<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hello all,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Please point me to a troubleshooting guide if you feel it would help my debugging.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m attempting to get a tunnel using IKEv2 and x509 certs established between a linux system with pluto 3.15 and an embedded system using vxWorks 6.5. I have the certificates incorporated in the NSS database and am having issues getting
to phase2.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It looks like Phase 1 successfully negotiates crypto routines but doesn’t seem to get through authentication. Here are relevant lines from /var/log/secure:<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Feb 27 11:32:57 Linux69 pluto[26056]: "target" #1: initiating v2 parent SA<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Feb 27 11:32:57 Linux69 pluto[26056]: "target" #1: STATE_PARENT_I1: sent v2I1, expected v2R1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Feb 27 11:32:57 Linux69 pluto[26056]: | Sending [CERT] of certificate: <Cert FQN Redacted><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Feb 27 11:32:57 Linux69 pluto[26056]: "target" #2: STATE_PARENT_I2: sent v2I2, expected v2R2 {auth=IKEv2 cipher=aes_128 integ=sha1_96 prf=sha group=MODP2048}<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Feb 27 11:32:58 Linux69 pluto[26056]: "target" #2: missing payload(s) (ISAKMP_NEXT_v2SA+ISAKMP_NEXT_v2IDr+ISAKMP_NEXT_v2AUTH+ISAKMP_NEXT_v2TSi+ISAKMP_NEXT_v2TSr). Message dropped.<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Feb 27 11:32:58 Linux69 pluto[26056]: packet from 172.23.129.50:500: sending unencrypted notification v2N_INVALID_MESSAGE_ID to 172.23.129.50:500<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Feb 27 11:32:58 Linux69 pluto[26056]: packet from 172.23.129.50:500: sending unencrypted notification v2N_INVALID_MESSAGE_ID to 172.23.129.50:500<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">…<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The vxWorks system is reporting the following in SYSLOG:<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:19 2018: ipike[57f84540]: Notice: New exchange started (IKE_SA_INIT with message ID: 0)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:19 2018: ipike[57f84540]: Notice: Received message 172.22.103.146[500], IKE_SA_INIT, #1(4), ID 0<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:19 2018: ipike[57f84540]: Info: selected 'aes' as encryption algorithm<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:19 2018: ipike[57f84540]: Info: selected '128' as key length<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:19 2018: ipike[57f84540]: Info: selected 'sha1' as hash algorithm<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:19 2018: ipike[57f84540]: Info: selected 'sha1' as integrity algorithm<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:19 2018: ipike[57f84540]: Info: selected 'modp2048' as DH group description<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:19 2018: ipike[57f84540]: Notice: Sending message 172.22.103.146[500], (IKE_SA_INIT), #2(4), ID 0<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:19 2018: ipike[57f84540]: Notice: Received message 172.22.103.146[500], IKE_SA_INIT, #3(4), ID 0<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:19 2018: ipike[57f84540]: Notice: Message 172.22.103.146[500] already processed, (IKE_SA_INIT), #2(4), ID 0<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:19 2018: ipike[57f84540]: Notice: Resending message 172.22.103.146[500], (IKE_AUTH), #2(4), ID 0, 1(5)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:20 2018: ipike[57f84540]: Notice: Received message 172.22.103.146[500], IKE_AUTH, #3(4), ID 1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:20 2018: ipike[57f84540]: Error: the payloads extends beyond the end of the ISAKMP package<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:20 2018: ipike[57f84540]: Warning: ISAKMP message dropped, error code 20<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:20 2018: ipike[57f84540]: Notice: Received message 172.22.103.146[500], IKE_AUTH, #3(4), ID 1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:20 2018: ipike[57f84540]: Error: payload check failed since 53 is an unsupported payload type<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:20 2018: ipike[57f84540]: Warning: ipike_policy_select_sa_param: no proposal was accepted<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:20 2018: ipike[57f84540]: Error: ipike_exchange_sa_init_update: Failed to create first child<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:20 2018: ipike[57f84540]: Notice: Sending message 172.22.103.146[500], (IKE_AUTH), #4(4), ID 1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:20 2018: ipike[57f84540]: Notice: New exchange started (IKE_AUTH with message ID: 1)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:20 2018: ipike[57f84540]: Notice: Received message 172.22.103.146[500], IKE_AUTH, #1(4), ID 1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">TUE FEB 27 16:57:20 2018: ipike[57f84540]: Notice: Bad exchange identifier, peer probably processed resend message<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here is the config I’m using:<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">conn target<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> type=tunnel<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> fragmentation=force<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> left=172.22.103.146<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> leftcert=TNMS<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> leftid=%cert<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> leftsendcert=always<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> leftsubnet=172.22.103.146/32<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> leftrsasigkey=%cert<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> right=172.23.129.50<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> rightca=%same<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> rightrsasigkey=%cert<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> authby=rsasig<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> auto=start<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> ikev2=insist<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> ike=aes128-sha1;modp2048<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> phase2alg=aes128-sha1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> keyingtries=%forever<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> pfs=yes<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> auto=start<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any thoughts/pointers provided is appreciated.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Jonathan Sadler<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>