Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPsec VPN + Cisco VPN Client

    Scheduled Pinned Locked Moved Russian
    13 Posts 2 Posters 3.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • werterW
      werter
      last edited by

      Включайте и смотрите логи IPSec, fw.

      P.s. Попробуйте использовать это - https://www.shrew.net/software

      1 Reply Last reply Reply Quote 0
      • D
        dER_MuKCeP
        last edited by

        Вариант с  Shrew Soft VPN Client очень хороший , но авторизация в AD платная (

        1 Reply Last reply Reply Quote 0
        • D
          dER_MuKCeP
          last edited by

          Было замечено , если растартануть racoon все все начинает работать…

          1 Reply Last reply Reply Quote 0
          • D
            dER_MuKCeP
            last edited by

            Лог после перезагрузки racoon и первой попытке соединения Cisco VPN Client

            May 11 12:02:00 	racoon: INFO: caught signal 15
May 11 12:02:00 	racoon: INFO: racoon process 25517 shutdown
May 11 12:02:05 	racoon: INFO: @(#)ipsec-tools 0.8.1 (http://ipsec-tools.sourceforge.net)
May 11 12:02:05 	racoon: INFO: @(#)This product linked OpenSSL 1.0.1g 7 Apr 2014 (http://www.openssl.org/)
May 11 12:02:05 	racoon: INFO: Reading configuration from "/var/etc/ipsec/racoon.conf"
May 11 12:02:05 	racoon: INFO: Resize address pool from 0 to 253
May 11 12:02:05 	racoon: [Self]: INFO: 123.123.123.123[4500] used for NAT-T
May 11 12:02:05 	racoon: [Self]: INFO: 123.123.123.123[4500] used as isakmp port (fd=14)
May 11 12:02:05 	racoon: [Self]: INFO: 123.123.123.123[500] used for NAT-T
May 11 12:02:05 	racoon: [Self]: INFO: 123.123.123.123[500] used as isakmp port (fd=15)
May 11 12:02:05 	racoon: INFO: unsupported PF_KEY message REGISTER
May 11 12:02:05 	racoon: ERROR: such policy already exists. anyway replace it: 192.168.1.2/32[0] 192.168.1.0/24[0] proto=any dir=out
May 11 12:02:05 	racoon: ERROR: such policy already exists. anyway replace it: 192.168.1.0/24[0] 192.168.1.2/32[0] proto=any dir=in
May 11 12:03:14 	racoon: [Self]: INFO: respond new phase 1 negotiation: 123.123.123.123[500]<=>45.45.45.45[55386]
May 11 12:03:14 	racoon: INFO: begin Aggressive mode.
May 11 12:03:14 	racoon: INFO: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
May 11 12:03:14 	racoon: INFO: received Vendor ID: DPD
May 11 12:03:14 	racoon: INFO: received broken Microsoft ID: FRAGMENTATION
May 11 12:03:14 	racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
May 11 12:03:14 	racoon: INFO: received Vendor ID: CISCO-UNITY
May 11 12:03:14 	racoon: [45.45.45.45] INFO: Selected NAT-T version: draft-ietf-ipsec-nat-t-ike-02
May 11 12:03:14 	racoon: INFO: Adding remote and local NAT-D payloads.
May 11 12:03:14 	racoon: [45.45.45.45] INFO: Hashing 45.45.45.45[55386] with algo #2
May 11 12:03:14 	racoon: [Self]: [123.123.123.123] INFO: Hashing 123.123.123.123[500] with algo #2
May 11 12:03:14 	racoon: INFO: Adding xauth VID payload.
May 11 12:03:14 	racoon: [Self]: INFO: NAT-T: ports changed to: 45.45.45.45[55387]<->123.123.123.123[4500]
May 11 12:03:14 	racoon: [45.45.45.45] ERROR: notification INITIAL-CONTACT received in aggressive exchange.
May 11 12:03:14 	racoon: [Self]: [123.123.123.123] INFO: Hashing 123.123.123.123[4500] with algo #2
May 11 12:03:14 	racoon: INFO: NAT-D payload #0 doesn't match
May 11 12:03:14 	racoon: [45.45.45.45] INFO: Hashing 45.45.45.45[55387] with algo #2
May 11 12:03:14 	racoon: INFO: NAT-D payload #1 doesn't match
May 11 12:03:14 	racoon: INFO: received Vendor ID: CISCO-UNITY
May 11 12:03:14 	racoon: INFO: NAT detected: ME PEER
May 11 12:03:14 	racoon: INFO: Sending Xauth request
May 11 12:03:14 	racoon: [Self]: INFO: ISAKMP-SA established 123.123.123.123[4500]-45.45.45.45[55387] spi:07f9b5569aa783e7:20e75e7333b5c9b8
May 11 12:03:28 	racoon: INFO: Using port 0
May 11 12:03:28 	racoon: user 'test' authenticated
May 11 12:03:28 	racoon: INFO: login succeeded for user "test"
May 11 12:03:28 	racoon: WARNING: Ignored attribute INTERNAL_ADDRESS_EXPIRY
May 11 12:03:28 	racoon: ERROR: Cannot open "/etc/motd"
May 11 12:03:28 	racoon: WARNING: Ignored attribute 28683
May 11 12:03:28 	racoon: WARNING: Ignored attribute 28684
May 11 12:03:28 	racoon: [Self]: INFO: respond new phase 2 negotiation: 123.123.123.123[4500]<=>45.45.45.45[55387]
May 11 12:03:28 	racoon: INFO: no policy found, try to generate the policy : 10.99.99.1/32[0] 0.0.0.0/0[0] proto=any dir=in
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:03:28 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:03:28 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:03:28 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:03:28 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: ERROR: not matched
May 11 12:03:28 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:03:28 	racoon: [Self]: INFO: IPsec-SA established: ESP 123.123.123.123[500]->45.45.45.45[500] spi=27097690(0x19d7a5a)
May 11 12:03:28 	racoon: [Self]: INFO: IPsec-SA established: ESP 123.123.123.123[500]->45.45.45.45[500] spi=602786838(0x23edcc16)

