I'm trying to create policy-based VPN connection between Cisco 841 and Netscreen-GT5, but IKE Phase-1 protpcol is not finished at GT5 side.
GT5 log:
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ****** Recv kernel msg IDX-0, TYPE-5 ******
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ****** Recv kernel msg IDX-0, TYPE-5 ******
## 2018-01-12 17:35:58 : IKE<39.110.248.241> sa orig index<0>, peer_id<1>.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> isadb get entry by peer/local ip and port
## 2018-01-12 17:35:58 : IKE<39.110.248.241> create sa: 39.110.248.243->39.110.248.241
## 2018-01-12 17:35:58 : getProfileFromP1Proposal->
## 2018-01-12 17:35:58 : find profile[0]=<00000005 00000001 00000001 00000002> for p1 proposal (id 4), xauth(0)
## 2018-01-12 17:35:58 : init p1sa, pidt = 0x0
## 2018-01-12 17:35:58 : change peer identity for p1 sa, pidt = 0x0
## 2018-01-12 17:35:58 : IKE<0.0.0.0 > create peer identity 0828fa350
## 2018-01-12 17:35:58 : peer identity 28fa350 created.
## 2018-01-12 17:35:58 : IKE<0.0.0.0 > EDIPI disabled
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct ISAKMP header.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Msg header built (next payload #1)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct [SA] for ISAKMP
## 2018-01-12 17:35:58 : IKE<39.110.248.241> auth(1)<PRESHRD>, encr(5)<3DES>, hash(1)<MD5>, group(2)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> xauth attribute: disabled
## 2018-01-12 17:35:58 : IKE<39.110.248.241> lifetime/lifesize (28800/0)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct NetScreen [VID]
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct custom [VID]
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct custom [VID]
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Xmit : [SA] [VID] [VID] [VID]
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Initiator sending IPv4 IP 39.110.248.241/port 500
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Send Phase 1 packet (len=156)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Phase 2 task added
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ****** Recv kernel msg IDX-2, TYPE-5 ******
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ****** Recv kernel msg IDX-2, TYPE-5 ******
## 2018-01-12 17:35:58 : IKE<39.110.248.241> sa orig index<2>, peer_id<1>.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> isadb get entry by peer/local ip and port
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Added Phase 2 session tasks to the task list.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ike packet, len 108, action 0
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: received 80 bytes from socket.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ****** Recv packet if <untrust> of vsys <Root> ******
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: get 80 bytes. src port 500
## 2018-01-12 17:35:58 : IKE<0.0.0.0 > ISAKMP msg: len 80, nxp 1[SA], exch 2[MM], flag 00
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Recv : [SA]
## 2018-01-12 17:35:58 : IKE<0.0.0.0 > extract payload (52):
## 2018-01-12 17:35:58 : IKE<39.110.248.241> MM in state OAK_MM_NO_STATE.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [SA]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Proposal received: xauthflag 0
## 2018-01-12 17:35:58 : IKE<39.110.248.241> auth(1)<PRESHRD>, encr(5)<3DES>, hash(1)<MD5>, group(2)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> xauth attribute: disabled
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Phase 1 proposal [0] selected.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> SA Life Type = seconds
## 2018-01-12 17:35:58 : IKE<39.110.248.241> SA lifetime (TV) = 28800
## 2018-01-12 17:35:58 : IKE<0.0.0.0 > dh group 2
## 2018-01-12 17:35:58 : IKE<39.110.248.241> DH_BG_consume OK. p1 resp
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Phase 1 MM Initiator constructing 3rd message.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct ISAKMP header.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Msg header built (next payload #4)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct [KE] for ISAKMP
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct [NONCE]
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Xmit : [KE] [NONCE]
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Initiator sending IPv4 IP 39.110.248.241/port 500
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Send Phase 1 packet (len=184)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> IKE msg done: PKI state<0> IKE state<1/0007>
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: Error get ike packet from socket.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ike packet, len 284, action 0
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: received 256 bytes from socket.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ****** Recv packet if <untrust> of vsys <Root> ******
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: get 256 bytes. src port 500
## 2018-01-12 17:35:58 : IKE<0.0.0.0 > ISAKMP msg: len 256, nxp 4[KE], exch 2[MM], flag 00
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Recv : [KE] [NONCE] [VID] [VID] [VID] [VID]
