Einfache Anleitung zur VPN-Einrichtung zwischen Windows XP-Rechner und Intranator

[j.krischik]

Das habe ich jetzt gemacht und eine virtuelle IP vergeben (192.168.100.10) Tunnel kommt leider immer noch nicht zu Stande die Intranator log meldet jetzt folgendes:
Nov 8 17:21:11 intranator pluto[2781]: packet from 80.187.99.129:54240: received Vendor ID payload [XAUTH]
Nov 8 17:21:11 intranator pluto[2781]: packet from 80.187.99.129:54240: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
Nov 8 17:21:11 intranator pluto[2781]: packet from 80.187.99.129:54240: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
Nov 8 17:21:11 intranator pluto[2781]: packet from 80.187.99.129:54240: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
Nov 8 17:21:11 intranator pluto[2781]: packet from 80.187.99.129:54240: received Vendor ID payload [RFC 3947]
Nov 8 17:21:11 intranator pluto[2781]: packet from 80.187.99.129:54240: received Vendor ID payload [Dead Peer Detection]
Nov 8 17:21:11 intranator pluto[2781]: packet from 80.187.99.129:54240: ignoring Vendor ID payload [NCP Client]
Nov 8 17:21:11 intranator pluto[2781]: packet from 80.187.99.129:54240: ignoring Vendor ID payload [c61baca1f1a60cc11500000000000000]
Nov 8 17:21:11 intranator pluto[2781]: packet from 80.187.99.129:54240: ignoring Vendor ID payload [FRAGMENTATION c0000000]
Nov 8 17:21:11 intranator pluto[2781]: packet from 80.187.99.129:54240: ignoring Vendor ID payload [Cisco-Unity]
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:54240 #303: responding to Main Mode from unknown peer 80.187.99.129:54240
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:54240 #303: Oakley Transform [AES_CBC (256), HMAC_SHA1, MODP_1024] refused due to strict flag
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:54240 #303: Oakley Transform [AES_CBC (256), HMAC_MD5, MODP_1024] refused due to strict flag
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:54240 #303: Oakley Transform [AES_CBC (256), HMAC_SHA1, MODP_1536] refused due to strict flag
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:54240 #303: Oakley Transform [AES_CBC (256), HMAC_MD5, MODP_1536] refused due to strict flag
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:54240 #303: NAT-Traversal: Result using RFC 3947: peer is NATed
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:54240 #303: ignoring informational payload, type IPSEC_INITIAL_CONTACT
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:54240 #303: Peer ID is ID_DER_ASN1_DN: 'C=de, ST=nrw, L=duisburg, O=FBW Duisburg, OU=EDV, CN=joerg krischik, E=j.krischik@fbw-duisburg.de'
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:54240 #303: issuer cacert not found
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:54240 #303: X.509 certificate rejected
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:54240 #303: we have a cert and are sending it
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: sent MR3, ISAKMP SA established
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: sending ModeCfg set
Nov 8 17:21:11 intranator pluto[2781]: acquired new lease for address 192.168.100.10 in pool 'P192.168.100.10'
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: assigning virtual IP 192.168.100.10 to peer
Nov 8 17:21:11 intranator pluto[2781]: packet from 80.187.99.129:12792: ModeCfg message is for a non-existent (expired?) ISAKMP SA
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: parsing ModeCfg ack
Nov 8 17:21:11 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: received ModeCfg ack, established
Nov 8 17:21:12 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: cannot respond to IPsec SA request because no connection is known for 192.168.100.0/24===62.54.164.190:4500[C=de, CN=intranator-fbw, E=info@fbw-duisburg.de]...80.187.99.129:12792[C=de, ST=nrw, L=duisburg, O=FBW Duisburg, OU=EDV, CN=joerg krischik, E=j.krischik@fbw-duisburg.de]===192.168.100.10/32
Nov 8 17:21:12 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: sending encrypted notification INVALID_ID_INFORMATION to 80.187.99.129:12792
Nov 8 17:21:16 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: parsing ModeCfg request
Nov 8 17:21:16 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: unknown attribute type (20002)
Nov 8 17:21:16 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: unknown attribute type (20003)
Nov 8 17:21:16 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: unknown attribute type (20004)
Nov 8 17:21:16 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: unknown attribute type (20005)
Nov 8 17:21:16 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: peer requested virtual IP %any
Nov 8 17:21:16 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: assigning virtual IP 192.168.100.10 to peer
Nov 8 17:21:16 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: sending ModeCfg reply
Nov 8 17:21:16 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: sent ModeCfg reply, established
Nov 8 17:21:16 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: cannot respond to IPsec SA request because no connection is known for 192.168.100.0/24===62.54.164.190:4500[C=de, CN=intranator-fbw, E=info@fbw-duisburg.de]...80.187.99.129:12792[C=de, ST=nrw, L=duisburg, O=FBW Duisburg, OU=EDV, CN=joerg krischik, E=j.krischik@fbw-duisburg.de]===192.168.100.10/32
Nov 8 17:21:16 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: sending encrypted notification INVALID_ID_INFORMATION to 80.187.99.129:12792
Nov 8 17:21:22 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xc243bfe0 (perhaps this is a duplicated packet)
Nov 8 17:21:22 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: sending encrypted notification INVALID_MESSAGE_ID to 80.187.99.129:12792
Nov 8 17:21:28 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xc243bfe0 (perhaps this is a duplicated packet)
Nov 8 17:21:28 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: sending encrypted notification INVALID_MESSAGE_ID to 80.187.99.129:12792
Nov 8 17:21:34 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xc243bfe0 (perhaps this is a duplicated packet)
Nov 8 17:21:34 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: sending encrypted notification INVALID_MESSAGE_ID to 80.187.99.129:12792
Nov 8 17:21:36 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792 #303: received Delete SA payload: deleting ISAKMP State #303
Nov 8 17:21:36 intranator pluto[2781]: "C6"[1] 80.187.99.129:12792: deleting connection "C6" instance with peer 80.187.99.129 {isakmp=#0/ipsec=#0}

Immerhin kommt man jetzt schon bis zur Phase 2!

Gruß Jörg Krischik

[Gerd von Egidy]

Hallo,

cannot respond to IPsec SA request because no connection is known for 192.168.100.0/24===62.54.164.190:4500[C=de, CN=intranator-fbw, E=info@fbw-duisburg.de]...80.187.99.129:12792[C=de, ST=nrw, L=duisburg, O=FBW Duisburg, OU=EDV, CN=joerg krischik, E=j.krischik@fbw-duisburg.de]===192.168.100.10/32

Der Client versucht jetzt, einen Tunnel in das Netz 192.168.100.0/24 aufzubauen (IP ganz links). Dabei will er eine eigene virtuelle IP 192.168.100.10 (ganz rechts) verwenden.

Das kann so nicht funktionieren, Virtuelle IP und Zielnetz müssen aus unterschiedlichen Netzen stammen.

Was haben Sie denn auf dem Intranator als lokales Netz eingestellt? Genau dieses Netz müssen Sie auch im NCP-Client im Menü "Split Tunneling" hinterlegen.

Ansonsten werden sich Intranator und Client nicht über die Tunnel einig und die Verbindung kommt nicht zustande.

Herzliche Grüße,

v. Egidy

[j.krischik]

Daran hat es gelegen, ich hatte da aus welchen Gründen auch immer drei verschiedene Netze eingetragen, habe die beiden falschen gelöscht und schon wird der Tunnel problemlos aufgebaut.
Vielen Dank für die wie immer prompte Hilfe!

Gruß Jörg Krischik