Quantcast
Channel: All ScreenOS Firewalls (NOT SRX) posts
Viewing all articles
Browse latest Browse all 2577

Site-to-site policy-based VPN between Juniper GT5 and Cisco 841

$
0
0

I'm trying to create policy-based VPN connection between Cisco 841 and Netscreen-GT5, but IKE Phase-1 protpcol is not finished at GT5 side.

 

GT5 log:

## 2018-01-12 17:35:58 : IKE<39.110.248.241> ****** Recv kernel msg IDX-0, TYPE-5 ******
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ****** Recv kernel msg IDX-0, TYPE-5 ******
## 2018-01-12 17:35:58 : IKE<39.110.248.241> sa orig index<0>, peer_id<1>.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> isadb get entry by peer/local ip and port
## 2018-01-12 17:35:58 : IKE<39.110.248.241>   create sa: 39.110.248.243->39.110.248.241
## 2018-01-12 17:35:58 : getProfileFromP1Proposal->
## 2018-01-12 17:35:58 : find profile[0]=<00000005 00000001 00000001 00000002> for p1 proposal (id 4), xauth(0)
## 2018-01-12 17:35:58 : init p1sa, pidt = 0x0
## 2018-01-12 17:35:58 : change peer identity for p1 sa, pidt = 0x0
## 2018-01-12 17:35:58 : IKE<0.0.0.0        >   create peer identity 0828fa350
## 2018-01-12 17:35:58 : peer identity 28fa350 created.
## 2018-01-12 17:35:58 : IKE<0.0.0.0        >   EDIPI disabled
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct ISAKMP header.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Msg header built (next payload #1)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct [SA] for ISAKMP
## 2018-01-12 17:35:58 : IKE<39.110.248.241> auth(1)<PRESHRD>, encr(5)<3DES>, hash(1)<MD5>, group(2)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> xauth attribute: disabled
## 2018-01-12 17:35:58 : IKE<39.110.248.241> lifetime/lifesize (28800/0)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct NetScreen [VID]
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct custom [VID]
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct custom [VID]
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Xmit : [SA] [VID] [VID] [VID]
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Initiator sending IPv4 IP 39.110.248.241/port 500
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Send Phase 1 packet (len=156)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Phase 2 task added
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ****** Recv kernel msg IDX-2, TYPE-5 ******
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ****** Recv kernel msg IDX-2, TYPE-5 ******
## 2018-01-12 17:35:58 : IKE<39.110.248.241> sa orig index<2>, peer_id<1>.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> isadb get entry by peer/local ip and port
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Added Phase 2 session tasks to the task list.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ike packet, len 108, action 0
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: received 80 bytes from socket.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ****** Recv packet if <untrust> of vsys <Root> ******
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: get 80 bytes. src port 500
## 2018-01-12 17:35:58 : IKE<0.0.0.0        >   ISAKMP msg: len 80, nxp 1[SA], exch 2[MM], flag 00
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Recv : [SA]
## 2018-01-12 17:35:58 : IKE<0.0.0.0        >   extract payload (52):
## 2018-01-12 17:35:58 : IKE<39.110.248.241> MM in state OAK_MM_NO_STATE.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [SA]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Proposal received: xauthflag 0
## 2018-01-12 17:35:58 : IKE<39.110.248.241> auth(1)<PRESHRD>, encr(5)<3DES>, hash(1)<MD5>, group(2)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> xauth attribute: disabled
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Phase 1 proposal [0] selected.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> SA Life Type = seconds
## 2018-01-12 17:35:58 : IKE<39.110.248.241> SA lifetime (TV) = 28800
## 2018-01-12 17:35:58 : IKE<0.0.0.0        >     dh group 2
## 2018-01-12 17:35:58 : IKE<39.110.248.241> DH_BG_consume OK. p1 resp
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Phase 1 MM Initiator constructing 3rd message.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct ISAKMP header.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Msg header built (next payload #4)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct [KE] for ISAKMP
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct [NONCE]
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Xmit : [KE] [NONCE]
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Initiator sending IPv4 IP 39.110.248.241/port 500
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Send Phase 1 packet (len=184)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> IKE msg done: PKI state<0> IKE state<1/0007>
