Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Upgrade to 2.2.4 –> The VPN Shared Secret is incorrect

    Scheduled Pinned Locked Moved IPsec
    18 Posts 4 Posters 9.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dgwilson
      last edited by

      I changed distinguished name to user distinguished name –> david@xyz.com
      And changed the group specification on OS X to be the same.
      It still failed with the same error.

      Aug 4 14:33:10 charon: 11[IKE] <con2|11>INFORMATIONAL_V1 request with message ID 3158498826 processing failed
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>INFORMATIONAL_V1 request with message ID 3158498826 processing failed
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>ignore malformed INFORMATIONAL request
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>ignore malformed INFORMATIONAL request
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>message parsing failed
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>message parsing failed
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>sending NAT-T (RFC 3947) vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>sending NAT-T (RFC 3947) vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>sending FRAGMENTATION vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>sending FRAGMENTATION vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>sending Cisco Unity vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>sending Cisco Unity vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>sending DPD vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>sending DPD vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>sending XAuth vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <con2|11>sending XAuth vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> IKE_SA (unnamed)[11] state change: CREATED => CONNECTING
      Aug 4 14:33:10 charon: 11[IKE] <11> IKE_SA (unnamed)[11] state change: CREATED => CONNECTING
      Aug 4 14:33:10 charon: 11[IKE] <11> 192.168.10.140 is initiating a Aggressive Mode IKE_SA
      Aug 4 14:33:10 charon: 11[IKE] <11> 192.168.10.140 is initiating a Aggressive Mode IKE_SA
      Aug 4 14:33:10 charon: 11[IKE] <11> received DPD vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received DPD vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received Cisco Unity vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received Cisco Unity vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received XAuth vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received XAuth vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-02 vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-02 vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-03 vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-03 vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-04 vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-04 vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-05 vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-05 vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-06 vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-06 vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-07 vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-07 vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-08 vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike-08 vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received draft-ietf-ipsec-nat-t-ike vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received NAT-T (RFC 3947) vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received NAT-T (RFC 3947) vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received FRAGMENTATION vendor ID
      Aug 4 14:33:10 charon: 11[IKE] <11> received FRAGMENTATION vendor ID
      Aug 4 14:33:09 charon: 11[IKE] <con2|10>IKE_SA con2[10] state change: CONNECTING => DESTROYING
      Aug 4 14:33:09 charon: 11[IKE] <con2|10>IKE_SA con2[10] state change: CONNECTING => DESTROYING</con2|10></con2|10></con2|11></con2|11></con2|11></con2|11></con2|11></con2|11></con2|11></con2|11></con2|11></con2|11></con2|11></con2|11></con2|11></con2|11></con2|11></con2|11>

      1 Reply Last reply Reply Quote 0
      • D
        dgwilson
        last edited by

        Some additional information.

        /var/etc/ipsec: cat ipsec.secrets
        203.97.236.202 @dgw.kiwi : PSK 0<changed to="" protect="" me="">=
        203.97.236.202 dgwilson : PSK 0<changed to="" protect="" me="">=

        In the gui the Distinguished name is defined as "dgw.kiwi" - without the quotes.

        • David</changed></changed>
        1 Reply Last reply Reply Quote 0
        • D
          dgwilson
          last edited by

          I'm continuing to look and this and experiment by changing various settings… without success.

          Anyway...  I put the IKE SA debug mode to highest... below is the final part of the log file...  I trust this will be of assistance.

          ... this is a bug right? Do I need to log a bug for it?
          ... can I look at the code for this? Where do I look? not sure I want to go here...