            Соединение установлено , все работает.

            Отключаюсь. Подключаюсь еще раз…

            Вот что выдал лог:

            May 11 12:24:21 	racoon: [Self]: INFO: respond new phase 1 negotiation: 123.123.123.123[500]<=>45.45.45.45[59617]
May 11 12:24:21 	racoon: INFO: begin Aggressive mode.
May 11 12:24:21 	racoon: INFO: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
May 11 12:24:21 	racoon: INFO: received Vendor ID: DPD
May 11 12:24:21 	racoon: INFO: received broken Microsoft ID: FRAGMENTATION
May 11 12:24:21 	racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
May 11 12:24:21 	racoon: INFO: received Vendor ID: CISCO-UNITY
May 11 12:24:21 	racoon: [45.45.45.45] INFO: Selected NAT-T version: draft-ietf-ipsec-nat-t-ike-02
May 11 12:24:21 	racoon: INFO: Adding remote and local NAT-D payloads.
May 11 12:24:21 	racoon: [45.45.45.45] INFO: Hashing 45.45.45.45[59617] with algo #2
May 11 12:24:21 	racoon: [Self]: [123.123.123.123] INFO: Hashing 123.123.123.123[500] with algo #2
May 11 12:24:21 	racoon: INFO: Adding xauth VID payload.
May 11 12:24:21 	racoon: [Self]: INFO: NAT-T: ports changed to: 45.45.45.45[59618]<->123.123.123.123[4500]
May 11 12:24:21 	racoon: [45.45.45.45] ERROR: notification INITIAL-CONTACT received in aggressive exchange.
May 11 12:24:21 	racoon: [Self]: [123.123.123.123] INFO: Hashing 123.123.123.123[4500] with algo #2
May 11 12:24:21 	racoon: INFO: NAT-D payload #0 doesn't match
May 11 12:24:21 	racoon: [45.45.45.45] INFO: Hashing 45.45.45.45[59618] with algo #2
May 11 12:24:21 	racoon: INFO: NAT-D payload #1 doesn't match
May 11 12:24:21 	racoon: INFO: received Vendor ID: CISCO-UNITY
May 11 12:24:21 	racoon: INFO: NAT detected: ME PEER
May 11 12:24:21 	racoon: INFO: Sending Xauth request
May 11 12:24:21 	racoon: [Self]: INFO: ISAKMP-SA established 123.123.123.123[4500]-45.45.45.45[59618] spi:06fbe9bf549af3b7:47e137722fc9fa19
May 11 12:24:24 	racoon: INFO: Using port 0
May 11 12:24:24 	racoon: user 'test' authenticated
May 11 12:24:24 	racoon: INFO: login succeeded for user "test"
May 11 12:24:24 	racoon: WARNING: Ignored attribute INTERNAL_ADDRESS_EXPIRY
May 11 12:24:24 	racoon: ERROR: Cannot open "/etc/motd"
May 11 12:24:24 	racoon: WARNING: Ignored attribute 28683
May 11 12:24:24 	racoon: WARNING: Ignored attribute 28684
May 11 12:24:24 	racoon: [Self]: INFO: respond new phase 2 negotiation: 123.123.123.123[4500]<=>45.45.45.45[59618]
May 11 12:24:24 	racoon: INFO: no policy found, try to generate the policy : 10.99.99.1/32[0] 0.0.0.0/0[0] proto=any dir=in
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:24:24 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:24:24 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:24:24 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: WARNING: trns_id mismatched: my:DEFLATE peer:LZS
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting my encmode UDP-Tunnel->Tunnel
May 11 12:24:24 	racoon: WARNING: authtype mismatched: my:hmac-sha peer:hmac-md5
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: ERROR: not matched
May 11 12:24:24 	racoon: INFO: Adjusting peer's encmode UDP-Tunnel(61443)->Tunnel(1)
May 11 12:24:24 	racoon: [Self]: INFO: IPsec-SA established: ESP 123.123.123.123[500]->45.45.45.45[500] spi=185558860(0xb0f674c)
May 11 12:24:24 	racoon: [Self]: INFO: IPsec-SA established: ESP 123.123.123.123[500]->45.45.45.45[500] spi=1350976079(0x5086424f)
May 11 12:24:30 	racoon: ERROR: no configuration found for 45.45.45.45.
May 11 12:24:30 	racoon: ERROR: failed to begin ipsec sa negotication.
            1 Reply Last reply Reply Quote 0
            • werterW
              werter
              last edited by