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: Error get ike packet from socket.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ike packet, len 284, action 0
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: received 256 bytes from socket.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ****** Recv packet if <untrust> of vsys <Root> ******
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: get 256 bytes. src port 500
## 2018-01-12 17:35:58 : IKE<0.0.0.0        >   ISAKMP msg: len 256, nxp 4[KE], exch 2[MM], flag 00
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Recv : [KE] [NONCE] [VID] [VID] [VID] [VID]
## 2018-01-12 17:35:58 : IKE<0.0.0.0        >   extract payload (228):
## 2018-01-12 17:35:58 : IKE<39.110.248.241> MM in state OAK_MM_SA_SETUP.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [VID]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241 >   Vendor ID:
## 2018-01-12 17:35:58 : 12 f5 f2 8c 45 71 68 a9  70 2d 9f e2 74 cc 01 00
## 2018-01-12 17:35:58 : IKE<39.110.248.241> rcv non-NAT-Traversal VID payload.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [VID]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241 >   Vendor ID:
## 2018-01-12 17:35:58 : af ca d7 13 68 a1 f1 c9  6b 86 96 fc 77 57 01 00
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [VID]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241 >   Vendor ID:
## 2018-01-12 17:35:58 : c8 6e 35 0f 10 16 73 f4  8b 70 42 e0 37 09 55 49
## 2018-01-12 17:35:58 : IKE<39.110.248.241> rcv non-NAT-Traversal VID payload.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [VID]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241 >   Vendor ID:
## 2018-01-12 17:35:58 : 09 00 26 89 df d6 b7 12
## 2018-01-12 17:35:58 : IKE<39.110.248.241> rcv XAUTH v6.0 vid
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [KE]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241> processing ISA_KE in phase 1.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [NONCE]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241> processing NONCE in phase 1.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> gen_skeyid()
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Phase 1 MM Initiator constructing 5th message.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct ISAKMP header.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Msg header built (next payload #5)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct [ID] for ISAKMP
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct [HASH]
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ID, len=8, type=1, pro=17, port=500,
## 2018-01-12 17:35:58 : IKE<39.110.248.241> addr=39.110.248.243
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Xmit*: [ID] [HASH]
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Encrypt P1 payload (len 60)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Initiator sending IPv4 IP 39.110.248.241/port 500
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Send Phase 1 packet (len=68)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> IKE msg done: PKI state<0> IKE state<2/80180f>
## 2018-01-12 17:35:58 : IKE<0.0.0.128> Catcher: Error get ike packet from socket.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ike packet, len 96, action 0
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: received 68 bytes from socket.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ****** Recv packet if <untrust> of vsys <Root> ******
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: get 68 bytes. src port 500
## 2018-01-12 17:35:58 : IKE<0.0.0.0        >   ISAKMP msg: len 68, nxp 5[ID], exch 2[MM], flag 01  E
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Decrypting payload (length 40)
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Recv*: [ID] [HASH]
## 2018-01-12 17:35:58 : IKE<0.0.0.0        >   extract payload (40):
## 2018-01-12 17:35:58 : IKE<39.110.248.241> MM in state OAK_MM_KEY_EXCH.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [ID]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ID received: type=ID_IPV4_ADDR, ip = 39.110.248.241, port=500, protocol=17
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Received incorrect ID payload: ID type mismatch.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ID processed. return 1. sa->p1_state = 2.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Error processing ID
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Phase 1: Main mode negotiations have failed.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> IKE msg done: PKI state<0> IKE state<2/80180f>
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: Error get ike packet from socket.