          Aug 6 19:46:51 charon: 11[IKE] <con2|3>sending retransmit 1 of response message ID 0, seq 1
          Aug 6 19:46:51 charon: 11[IKE] <con2|3>sending retransmit 1 of response message ID 0, seq 1
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>INFORMATIONAL_V1 request with message ID 3698334349 processing failed
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>INFORMATIONAL_V1 request with message ID 3698334349 processing failed
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>ignore malformed INFORMATIONAL request
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>ignore malformed INFORMATIONAL request
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>message parsing failed
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>message parsing failed
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>0: 79 A8 9B 58 75 8C 17 95 00 CF ED 66 9D 5C C8 9D y..Xu…...f...
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>next IV for MID 3698334349 => 16 bytes @ 0x29c52cc0
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>0: 79 A8 9B 58 75 8C 17 95 00 CF ED 66 9D 5C C8 9D y..Xu…...f...
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>next IV for MID 3698334349 => 16 bytes @ 0x29c52cc0
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>16: 21 CC 87 A1 !…
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>0: 13 3F 59 46 CD E8 8D C4 90 C4 CF 45 F7 7B 18 6A .?YF…....E.{.j
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>natd_hash => 20 bytes @ 0x288f4220
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>16: 21 CC 87 A1 !…
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>0: 13 3F 59 46 CD E8 8D C4 90 C4 CF 45 F7 7B 18 6A .?YF…....E.{.j
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>natd_hash => 20 bytes @ 0x288f4220
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>16: C0 A8 0A 8C 01 F4 …...
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>0: 76 F5 2A 36 4A CF BE 56 48 89 D8 53 79 59 FD 05 v.*6J..VH..SyY..
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>natd_chunk => 22 bytes @ 0xbeff3d70
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>16: C0 A8 0A 8C 01 F4 …...
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>0: 76 F5 2A 36 4A CF BE 56 48 89 D8 53 79 59 FD 05 v.*6J..VH..SyY..
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>natd_chunk => 22 bytes @ 0xbeff3d70
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>16: 32 67 7D 21 2g}!
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>0: 37 EB 39 57 FF 4D DB A5 B8 49 21 10 F0 99 47 F9 7.9W.M…I!...G.
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>HASH_R => 20 bytes @ 0x288f4220
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>16: 32 67 7D 21 2g}!
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>0: 37 EB 39 57 FF 4D DB A5 B8 49 21 10 F0 99 47 F9 7.9W.M…I!...G.
          Aug 6 19:46:47 charon: 11[IKE] <con2|3>HASH_R => 20 bytes @ 0x288f4220</con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3></con2|3>

          1 Reply Last reply Reply Quote 0
          • D
            dgwilson
            last edited by

            And more debug settings turned on…

            Invalid HASH_V1 payload length, description failed....
            could not decrypt payloads ...

            A problem with the IKEv1 decryption??????

            Aug 6 20:02:25 charon: 04[IKE] <con2|4>message parsing failed
            Aug 6 20:02:25 charon: 04[IKE] <con2|4>message parsing failed
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>could not decrypt payloads
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>could not decrypt payloads
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>invalid HASH_V1 payload length, decryption failed?
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>invalid HASH_V1 payload length, decryption failed?
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>32: 9F 20 CA 1E 76 43 21 1C F9 55 32 CA 7A 41 B9 06 . ..vC!..U2.zA..
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>16: B1 88 23 C1 87 78 7C 65 7D 48 18 28 B0 C5 F1 E3 ..#..x|e}H.(….
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>0: CD B2 1F 0E DA FC 34 8A 7D EF AE A9 87 55 3E 7E …...4.}....U>~
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>plain => 48 bytes @ 0x2a093160
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>32: 9F 20 CA 1E 76 43 21 1C F9 55 32 CA 7A 41 B9 06 . ..vC!..U2.zA..
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>16: B1 88 23 C1 87 78 7C 65 7D 48 18 28 B0 C5 F1 E3 ..#..x|e}H.(….
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>0: CD B2 1F 0E DA FC 34 8A 7D EF AE A9 87 55 3E 7E …...4.}....U>~
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>plain => 48 bytes @ 0x2a093160
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>32: 7E 9F 84 3A CA 15 B9 B0 9C F2 59 42 8C 89 8F 4F ~..:…...YB...O
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>16: BB E9 E4 BC 7B EF F4 9E 5E 85 28 EC A0 56 21 E8 ….{...^.(..V!.
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>0: F2 A5 D0 0C 60 E8 C7 2E FE 0F 52 33 53 D3 AC 1A …......R3S... Aug 6 20:02:25 charon: 04[ENC] <con2|4>encrypted => 48 bytes @ 0x2a093160 Aug 6 20:02:25 charon: 04[ENC] <con2|4>32: 7E 9F 84 3A CA 15 B9 B0 9C F2 59 42 8C 89 8F 4F ~..:…...YB...O Aug 6 20:02:25 charon: 04[ENC] <con2|4>16: BB E9 E4 BC 7B EF F4 9E 5E 85 28 EC A0 56 21 E8 ….{...^.(..V!. Aug 6 20:02:25 charon: 04[ENC] <con2|4>0: F2 A5 D0 0C 60 E8 C7 2E FE 0F 52 33 53 D3 AC 1A …......R3S...
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>encrypted => 48 bytes @ 0x2a093160
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>decrypting payloads:
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>decrypting payloads:
            Aug 6 20:02:25 charon: 04[IKE] <con2|4>0: C4 A3 00 AE 5C EE 73 4F D3 78 C4 62 79 3E 18 03 …..sO.x.by>..
            Aug 6 20:02:25 charon: 04[IKE] <con2|4>next IV for MID 3073414076 => 16 bytes @ 0x29c4e800
            Aug 6 20:02:25 charon: 04[IKE] <con2|4>0: C4 A3 00 AE 5C EE 73 4F D3 78 C4 62 79 3E 18 03 …..sO.x.by>..
            Aug 6 20:02:25 charon: 04[IKE] <con2|4>next IV for MID 3073414076 => 16 bytes @ 0x29c4e800
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>found an encrypted payload
            Aug 6 20:02:25 charon: 04[ENC] <con2|4>found an encrypted payload

