<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Dear Mr. Wouters,</p>
<p>I was unsuccessful in trying to produce a VPN Client log.</p>
<p>c:\ netsh trace start VpnClient per=yes maxsize=0 filemode=single</p>
<p>produced a
C:\Users\mtodo\AppData\Local\Temp\NetTraces\NetTrace.etl log that
requires PerfView and it<br>
is all Greek to me.</p>
<p>C:\Windows\tracing\rasman.log is empty (size 0).</p>
<p>Any idea? I'm on a Windows 10 Professional box.</p>
<p>Kind regards,<br>
Mirsad Todorovac<br>
</p>
<div class="moz-cite-prefix">On 11/24/2021 3:30 PM, Paul Wouters
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:2cdbfa4b-9775-ca28-cf5d-a6da61ed4afe@nohats.ca">On Wed,
24 Nov 2021, Mirsad Goran Todorovac wrote:
<br>
<br>
<blockquote type="cite">Subject: Re: [Swan] Lost IKEv1
connectivity after libreswan upgrade
<br>
</blockquote>
<br>
<blockquote type="cite">It seems that IPSEC is established, and a
transport connection:
<br>
<br>
Nov 24 15:16:18.322599: | pstats #14 ikev1.ipsec established
<br>
Nov 24 15:16:18.322609: | NAT-T: encaps is 'auto'
<br>
Nov 24 15:16:18.322617: "L2TP-PSK-noNAT"[7] 193.198.186.218 #14:
STATE_QUICK_R2: IPsec SA established transport mode
{ESP=>0xbd9d07f4 <0x935a0ca5 xfrm=AES_CBC_128-HMAC_SHA1_96
NATOA=none NATD=none DPD
<br>
</blockquote>
<br>
On the server side at least. But the last packet sent by the
server
<br>
still has to be accepted by the client.
<br>
<br>
<blockquote type="cite">but then, after receiving first encrypted
packet, pluto spuriously decides to delete, "down" the
connection and "unroute" it:
<br>
<br>
Nov 24 15:16:53.359857: | State DB: found IKEv1 state #13 in
MAIN_R3 (find_v1_info_state)
<br>
</blockquote>
<br>
R3 is not yet fully established.
<br>
<br>
<blockquote type="cite">Nov 24 15:16:53.360046: | ***parse ISAKMP
Hash Payload:
<br>
Nov 24 15:16:53.360056: | next payload type: ISAKMP_NEXT_D
(0xc)
<br>
</blockquote>
<br>
This is a Delete request. The client is unhappy with something and
<br>
deleting the connection. If this is due to an upgrade, it could be
the
<br>
new defaults for our algorithms aren't matching the old defaults?
<br>
Although we havent changed IKEv1 defaults in a very long time.
<br>
<br>
<blockquote type="cite">I seem to be stuck here, I don't know how
to debug connection.
<br>
</blockquote>
<br>
The client should have a log message about why it decided to hang
up?
<br>
<br>
Paul<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Swan mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Swan@lists.libreswan.org">Swan@lists.libreswan.org</a>
<a class="moz-txt-link-freetext" href="https://lists.libreswan.org/mailman/listinfo/swan">https://lists.libreswan.org/mailman/listinfo/swan</a>
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Mirsad Goran Todorovac
CARNet sistem inženjer
Grafički fakultet | Akademija likovnih umjetnosti
Sveučilište u Zagrebu
--
CARNet system engineer
Faculty of Graphic Arts | Academy of Fine Arts
University of Zagreb, Republic of Croatia
tel. +385 (0)1 3711 451
mob. +385 91 57 88 355</pre>
</body>
</html>