opensuse13.1(i386) with openswan:
Configured and UP connect to the MS AZURE NetWork. OK
I can ping hosts from the our local lan all hosts in the Azure NetWork.
But:
1. from time to time i need stop and start ipsec ( connection UP, but ping - lost )
2. in the /var/log/messages i see to many this error records:
This is my config file:
Please, help me resolved problem with INVALID_PAYLOAD_TYPE
(
left - my local lan
right - azure network
)
Serg
Code:
ipsec01:~ # rpm -qa | grep -i openswanopenswan-2.6.41-62.1.i586I can ping hosts from the our local lan all hosts in the Azure NetWork.
But:
1. from time to time i need stop and start ipsec ( connection UP, but ping - lost )
2. in the /var/log/messages i see to many this error records:
Code:
2014-07-01T21:57:30.876903+03:00 ipsec01 pluto[11213]: "dntskazure/6x1" #1: received and ignored informational message2014-07-01T21:57:40.884153+03:00 ipsec01 pluto[11213]: "dntskazure/6x1" #16: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK to replace #15 {using isakmp#1 msgid:923de997 proposal=AES(12)_128-SHA1(2)_160 pfsgroup=no-pfs}
2014-07-01T21:57:40.885117+03:00 ipsec01 pluto[11213]: "dntskazure/5x1" #17: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK to replace #14 {using isakmp#1 msgid:32475da1 proposal=AES(12)_128-SHA1(2)_160 pfsgroup=no-pfs}
2014-07-01T21:57:40.885936+03:00 ipsec01 pluto[11213]: "dntskazure/4x1" #18: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK to replace #13 {using isakmp#1 msgid:ef66d0a2 proposal=AES(12)_128-SHA1(2)_160 pfsgroup=no-pfs}
2014-07-01T21:57:40.886510+03:00 ipsec01 pluto[11213]: "dntskazure/3x1" #19: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK to replace #12 {using isakmp#1 msgid:0664ae17 proposal=AES(12)_128-SHA1(2)_160 pfsgroup=no-pfs}
2014-07-01T21:57:40.955710+03:00 ipsec01 pluto[11213]: "dntskazure/6x1" #16: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2014-07-01T21:57:40.956043+03:00 ipsec01 pluto[11213]: "dntskazure/6x1" #16: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
2014-07-01T21:57:40.956305+03:00 ipsec01 pluto[11213]: "dntskazure/6x1" #16: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0x6ba60c66 <0xdb2fd03e xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}
2014-07-01T21:57:40.957202+03:00 ipsec01 pluto[11213]: "dntskazure/5x1" #17: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2014-07-01T21:57:40.957566+03:00 ipsec01 pluto[11213]: "dntskazure/5x1" #17: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
2014-07-01T21:57:40.957863+03:00 ipsec01 pluto[11213]: "dntskazure/5x1" #17: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xd230daa8 <0x3bc31329 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}
2014-07-01T21:57:40.958111+03:00 ipsec01 pluto[11213]: "dntskazure/4x1" #18: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2014-07-01T21:57:40.958353+03:00 ipsec01 pluto[11213]: "dntskazure/4x1" #18: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
2014-07-01T21:57:40.958601+03:00 ipsec01 pluto[11213]: "dntskazure/4x1" #18: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xeeaed1ee <0x4ff317b8 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}
2014-07-01T21:57:40.958840+03:00 ipsec01 pluto[11213]: "dntskazure/3x1" #19: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2014-07-01T21:57:40.959112+03:00 ipsec01 pluto[11213]: "dntskazure/3x1" #19: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
2014-07-01T21:57:40.959359+03:00 ipsec01 pluto[11213]: "dntskazure/3x1" #19: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xe5366f6c <0xf7e1e956 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}
2014-07-01T21:57:41.027503+03:00 ipsec01 pluto[11213]: "dntskazure/6x1" #16: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2014-07-01T21:57:41.028226+03:00 ipsec01 pluto[11213]: "dntskazure/6x1" #16: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_HASH)
2014-07-01T21:57:41.028847+03:00 ipsec01 pluto[11213]: "dntskazure/6x1" #16: sending encrypted notification INVALID_PAYLOAD_TYPE to 23.100.62.146:500
2014-07-01T21:57:41.029467+03:00 ipsec01 pluto[11213]: "dntskazure/5x1" #17: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2014-07-01T21:57:41.030160+03:00 ipsec01 pluto[11213]: "dntskazure/5x1" #17: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_HASH)
2014-07-01T21:57:41.030725+03:00 ipsec01 pluto[11213]: "dntskazure/5x1" #17: sending encrypted notification INVALID_PAYLOAD_TYPE to 23.100.62.146:500
2014-07-01T21:57:41.031259+03:00 ipsec01 pluto[11213]: "dntskazure/4x1" #18: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2014-07-01T21:57:41.031795+03:00 ipsec01 pluto[11213]: "dntskazure/4x1" #18: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_HASH)
2014-07-01T21:57:41.032335+03:00 ipsec01 pluto[11213]: "dntskazure/4x1" #18: sending encrypted notification INVALID_PAYLOAD_TYPE to 23.100.62.146:500
2014-07-01T21:57:41.032749+03:00 ipsec01 pluto[11213]: "dntskazure/3x1" #19: IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag
2014-07-01T21:57:41.032919+03:00 ipsec01 pluto[11213]: "dntskazure/3x1" #19: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_HASH)
2014-07-01T21:57:41.033067+03:00 ipsec01 pluto[11213]: "dntskazure/3x1" #19: sending encrypted notification INVALID_PAYLOAD_TYPE to 23.100.62.146:500
ipsec01:~ #Code:
ipsec01:~ # cat /etc/ipsec.conf
version 2.0 # conforms to second version of ipsec.conf specification
# basic configuration
config setup
dumpdir=/var/run/pluto/
nat_traversal=yes
virtual_private=%v4:172.16.0.0/16,%v4:172.17.0.0/16,%v4:192.168.0.0/16,%v4:10.8.0.0/24,%v4:10.0.2.0/24,%v4:10.4.0.0/16
oe=off
protostack=auto
# default settings for connections
conn %default
leftrsasigkey=%cert
rightrsasigkey=%cert
conn dntskazure
authby=secret
auto=start
type=tunnel
left=92.242.127.22
leftsubnets={172.16.0.0/16,172.17.0.0/16,192.168.0.0/16,10.8.0.0/24,10.0.2.0/24,10.4.0.0/16}
right=23.100.62.146
rightsubnets={172.18.1.0/24}
ike=aes128-sha1-modp1024
esp=aes128-sha1
pfs=no
ikelifetime=8h
keylife=1h
ipsec01:~ #Please, help me resolved problem with INVALID_PAYLOAD_TYPE
(
left - my local lan
right - azure network
)
Serg