            –------------------------------------------------------------------------------------------------------------------

            And more debug settings...
            IKEv1
            Authentication: Mutual PSK + Xauth
            Negotiation: Agressive

            --> invalid shared secret

            ... yes I'm trying to connect internally on the network to test. It's worked in the past.

            Aug 6 20:24:09 charon: 09[NET] <con2|1>sending packet: from 203.97.236.202[500] to 192.168.10.140[500] (432 bytes)
            Aug 6 20:24:09 charon: 09[IKE] <con2|1>sending retransmit 1 of response message ID 0, seq 1
            Aug 6 20:24:09 charon: 09[IKE] <con2|1>sending retransmit 1 of response message ID 0, seq 1
            Aug 6 20:24:05 charon: 09[IKE] <con2|1>INFORMATIONAL_V1 request with message ID 2747622485 processing failed
            Aug 6 20:24:05 charon: 09[IKE] <con2|1>INFORMATIONAL_V1 request with message ID 2747622485 processing failed
            Aug 6 20:24:05 charon: 09[IKE] <con2|1>ignore malformed INFORMATIONAL request
            Aug 6 20:24:05 charon: 09[IKE] <con2|1>ignore malformed INFORMATIONAL request
            Aug 6 20:24:05 charon: 09[IKE] <con2|1>message parsing failed
            Aug 6 20:24:05 charon: 09[IKE] <con2|1>message parsing failed
            Aug 6 20:24:05 charon: 09[ENC] <con2|1>could not decrypt payloads
            Aug 6 20:24:05 charon: 09[ENC] <con2|1>invalid HASH_V1 payload length, decryption failed?
            Aug 6 20:24:05 charon: 09[NET] <con2|1>received packet: from 192.168.10.140[4500] to 203.97.236.202[4500] (76 bytes)
            Aug 6 20:24:05 charon: 09[NET] <con2|1>sending packet: from 203.97.236.202[500] to 192.168.10.140[500] (432 bytes)
            Aug 6 20:24:05 charon: 09[ENC] <con2|1>generating AGGRESSIVE response 0 [ SA KE No ID NAT-D NAT-D HASH V V V V V ]
            Aug 6 20:24:05 charon: 09[CFG] <1> selected peer config "con2"
            Aug 6 20:24:05 charon: 09[CFG] <1> looking for XAuthInitPSK peer configs matching 203.97.236.202…192.168.10.140[dgw.kiwi]
            Aug 6 20:24:05 charon: 09[IKE] <1> 192.168.10.140 is initiating a Aggressive Mode IKE_SA
            Aug 6 20:24:05 charon: 09[IKE] <1> 192.168.10.140 is initiating a Aggressive Mode IKE_SA
            Aug 6 20:24:05 charon: 09[IKE] <1> received DPD vendor ID
            Aug 6 20:24:05 charon: 09[IKE] <1> received DPD vendor ID
            Aug 6 20:24:05 charon: 09[IKE] <1> received Cisco Unity vendor ID
            Aug 6 20:24:05 charon: 09[IKE] <1> received Cisco Unity vendor ID
            Aug 6 20:24:05 charon: 09[IKE] <1> received XAuth vendor ID
            Aug 6 20:24:05 charon: 09[IKE] <1> received XAuth vendor ID</con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4></con2|4>