## 2018-01-12 17:35:58 : IKE<0.0.0.0 > extract payload (228):
## 2018-01-12 17:35:58 : IKE<39.110.248.241> MM in state OAK_MM_SA_SETUP.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [VID]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Vendor ID:
## 2018-01-12 17:35:58 : 12 f5 f2 8c 45 71 68 a9 70 2d 9f e2 74 cc 01 00
## 2018-01-12 17:35:58 : IKE<39.110.248.241> rcv non-NAT-Traversal VID payload.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [VID]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Vendor ID:
## 2018-01-12 17:35:58 : af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [VID]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Vendor ID:
## 2018-01-12 17:35:58 : c8 6e 35 0f 10 16 73 f4 8b 70 42 e0 37 09 55 49
## 2018-01-12 17:35:58 : IKE<39.110.248.241> rcv non-NAT-Traversal VID payload.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [VID]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Vendor ID:
## 2018-01-12 17:35:58 : 09 00 26 89 df d6 b7 12
## 2018-01-12 17:35:58 : IKE<39.110.248.241> rcv XAUTH v6.0 vid
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [KE]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241> processing ISA_KE in phase 1.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [NONCE]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241> processing NONCE in phase 1.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> gen_skeyid()
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Phase 1 MM Initiator constructing 5th message.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct ISAKMP header.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Msg header built (next payload #5)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct [ID] for ISAKMP
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Construct [HASH]
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ID, len=8, type=1, pro=17, port=500,
## 2018-01-12 17:35:58 : IKE<39.110.248.241> addr=39.110.248.243
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Xmit*: [ID] [HASH]
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Encrypt P1 payload (len 60)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Initiator sending IPv4 IP 39.110.248.241/port 500
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Send Phase 1 packet (len=68)
## 2018-01-12 17:35:58 : IKE<39.110.248.241> IKE msg done: PKI state<0> IKE state<2/80180f>
## 2018-01-12 17:35:58 : IKE<0.0.0.128> Catcher: Error get ike packet from socket.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ike packet, len 96, action 0
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: received 68 bytes from socket.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ****** Recv packet if <untrust> of vsys <Root> ******
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: get 68 bytes. src port 500
## 2018-01-12 17:35:58 : IKE<0.0.0.0 > ISAKMP msg: len 68, nxp 5[ID], exch 2[MM], flag 01 E
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Decrypting payload (length 40)
## 2018-01-12 17:35:58 : IKE<39.110.248.241 > Recv*: [ID] [HASH]
## 2018-01-12 17:35:58 : IKE<0.0.0.0 > extract payload (40):
## 2018-01-12 17:35:58 : IKE<39.110.248.241> MM in state OAK_MM_KEY_EXCH.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Process [ID]:
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ID received: type=ID_IPV4_ADDR, ip = 39.110.248.241, port=500, protocol=17
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Received incorrect ID payload: ID type mismatch.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> ID processed. return 1. sa->p1_state = 2.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Error processing ID
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Phase 1: Main mode negotiations have failed.
## 2018-01-12 17:35:58 : IKE<39.110.248.241> IKE msg done: PKI state<0> IKE state<2/80180f>
## 2018-01-12 17:35:58 : IKE<39.110.248.241> Catcher: Error get ike packet from socket.
Cisco log:
Jan 12 08:30:41.459: ISAKMP-PAK: (0):received packet from 39.110.248.243 dport 500 sport 500 Global (N) NEW SA
Jan 12 08:30:41.459: ISAKMP: (0):Found a peer struct for 39.110.248.243, peer port 500
Jan 12 08:30:41.459: ISAKMP: (0):Locking peer struct 0x104CF314, refcount 74 for crypto_isakmp_process_block
Jan 12 08:30:41.459: ISAKMP: (0):local port 500, remote port 500
Jan 12 08:30:41.459: ISAKMP: (0):Find a dup sa in the avl tree during calling isadb_insert sa = 10502D08
Jan 12 08:30:41.459: ISAKMP: (0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Jan 12 08:30:41.459: ISAKMP: (0)
ld State = IKE_READY New State = IKE_R_MM1
Jan 12 08:30:41.459: ISAKMP: (0)
rocessing SA payload. message ID = 0
Jan 12 08:30:41.459: ISAKMP: (0)
rocessing vendor id payload
Jan 12 08:30:41.459: ISAKMP: (0):vendor ID seems Unity/DPD but major 19 mismatch
Jan 12 08:30:41.459: ISAKMP: (0)
rocessing vendor id payload
Jan 12 08:30:41.459: ISAKMP: (0):vendor ID is DPD
Jan 12 08:30:41.459: ISAKMP: (0)
rocessing vendor id payload
Jan 12 08:30:41.459: ISAKMP: (0)
rocessing IKE frag vendor id payload
Jan 12 08:30:41.459: ISAKMP: (0)
upport for IKE Fragmentation not enabled
Jan 12 08:30:41.459: ISAKMP: (0):found peer pre-shared key matching 39.110.248.243
Jan 12 08:30:41.459: ISAKMP: (0):local preshared key found
Jan 12 08:30:41.459: ISAKMP: (0)
canning profiles for xauth ...