 

Cisco log:

Jan 12 08:30:41.459: ISAKMP-PAK: (0):received packet from 39.110.248.243 dport 500 sport 500 Global (N) NEW SA
Jan 12 08:30:41.459: ISAKMP: (0):Found a peer struct for 39.110.248.243, peer port 500
Jan 12 08:30:41.459: ISAKMP: (0):Locking peer struct 0x104CF314, refcount 74 for crypto_isakmp_process_block
Jan 12 08:30:41.459: ISAKMP: (0):local port 500, remote port 500
Jan 12 08:30:41.459: ISAKMP: (0):Find a dup sa in the avl tree during calling isadb_insert sa = 10502D08
Jan 12 08:30:41.459: ISAKMP: (0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Jan 12 08:30:41.459: ISAKMP: (0)Smiley Surprisedld State = IKE_READY  New State = IKE_R_MM1

Jan 12 08:30:41.459: ISAKMP: (0)Smiley Tonguerocessing SA payload. message ID = 0
Jan 12 08:30:41.459: ISAKMP: (0)Smiley Tonguerocessing vendor id payload
Jan 12 08:30:41.459: ISAKMP: (0):vendor ID seems Unity/DPD but major 19 mismatch
Jan 12 08:30:41.459: ISAKMP: (0)Smiley Tonguerocessing vendor id payload
Jan 12 08:30:41.459: ISAKMP: (0):vendor ID is DPD
Jan 12 08:30:41.459: ISAKMP: (0)Smiley Tonguerocessing vendor id payload
Jan 12 08:30:41.459: ISAKMP: (0)Smiley Tonguerocessing IKE frag vendor id payload
Jan 12 08:30:41.459: ISAKMP: (0)Smiley Frustratedupport for IKE Fragmentation not enabled
Jan 12 08:30:41.459: ISAKMP: (0):found peer pre-shared key matching 39.110.248.243
Jan 12 08:30:41.459: ISAKMP: (0):local preshared key found
Jan 12 08:30:41.459: ISAKMP: (0)Smiley Frustratedcanning profiles for xauth ...
Jan 12 08:30:41.459: ISAKMP: (0):Checking ISAKMP transform 1 against priority 1 policy
Jan 12 08:30:41.459: ISAKMP: (0):      encryption 3DES-CBC
Jan 12 08:30:41.459: ISAKMP: (0):      hash MD5
Jan 12 08:30:41.459: ISAKMP: (0):      default group 2
Jan 12 08:30:41.459: ISAKMP: (0):      auth pre-share
Jan 12 08:30:41.459: ISAKMP: (0):      life type in seconds
Jan 12 08:30:41.459: ISAKMP: (0):      life duration (basic) of 28800
Jan 12 08:30:41.459: ISAKMP: (0):atts are acceptable. Next payload is 0
Jan 12 08:30:41.459: ISAKMP: (0):Acceptable atts:actual life: 86400
Jan 12 08:30:41.459: ISAKMP: (0):Acceptable atts:life: 0
Jan 12 08:30:41.459: ISAKMP: (0):Basic life_in_seconds:28800
Jan 12 08:30:41.459: ISAKMP: (0):Returning Actual lifetime: 28800
Jan 12 08:30:41.459: ISAKMP: (0)Smiley Frustratedtarted lifetime timer: 28800.

Jan 12 08:30:41.459: ISAKMP: (0)Smiley Tonguerocessing vendor id payload
Jan 12 08:30:41.459: ISAKMP: (0):vendor ID seems Unity/DPD but major 19 mismatch
Jan 12 08:30:41.459: ISAKMP: (0)Smiley Tonguerocessing vendor id payload
Jan 12 08:30:41.459: ISAKMP: (0):vendor ID is DPD
Jan 12 08:30:41.459: ISAKMP: (0)Smiley Tonguerocessing vendor id payload
Jan 12 08:30:41.463: ISAKMP: (0)Smiley Tonguerocessing IKE frag vendor id payload
Jan 12 08:30:41.463: ISAKMP: (0)Smiley Frustratedupport for IKE Fragmentation not enabled
Jan 12 08:30:41.463: ISAKMP: (0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Jan 12 08:30:41.463: ISAKMP: (0)Smiley Surprisedld State = IKE_R_MM1  New State = IKE_R_MM1

Jan 12 08:30:41.463: ISAKMP-PAK: (0):sending packet to 39.110.248.243 my_port 500 peer_port 500 (R) MM_SA_SETUP
Jan 12 08:30:41.463: ISAKMP: (0)Smiley Frustratedending an IKE IPv4 Packet.
Jan 12 08:30:41.463: ISAKMP: (0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Jan 12 08:30:41.463: ISAKMP: (0)Smiley Surprisedld State = IKE_R_MM1  New State = IKE_R_MM2

Jan 12 08:30:41.467: ISAKMP-PAK: (0):received packet from 39.110.248.243 dport 500 sport 500 Global (R) MM_SA_SETUP
Jan 12 08:30:41.467: ISAKMP: (0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Jan 12 08:30:41.467: ISAKMP: (0)Smiley Surprisedld State = IKE_R_MM2  New State = IKE_R_MM3

