261101e9f 11-14: 16:10:55:843:780 R-COOKIE 57c59456b9cb9075 11-14: 16:10:55:843:780 exchange: Oakley Main Mode 11-14: 16:10:55:843:780 flags: 1 ( encrypted ) 11-14: 16:10:55:843:780 next payload: ID 11-14: 16:10:55:843:780 message ID: 00000000 11-14: 16:10:55:843:780 processing payload ID 11-14: 16:10:55:843:780 processing payload CERT 11-14: 16:10:55:843:780 processing payload SIG 11-14: 16:10:55:843:780 Verifying CertStore 11-14: 16:10:55:843:780 SubjectName: C=CA, S=Quebec, L=Sherbrooke, O=DmInnovatech, CN=Router, E=dany.fortier@sympatico.ca 11-14: 16:10:55:843:780 Cert Serialnumber 01 11-14: 16:10:55:843:780 Cert SHA Thumbprint e7ebb075adbaa3f92535206bd5bde894 11-14: 16:10:55:843:780 f042930c 11-14: 16:10:55:843:780 Cert Trustes. 0 100 11-14: 16:10:55:843:780 SubjectName: C=CA, S=Quebec, L=Sherbrooke, O=DmInnovatech, CN=Router, E=dany.fortier@sympatico.ca 11-14: 16:10:55:843:780 Cert Serialnumber 01 11-14: 16:10:55:843:780 Cert SHA Thumbprint e7ebb075adbaa3f92535206bd5bde894 11-14: 16:10:55:843:780 f042930c 11-14: 16:10:55:843:780 SubjectName: C=CA, S=Quebec, L=Sherbrooke, O=DmInnovatech, CN=Router, E=dany.fortier@sympatico.ca 11-14: 16:10:55:843:780 Cert Serialnumber 00 11-14: 16:10:55:843:780 Cert SHA Thumbprint 58c0aa1d44a0a76ccf6a57507d3c008c 11-14: 16:10:55:843:780 1d55b0c6 11-14: 16:10:55:843:780 Cert SHA Thumbprint e7ebb075adbaa3f92535206bd5bde894 11-14: 16:10:55:843:780 f042930c 11-14: 16:10:55:843:780 Entered CRL check 11-14: 16:10:55:843:780 Left CRL check 11-14: 16:10:55:843:780 CertFindExtenstion failed with 0 11-14: 16:10:55:843:780 Signature validated 11-14: 16:10:55:843:780 MM established. SA: 0011A2A8 11-14: 16:10:55:843:780 GetSpi: src = 64.228.217.20.0000, dst = 216.209.130.95.0000, proto = 00, context = 81DB56D8, srcMask = 255.255.255.255, destMask = 255.255.255.255, TunnelFilter 1 11-14: 16:10:55:843:780 Setting SPI 4049426892 11-14: 16:10:55:843:780 constructing ISAKMP Header 11-14: 16:10:55:843:780 constructing HASH (null) 11-14: 16:10:55:843:780 constructing SA (IPSEC) 11-14: 16:10:55:843:780 Sending Tunnelling Attribute 11-14: 16:10:55:843:780 constructing QM KE 11-14: 16:10:55:875:780 constructing NONCE (IPSEC) 11-14: 16:10:55:875:780 constructing ID (proxy) 11-14: 16:10:55:875:780 constructing ID (proxy) 11-14: 16:10:55:875:780 constructing HASH (QM) 11-14: 16:10:55:875:780 11-14: 16:10:55:875:780 Sending: SA = 0x0011A2A8 to 64.228.217.20:Type 2 11-14: 16:10:55:875:780 ISAKMP Header: (V1.0), len = 300 11-14: 16:10:55:875:780 I-COOKIE a0abc08261101e9f 11-14: 16:10:55:875:780 R-COOKIE 57c59456b9cb9075 11-14: 16:10:55:875:780 exchange: Oakley Quick Mode 11-14: 16:10:55:875:780 flags: 1 ( encrypted ) 11-14: 16:10:55:875:780 next payload: HASH 11-14: 16:10:55:875:780 message ID: ca8c68e5 11-14: 16:10:56:640:780 11-14: 16:10:56:640:780 Receive: (get) SA = 0x0011a2a8 from 64.228.217.20 11-14: 16:10:56:640:780 ISAKMP Header: (V1.0), len = 1620 11-14: 16:10:56:640:780 I-COOKIE a0abc08261101e9f 11-14: 16:10:56:640:780 R-COOKIE 57c59456b9cb9075 11-14: 16:10:56:640:780 exchange: Oakley Main Mode 11-14: 16:10:56:640:780 flags: 1 ( encrypted ) 11-14: 16:10:56:640:780 next payload: ID 11-14: 16:10:56:640:780 message ID: 00000000 11-14: 16:10:56:640:780 invalid payload received 11-14: 16:10:56:640:780 GetPacket failed 3613 11-14: 16:10:56:656:780 11-14: 16:10:56:656:780 Receive: (get) SA = 0x0011a2a8 from 64.228.217.20 11-14: 16:10:56:656:780 ISAKMP Header: (V1.0), len = 68 11-14: 16:10:56:656:780 I-COOKIE a0abc08261101e9f 11-14: 16:10:56:656:780 R-COOKIE 57c59456b9cb9075 11-14: 16:10:56:656:780 exchange: ISAKMP Informational Exchange 11-14: 16:10:56:656:780 flags: 1 ( encrypted ) 11-14: 16:10:56:656:780 next payload: HASH 11-14: 16:10:56:656:780 message ID: cd53bbfe 11-14: 16:10:56:656:780 processing HASH (Notify/Delete) 11-14: 16:10:56:656:780 processing payload NOTIFY 