            1 Reply Last reply Reply Quote 0
            • C
              cmb
              last edited by

              You have the client connecting to an IP or hostname?

              1 Reply Last reply Reply Quote 0
              • D
                dgwilson
                last edited by

                Client is connecting to an IP Address.

                Always has. Hmmm, recommended config change somewhere? Interesting.

                • David
                1 Reply Last reply Reply Quote 0
                • C
                  cmb
                  last edited by

                  Was curious if by FQDN, in case that made it not match ipsec.secrets for some reason.

                  Try changing your IP in ipsec.secrets to:

                  %any @dgw.kiwi : PSK ...

                  Then run 'ipsec stop && ipsec start' and try to connect again. If you have other connections you don't want to drop, just a 'ipsec rereadall' will suffice, a stop/start just makes really sure everything previous is cleared out, and any SAs are deleted.

                  If that doesn't work, try omitting the %any part in the above. If that doesn't work, take the leading part out entirely so you have something like:

                   : PSK ...

                  And let us know the results.

                  1 Reply Last reply Reply Quote 0
                  • D
                    dgwilson
                    last edited by

                    I changed ipsec.secrets to:
                    %any @dgw.kiwi : PSK 0<deleted>=
                    203.97.236.202 dgwilson : PSK 0<deleted>=

                    Initiated the stop and start… from the command line.
                    Received the same error... Shared Secret is incorrect.

                    I confirm that the contents of ipsec.secrets was correct before and after the connection.
                    Stopping and starting the service via the GUI causes ipsec.secrets to be re-created. (I suspect you knew that. :-) )

                    Aug 7 17:39:31 charon: 15[NET] <con2|1>sending packet: from 203.97.236.202[500] to 192.168.10.140[500] (432 bytes)
                    Aug 7 17:39:31 charon: 15[IKE] <con2|1>sending retransmit 1 of response message ID 0, seq 1
                    Aug 7 17:39:31 charon: 15[IKE] <con2|1>sending retransmit 1 of response message ID 0, seq 1
                    Aug 7 17:39:27 charon: 15[IKE] <con2|1>INFORMATIONAL_V1 request with message ID 3403150820 processing failed
                    Aug 7 17:39:27 charon: 15[IKE] <con2|1>INFORMATIONAL_V1 request with message ID 3403150820 processing failed
                    Aug 7 17:39:27 charon: 15[IKE] <con2|1>ignore malformed INFORMATIONAL request
                    Aug 7 17:39:27 charon: 15[IKE] <con2|1>ignore malformed INFORMATIONAL request
                    Aug 7 17:39:27 charon: 15[IKE] <con2|1>message parsing failed
                    Aug 7 17:39:27 charon: 15[IKE] <con2|1>message parsing failed
                    Aug 7 17:39:27 charon: 15[ENC] <con2|1>could not decrypt payloads
                    Aug 7 17:39:27 charon: 15[ENC] <con2|1>invalid HASH_V1 payload length, decryption failed?
                    Aug 7 17:39:27 charon: 15[NET] <con2|1>received packet: from 192.168.10.140[4500] to 203.97.236.202[4500] (76 bytes)
                    Aug 7 17:39:27 charon: 15[NET] <con2|1>sending packet: from 203.97.236.202[500] to 192.168.10.140[500] (432 bytes)
                    Aug 7 17:39:27 charon: 15[ENC] <con2|1>generating AGGRESSIVE response 0 [ SA KE No ID NAT-D NAT-D HASH V V V V V ]
                    Aug 7 17:39:27 charon: 15[CFG] <1> selected peer config "con2"
                    Aug 7 17:39:27 charon: 15[CFG] <1> looking for XAuthInitPSK peer configs matching 203.97.236.202…192.168.10.140[dgw.kiwi]
                    Aug 7 17:39:27 charon: 15[IKE] <1> 192.168.10.140 is initiating a Aggressive Mode IKE_SA
                    Aug 7 17:39:27 charon: 15[IKE] <1> 192.168.10.140 is initiating a Aggressive Mode IKE_SA
                    Aug 7 17:39:27 charon: 15[IKE] <1> received DPD vendor ID
                    Aug 7 17:39:27 charon: 15[IKE] <1> received DPD vendor ID
                    Aug 7 17:39:27 charon: 15[IKE] <1> received Cisco Unity vendor ID
                    Aug 7 17:39:27 charon: 15[IKE] <1> received Cisco Unity vendor ID
                    Aug 7 17:39:27 charon: 15[IKE] <1> received XAuth vendor ID
                    Aug 7 17:39:27 charon: 15[IKE] <1> received XAuth vendor ID
                    Aug 7 17:39:27 charon: 15[IKE] <1> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
                    Aug 7 17:39:27 charon: 15[IKE] <1> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID</con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></con2|1></deleted></deleted>