              Ошибка происходит на 2-ой фазе. Попробуйте сменить настройки с Aggressive mode на main

              Пробуйте сперва это  - https://forum.pfsense.org/index.php?topic=46917.0, https://forum.pfsense.org/index.php?topic=41631.15

              Еще :

              To resolve this issue disable NAT-T (when pfsense holds the public IP). If that still does not help disable DPD and set 'Negotiation Mode' in Phase 1 to main (pfsense is at both ends in my scenario).

              И еще :

              _on the pfsense side, try setting the P1 Policy Generation to "unique"

              i was having similar issues for subequent reconnects for the Shrew client where restarting the pfsense ipsec process would clear the issue

              i did NOT need to disable NAT-T or DPD, just changing the P1 Policy Generation setting from "default" to "unique" was the only change i made_

              P.s. Люди пишут, что проблема с цисковским клиентом. Вы последнюю версию этого клиента пользуете? Если у Вас 64-битная версия (если такая есть, я не в курсе  :-), то смените ее на 32-х.

              1 Reply Last reply Reply Quote 0
              • D
                dER_MuKCeP
                last edited by

                При смене с "Aggressive" на "main"

                
May 11 14:48:04 	racoon: [213.142.62.211] ERROR: exchange Aggressive not allowed in any applicable rmconf.
                1 Reply Last reply Reply Quote 0
                • D
                  dER_MuKCeP
                  last edited by

                  @werter:

                  P.s. Люди пишут, что проблема с цисковским клиентом. Вы последнюю версию этого клиента пользуете? Если у Вас 64-битная версия (если такая есть, я не в курсе  :-), то смените ее на 32-х.

                  Я бы не проч использовать другой клиент , главное что бы была поддержка авторизации в AD

                  1 Reply Last reply Reply Quote 0
                  • werterW
                    werter
                    last edited by

                    Попробуйте сделать точно по инс-ции :

                    https://sites.google.com/a/vorkbaard.nl/dekapitein/tech-1/how-to-set-up-ipsec-tunneling-in-pfsense-2-0-release-for-road-warriors

                    P.s. Включите дебаг ракуна и смотрите лог :

                    You can enable debug mode for racoon by checking the option for it under System > Advanced on the Miscellaneous tab.

                    1 Reply Last reply Reply Quote 0
                    • D
                      dER_MuKCeP
                      last edited by

                      Сделал все по мануалу + установил ShrewSoft VPN Client … все работает отлично!!!

                      1 Reply Last reply Reply Quote 0
                      • werterW
                        werter
                        last edited by

                        Т.е. авторизация с AD работает стабильно и при переподключении? Не рвется? А с клиентом от Cisco ?

                        P.s. Поставьте, пож-та, в название темы [РЕШЕНО].

                        1 Reply Last reply Reply Quote 0
                        • D
                          dER_MuKCeP
                          last edited by

                          Пробовал с ПК несколько раз рвать соединение, все отлично работает! и авторизация через АД тоже проходит. НО…

                          если попробовать подключиться еще раз с другого устройства (я использую iPad) то на ПК все прекращает работать , соединение есть, но доступа никуда нет . На планшете тоже самое, ВПН поднимается но никуда доступа нет, пинги пропадают и на ПК и на планшете.

                          1 Reply Last reply Reply Quote 0
                          • D
                            dER_MuKCeP
                            last edited by

                            @werter:

                            А с клиентом от Cisco ?

                            с параметрами из мануала Cisco VPN Client не  подключается

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.