11-14: 16:10:56:656:780 notify: INVALID-ID-INFORMATION 11-14: 16:10:56:656:780 isadb_set_status sa:0011A2A8 centry:00000000 status 3601 11-14: 16:10:56:875:4cc retransmit: sa = 0011A2A8 centry 000C3870 , count = 1 11-14: 16:10:56:875:4cc 11-14: 16:10:56:875:4cc Sending: SA = 0x0011A2A8 to 64.228.217.20:Type 2 11-14: 16:10:56:875:4cc ISAKMP Header: (V1.0), len = 300 11-14: 16:10:56:875:4cc I-COOKIE a0abc08261101e9f 11-14: 16:10:56:875:4cc R-COOKIE 57c59456b9cb9075 11-14: 16:10:56:875:4cc exchange: Oakley Quick Mode 11-14: 16:10:56:875:4cc flags: 1 ( encrypted ) 11-14: 16:10:56:875:4cc next payload: HASH 11-14: 16:10:56:875:4cc message ID: ca8c68e5 11-14: 16:10:57:250:780 11-14: 16:10:57:250:780 Receive: (get) SA = 0x0011a2a8 from 64.228.217.20 11-14: 16:10:57:250:780 ISAKMP Header: (V1.0), len = 68 11-14: 16:10:57:250:780 I-COOKIE a0abc08261101e9f 11-14: 16:10:57:250:780 R-COOKIE 57c59456b9cb9075 11-14: 16:10:57:250:780 exchange: ISAKMP Informational Exchange 11-14: 16:10:57:250:780 flags: 1 ( encrypted ) 11-14: 16:10:57:250:780 next payload: HASH 11-14: 16:10:57:250:780 message ID: acb68cff 11-14: 16:10:57:250:780 processing HASH (Notify/Delete) 11-14: 16:10:57:250:780 processing payload NOTIFY 11-14: 16:10:57:250:780 notify: INVALID-MESSAGE-ID 11-14: 16:10:57:250:780 Unknown Notify Message 9 11-14: 16:10:58:875:4cc retransmit: sa = 0011A2A8 centry 000C3870 , count = 2 11-14: 16:10:58:875:4cc 11-14: 16:10:58:875:4cc Sending: SA = 0x0011A2A8 to 64.228.217.20:Type 2 11-14: 16:10:58:875:4cc ISAKMP Header: (V1.0), len = 300 11-14: 16:10:58:875:4cc I-COOKIE a0abc08261101e9f 11-14: 16:10:58:875:4cc R-COOKIE 57c59456b9cb9075 11-14: 16:10:58:875:4cc exchange: Oakley Quick Mode 11-14: 16:10:58:875:4cc flags: 1 ( encrypted ) 11-14: 16:10:58:875:4cc next payload: HASH 11-14: 16:10:58:875:4cc message ID: ca8c68e5 11-14: 16:10:59:281:780 11-14: 16:10:59:281:780 Receive: (get) SA = 0x0011a2a8 from 64.228.217.20 11-14: 16:10:59:281:780 ISAKMP Header: (V1.0), len = 68 11-14: 16:10:59:281:780 I-COOKIE a0abc08261101e9f 11-14: 16:10:59:281:780 R-COOKIE 57c59456b9cb9075 11-14: 16:10:59:281:780 exchange: ISAKMP Informational Exchange 11-14: 16:10:59:281:780 flags: 1 ( encrypted ) 11-14: 16:10:59:281:780 next payload: HASH 11-14: 16:10:59:281:780 message ID: 6e691b47 11-14: 16:10:59:281:780 processing HASH (Notify/Delete) 11-14: 16:10:59:281:780 processing payload NOTIFY 11-14: 16:10:59:281:780 notify: INVALID-MESSAGE-ID 11-14: 16:10:59:281:780 Unknown Notify Message 9 11-14: 16:11:02:875:4cc retransmit: sa = 0011A2A8 centry 000C3870 , count = 3 11-14: 16:11:02:875:4cc 11-14: 16:11:02:875:4cc Sending: SA = 0x0011A2A8 to 64.228.217.20:Type 2 11-14: 16:11:02:875:4cc ISAKMP Header: (V1.0), len = 300 11-14: 16:11:02:875:4cc I-COOKIE a0abc08261101e9f 11-14: 16:11:02:875:4cc R-COOKIE 57c59456b9cb9075 11-14: 16:11:02:875:4cc exchange: Oakley Quick Mode 11-14: 16:11:02:875:4cc flags: 1 ( encrypted ) 11-14: 16:11:02:875:4cc next payload: HASH 11-14: 16:11:02:875:4cc message ID: ca8c68e5 11-14: 16:11:03:109:780 11-14: 16:11:03:109:780 Receive: (get) SA = 0x0011a2a8 from 64.228.217.20 11-14: 16:11:03:109:780 ISAKMP Header: (V1.0), len = 68 11-14: 16:11:03:109:780 I-COOKIE a0abc08261101e9f 11-14: 16:11:03:109:780 R-COOKIE 57c59456b9cb9075 11-14: 16:11:03:109:780 exchange: ISAKMP Informational Exchange 11-14: 16:11:03:109:780 flags: 1 ( encrypted ) 11-14: 16:11:03:109:780 next payload: HASH 11-14: 16:11:03:109:780 message ID: fbf7ed6a 11-14: 16:11:03:109:780 processing HASH (Notify/Delete) 11-14: 16:11:03:109:780 processing payload NOTIFY 11-14: 16:11:03:109:780 notify: INVALID-MESSAGE-ID 11-14: 16:11:03:109:780 Unknown Notify Message 9 J'ai toujours les mêmes message d'erreurs qui reviennent soit: processing payload NOTIFY notify: INVALID-MESSAGE-ID Je ne sais plus quoi faire. Quelqu'un a une idée du problème ??

