<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">That’s a bug in 3.15 where it did not allow more then one CERT payload. Please upgrade to a later version.<div><br></div><div>Paul<br><div><br><div id="AppleMailSignature">Sent from my iPhone</div><div><br>On Feb 27, 2018, at 16:45, Sadler, Jonathan B. <<a href="mailto:jonathan.sadler@coriant.com">jonathan.sadler@coriant.com</a>> wrote:<br><br></div><blockquote type="cite"><div>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-7">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoPlainText">Thanks for the quick response.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I thought some MTU issues may exists, so I had inserted the fragment=forced in the config. After getting your response pointing out issues with fragmentation and knowing that the Interpeak IKE is supposed to handle message sizes up to
10000 bytes, I did some path MTU tests and found an Ethernet switch in the path that was limiting Ethernet frames to 512 bytes payload. Not useful...<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">After swapping the switch out, things seem better, but still not coming up roses. Here is the current output from /var/log/secure:<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:36 Linux69 pluto[22722]: "target" #1: initiating v2 parent SA<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:36 Linux69 pluto[22722]: "target" #1: STATE_PARENT_I1: sent v2I1, expected v2R1<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:37 Linux69 pluto[22722]: | Sending [CERT] of certificate: <a href="mailto:E=nmsmaster@envisionplusdomain.com">E=nmsmaster@envisionplusdomain.com</a>.,CN=<a href="http://TNMSLinux69.envisionplusdomain.com">TNMSLinux69.envisionplusdomain.com</a>.,OU=Test,O=Coriant,ST=IL,C=US<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:37 Linux69 pluto[22722]: "target" #2: STATE_PARENT_I2: sent v2I2, expected v2R2 {auth=IKEv2 cipher=aes_128 integ=sha1_96 prf=sha group=MODP2048}<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:37 Linux69 pluto[22722]: "target" #2: payload(s) (ISAKMP_NEXT_v2CERT) unexpectedly repeated. Message dropped.<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:37 Linux69 pluto[22722]: "target" #2: payload(s) (ISAKMP_NEXT_v2CERT) unexpectedly repeated. Message dropped.<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:38 Linux69 pluto[22722]: "target" #2: payload(s) (ISAKMP_NEXT_v2CERT) unexpectedly repeated. Message dropped.<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:39 Linux69 pluto[22722]: "target" #2: payload(s) (ISAKMP_NEXT_v2CERT) unexpectedly repeated. Message dropped.<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:40 Linux69 pluto[22722]: "target" #3: STATE_PARENT_R1: received v2I1, sent v2R1 {auth=IKEv2 cipher=aes_128 integ=sha1_96 prf=sha group=MODP2048}<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:41 Linux69 pluto[22722]: "target" #2: payload(s) (ISAKMP_NEXT_v2CERT) unexpectedly repeated. Message dropped.<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:41 Linux69 pluto[22722]: "target" #3: payload(s) (ISAKMP_NEXT_v2CERT) unexpectedly repeated. Message dropped.<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:41 Linux69 pluto[22722]: | ikev2_parent_inI2outR2_tail returned STF_FAIL with v2N_INVALID_SYNTAX<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:41 Linux69 pluto[22722]: "target" #3: sending unencrypted notification v2N_INVALID_SYNTAX to 172.23.129.50:500<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:41 Linux69 pluto[22722]: "target" #3: missing payload(s) (ISAKMP_NEXT_v2SK). Message dropped.<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:41 Linux69 pluto[22722]: "target" #3: sending unencrypted notification v2N_INVALID_SYNTAX to 172.23.129.50:500<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Feb 27 16:30:41 Linux69 pluto[22722]: "target" #3: missing payload(s) (ISAKMP_NEXT_v2SK). Message dropped.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">And from vxWorks SYSLOG:<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Notice: New exchange started (IKE_SA_INIT with message ID: 0)<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Notice: Received message 172.22.103.146[500], IKE_SA_INIT, #1(4), ID 0<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Info: selected 'aes' as encryption algorithm<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Info: selected '128' as key length<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Info: selected 'sha1' as hash algorithm<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Info: selected 'sha1' as integrity algorithm<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Info: selected 'modp2048' as DH group description<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Notice: Sending message 172.22.103.146[500], (IKE_SA_INIT), #2(4), ID 0<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Notice: Received message 172.22.103.146[500], IKE_SA_INIT, #3(4), ID 0<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Notice: Message 172.22.103.146[500] already processed, (IKE_SA_INIT), #2(4), ID 0<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Notice: Resending message 172.22.103.146[500], (IKE_AUTH), #2(4), ID 0, 1(5)<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Notice: Received message 172.22.103.146[500], IKE_AUTH, #3(4), ID 1<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Info: selected 'aes' as encryption algorithm<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Info: selected '128' as key length<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Info: selected 'sha1' as integrity algorithm<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:27 2018: ipike[57a49230]: Info: selected 'off' for ESN<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:28 2018: ipike[57a49230]: Notice: Sending message 172.22.103.146[500], (IKE_AUTH), #4(4), ID 1<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:28 2018: ipike[57a49230]: Info: CHILD SA exchange done in 670 ms (peer: 172.22.103.146, message ID: 1)<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:28 2018: ipike[57a49230]: Info: IKE SA INIT done in 670 ms (peer: 172.22.103.146, message ID: 1)<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:28 2018: ipike[57a49230]: Notice: Received message 172.22.103.146[500], IKE_AUTH, #5(4), ID 