                    1 Reply Last reply Reply Quote 0
                    • D
                      dgwilson
                      last edited by

                      I have continued… removing the %any
                      ... that met with the same fate of Shared Secret is incorrect.

                      and continuing again to remove the dgw.kiwi so that I'm left with : PSK...

                      and... we have a connection! Success.

                      I'm happy to continue the playing and experimenting to assist with the fault diagnosis.
                      Let me know what you'd like me to do.

                      • David
                      1 Reply Last reply Reply Quote 0
                      • J
                        juniper80
                        last edited by

                        @dgwilson:

                        and continuing again to remove the dgw.kiwi so that I'm left with : PSK…

                        and... we have a connection! Success.

                        I had the same issue (Update from 2.1 -> 2.2.4, IPsec Phase1 keeps failing)

                        I can confirm, this worked for me as well….

                        woohoo!

                        1 Reply Last reply Reply Quote 0
                        • C
                          cmb
                          last edited by

                          @dgwilson:

                          Stopping and starting the service via the GUI causes ipsec.secrets to be re-created. (I suspect you knew that. :-) )

                          Yeah, I meant to run those commands from the shell, which won't regenerate the conf files.

                          @dgwilson:

                          and… we have a connection! Success.

                          Ok good, thanks for that. I'll check into that further to see what the difference is.

                          1 Reply Last reply Reply Quote 0
                          • C
                            cmb
                            last edited by

                            @juniper80:

                            I had the same issue (Update from 2.1 -> 2.2.4, IPsec Phase1 keeps failing)

                            I can confirm, this worked for me as well….

                            With iOS and/or OS X mobile clients?

                            1 Reply Last reply Reply Quote 0
                            • D
                              dgwilson
                              last edited by

                              I have tested on iOS as well.

                              The connection failed until I repeated the edits required on ipsec.secrets by making it look like…

                              : PSK ...

                              • David
                              1 Reply Last reply Reply Quote 0
                              • C
                                cvance
                                last edited by

                                Issue and solution confirmed. Thanks for all the help.

                                1 Reply Last reply Reply Quote 0
                                • J
                                  juniper80
                                  last edited by

                                  @cmb:

                                  @juniper80:

                                  I had the same issue (Update from 2.1 -> 2.2.4, IPsec Phase1 keeps failing)

                                  I can confirm, this worked for me as well….

                                  With iOS and/or OS X mobile clients?

                                  For me this solved the issue on Windows with Shrewsoft VPN Client.

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.