par **mekano** » 15 Nov 2003 22:07

Personne n'a de solutions ou ne peut m'aider?? <IMG SRC="images/smiles/icon_confused.gif">

par **tomtom** » 16 Nov 2003 00:50

Il me semble que tu dois avoir le right et le left qui signifient la même chose des deux cotes.. Donc, dans une de tes deux configs, tu devrais inverser left et right... Mais je ne suis pas sur que le problème vienne de là.... T.

par **mekano** » 16 Nov 2003 01:48

Ok, Si je comprends bien, dans le cas d'un client Itinérant, le "left" voudrait dire le réseau sur lequel est située la passerelle et le right represente le client itinérant ? Est-ce que je comprend bien ? Ex: Adresse passerelle VPN = 67.68.69.70 Config IPSEC Coté client conn distante left=66.68.67.40 right=%any rightca="C=CA, S=Quebec, L=Sherbrooke, O=DmInnovatech,CN=Router, Email=dany.fortier@sympatico.ca" network=ras auto=start pfs=yes Config ipsec passerelle # basic configuration config setup interfaces=%defaultroute klipsdebug=all plutodebug=all plutoload=%search plutostart=%search uniqueids=yes conn %default keyingtries=0 compress=yes authby=rsasig disablearrivalcheck=no conn distante right=%any rightnexthop=%defaultroute rightrsasigkey=%cert left=%defaultroute leftsubnet=192.168.0.0/24 //adresse de mon sous-reseau derriere la passerelle leftrsasigkey=%cert leftcert=router.pem auto=add pfs=yes Est-ce que j'ai bien compris ??

Freeswan + Client Windows XP

Qui est en ligne ?