1<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:28 2018: ipike[57a49230]: Notice: Message 172.22.103.146[500] already processed, (IKE_AUTH), #4(4), ID 1<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:28 2018: ipike[57a49230]: Notice: Resending message 172.22.103.146[500], (IKE_AUTH), #4(4), ID 1, 2(5)<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:28 2018: ipike[57a49230]: Notice: Received message 172.22.103.146[500], IKE_AUTH, #5(4), ID 1<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">TUE FEB 27 21:39:28 2018: ipike[57a49230]: Notice: Message 172.22.103.146[500] already processed, (IKE_AUTH), #4(4), ID 1<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The Linux system thinks things are better, showing IKE SAs that are authenticated:<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">000 Total IPsec connections: loaded 1, active 0<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">000 <o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">000 State Information: DDoS cookies not required, Accepting new IKE connections<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">000 IKE SAs: total(7), half-open(1), open(0), authenticated(6), anonymous(0)<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">000 IPsec SAs: total(1), authenticated(1), anonymous(0)<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">000 <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">But the vxWorks system is not as happy:<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">[vxWorks]# ike list<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">[0] initiator cookie: 0x199a30a4c4a77457 responder cookie: 0xeaf67966e11cd5e8<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in"> created 13 seconds ago as initiator, ref.count: 1, state: CONSTRUCTING<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in"> peer addr: 172.22.103.146, local addr: 172.23.129.50<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in"> sent bytes: 2048, received bytes: 4380<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Config is same as before, removing the fragmentation=forced directive.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Any thoughts?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Jonathan Sadler<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: Paul Wouters [<a href="mailto:paul@nohats.ca">mailto:paul@nohats.ca</a>] <br>
Sent: Tuesday, February 27, 2018 11:08 AM<br>
To: Sadler, Jonathan B. <<a href="mailto:jonathan.sadler@coriant.com">jonathan.sadler@coriant.com</a>><br>
Cc: <a href="mailto:swan@lists.libreswan.org">swan@lists.libreswan.org</a><br>
Subject: Re: [Swan] Looking for assistance: libreswan pluto 3.15 interop with vxWorks (Interpeak) 6.5 ipsec</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On Tue, 27 Feb 2018, Sadler, Jonathan B. wrote:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> Please point me to a troubleshooting guide if you feel it would help my debugging.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> I’m attempting to get a tunnel using IKEv2 and x509 certs established
<o:p></o:p></p>
<p class="MsoPlainText">> between a linux system with pluto 3.15 and an embedded system using vxWorks 6.5. I have the certificates incorporated in the NSS database and am having issues getting to phase2.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> Feb 27 11:32:58 Linux69 pluto[26056]: "target" #2: missing payload(s)
<o:p></o:p></p>
<p class="MsoPlainText">> (ISAKMP_NEXT_v2SA+ISAKMP_NEXT_v2IDr+ISAKMP_NEXT_v2AUTH+ISAKMP_NEXT_v2TSi+ISAKMP_NEXT_v2TSr). Message dropped.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Feb 27 11:32:58 Linux69 pluto[26056]: packet from 172.23.129.50:500:
<o:p></o:p></p>
<p class="MsoPlainText">> sending unencrypted notification v2N_INVALID_MESSAGE_ID to<o:p></o:p></p>
<p class="MsoPlainText">> 172.23.129.50:500<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">This means it throws an error to libreswan.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> TUE FEB 27 16:57:19 2018: ipike[57f84540]: Notice: Message
<o:p></o:p></p>
<p class="MsoPlainText">> 172.22.103.146[500] already processed, (IKE_SA_INIT), #2(4), ID 0<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> TUE FEB 27 16:57:19 2018: ipike[57f84540]: Notice: Resending message
<o:p></o:p></p>
<p class="MsoPlainText">> 172.22.103.146[500], (IKE_AUTH), #2(4), ID 0, 1(5)<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> TUE FEB 27 16:57:20 2018: ipike[57f84540]: Notice: Received message
<o:p></o:p></p>
<p class="MsoPlainText">> 172.22.103.146[500], IKE_AUTH, #3(4), ID 1<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> TUE FEB 27 16:57:20 2018: ipike[57f84540]: Error: the payloads extends
<o:p></o:p></p>
<p class="MsoPlainText">> beyond the end of the ISAKMP package<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> TUE FEB 27 16:57:20 2018: ipike[57f84540]: Warning: ISAKMP message
<o:p></o:p></p>
<p class="MsoPlainText">> dropped, error code 20<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">that's weird. It claims we sent a badly formed IKE packet?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> TUE FEB 27 16:57:20 2018: ipike[57f84540]: Notice: Received message
<o:p></o:p></p>
<p class="MsoPlainText">> 172.22.103.146[500], IKE_AUTH, #3(4), ID 1<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> TUE FEB 27 16:57:20 2018: ipike[57f84540]: Error: payload check failed
<o:p></o:p></p>
<p class="MsoPlainText">> since 53 is an unsupported payload type<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Type 53 is an encrypted fragment (see RFC 7383). If it does not support that, then why was FRAGMENTATION performed. libreswan has an "override"<o:p></o:p></p>
<p class="MsoPlainText">when using fragmentation=force which obviously should not be used with implementations that do not support fragmentation.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> Here is the config I’m using:<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> conn target<o:p></o:p></p>
<p class="MsoPlainText">> type=tunnel<o:p></o:p></p>
<p class="MsoPlainText">> fragmentation=force<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">So remove this fragmentation=force line :)<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Paul<o:p></o:p></p>
</div>
</div></blockquote></div></div></body></html>