Jan 12 08:30:41.467: ISAKMP: (0)Smiley Tonguerocessing KE payload. message ID = 0
Jan 12 08:30:41.471: ISAKMP: (0)Smiley Tonguerocessing NONCE payload. message ID = 0
Jan 12 08:30:41.471: ISAKMP: (0):found peer pre-shared key matching 39.110.248.243
Jan 12 08:30:41.471: ISAKMP: (2084):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Jan 12 08:30:41.471: ISAKMP: (2084)Smiley Surprisedld State = IKE_R_MM3  New State = IKE_R_MM3

Jan 12 08:30:41.471: ISAKMP-PAK: (2084):sending packet to 39.110.248.243 my_port 500 peer_port 500 (R) MM_KEY_EXCH
Jan 12 08:30:41.471: ISAKMP: (2084)Smiley Frustratedending an IKE IPv4 Packet.
Jan 12 08:30:41.471: ISAKMP: (2084):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Jan 12 08:30:41.471: ISAKMP: (2084)Smiley Surprisedld State = IKE_R_MM3  New State = IKE_R_MM4

Jan 12 08:30:41.531: ISAKMP-PAK: (2084):received packet from 39.110.248.243 dport 500 sport 500 Global (R) MM_KEY_EXCH
Jan 12 08:30:41.531: ISAKMP: (2084):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Jan 12 08:30:41.531: ISAKMP: (2084)Smiley Surprisedld State = IKE_R_MM4  New State = IKE_R_MM5

Jan 12 08:30:41.531: ISAKMP: (2084)Smiley Tonguerocessing ID payload. message ID = 0
Jan 12 08:30:41.531: ISAKMP: (2084):ID payload
    next-payload : 8
    type         : 1
Jan 12 08:30:41.531: ISAKMP: (2084):    address      : 39.110.248.243
Jan 12 08:30:41.531: ISAKMP: (2084):    protocol     : 17
    port         : 500
    length       : 12
Jan 12 08:30:41.531: ISAKMP: (0)Smiley Tongueeer matches *none* of the profiles
Jan 12 08:30:41.531: ISAKMP: (2084)Smiley Tonguerocessing HASH payload. message ID = 0
Jan 12 08:30:41.531: ISAKMP: (2084)Smiley FrustratedA authentication status:
    authenticated
Jan 12 08:30:41.531: ISAKMP: (2084)Smiley FrustratedA has been authenticated with 39.110.248.243
Jan 12 08:30:41.531: ISAKMP: (2084):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Jan 12 08:30:41.531: ISAKMP: (2084)Smiley Surprisedld State = IKE_R_MM5  New State = IKE_R_MM5

Jan 12 08:30:41.531: ISAKMP: (2084)Smiley FrustratedA is doing
Jan 12 08:30:41.531: ISAKMP: (2084)Smiley Tonguere-shared key authentication using id type ID_IPV4_ADDR
Jan 12 08:30:41.531: ISAKMP: (2084):ID payload
    next-payload : 8
    type         : 1
Jan 12 08:30:41.531: ISAKMP: (2084):    address      : 39.110.248.241
Jan 12 08:30:41.531: ISAKMP: (2084):    protocol     : 17
    port         : 500
    length       : 12
Jan 12 08:30:41.531: ISAKMP: (2084):Total payload length: 12
Jan 12 08:30:41.531: ISAKMP-PAK: (2084):sending packet to 39.110.248.243 my_port 500 peer_port 500 (R) MM_KEY_EXCH
Jan 12 08:30:41.531: ISAKMP: (2084)Smiley Frustratedending an IKE IPv4 Packet.
Jan 12 08:30:41.531: ISAKMP: (2084):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Jan 12 08:30:41.531: ISAKMP: (2084)Smiley Surprisedld State = IKE_R_MM5  New State = IKE_P1_COMPLETE

Jan 12 08:30:41.531: ISAKMP: (2084):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
Jan 12 08:30:41.531: ISAKMP: (2084)Smiley Surprisedld State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE

 


Viewing all articles
Browse latest Browse all 2577

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>