Jan 12 08:30:41.459: ISAKMP: (0):Checking ISAKMP transform 1 against priority 1 policy
Jan 12 08:30:41.459: ISAKMP: (0): encryption 3DES-CBC
Jan 12 08:30:41.459: ISAKMP: (0): hash MD5
Jan 12 08:30:41.459: ISAKMP: (0): default group 2
Jan 12 08:30:41.459: ISAKMP: (0): auth pre-share
Jan 12 08:30:41.459: ISAKMP: (0): life type in seconds
Jan 12 08:30:41.459: ISAKMP: (0): life duration (basic) of 28800
Jan 12 08:30:41.459: ISAKMP: (0):atts are acceptable. Next payload is 0
Jan 12 08:30:41.459: ISAKMP: (0):Acceptable atts:actual life: 86400
Jan 12 08:30:41.459: ISAKMP: (0):Acceptable atts:life: 0
Jan 12 08:30:41.459: ISAKMP: (0):Basic life_in_seconds:28800
Jan 12 08:30:41.459: ISAKMP: (0):Returning Actual lifetime: 28800
Jan 12 08:30:41.459: ISAKMP: (0)
tarted lifetime timer: 28800.
Jan 12 08:30:41.459: ISAKMP: (0)
rocessing vendor id payload
Jan 12 08:30:41.459: ISAKMP: (0):vendor ID seems Unity/DPD but major 19 mismatch
Jan 12 08:30:41.459: ISAKMP: (0)
rocessing vendor id payload
Jan 12 08:30:41.459: ISAKMP: (0):vendor ID is DPD
Jan 12 08:30:41.459: ISAKMP: (0)
rocessing vendor id payload
Jan 12 08:30:41.463: ISAKMP: (0)
rocessing IKE frag vendor id payload
Jan 12 08:30:41.463: ISAKMP: (0)
upport for IKE Fragmentation not enabled
Jan 12 08:30:41.463: ISAKMP: (0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Jan 12 08:30:41.463: ISAKMP: (0)
ld State = IKE_R_MM1 New State = IKE_R_MM1
Jan 12 08:30:41.463: ISAKMP-PAK: (0):sending packet to 39.110.248.243 my_port 500 peer_port 500 (R) MM_SA_SETUP
Jan 12 08:30:41.463: ISAKMP: (0)
ending an IKE IPv4 Packet.
Jan 12 08:30:41.463: ISAKMP: (0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Jan 12 08:30:41.463: ISAKMP: (0)
ld State = IKE_R_MM1 New State = IKE_R_MM2
Jan 12 08:30:41.467: ISAKMP-PAK: (0):received packet from 39.110.248.243 dport 500 sport 500 Global (R) MM_SA_SETUP
Jan 12 08:30:41.467: ISAKMP: (0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Jan 12 08:30:41.467: ISAKMP: (0)
ld State = IKE_R_MM2 New State = IKE_R_MM3
Jan 12 08:30:41.467: ISAKMP: (0)
rocessing KE payload. message ID = 0
Jan 12 08:30:41.471: ISAKMP: (0)
rocessing NONCE payload. message ID = 0
Jan 12 08:30:41.471: ISAKMP: (0):found peer pre-shared key matching 39.110.248.243
Jan 12 08:30:41.471: ISAKMP: (2084):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Jan 12 08:30:41.471: ISAKMP: (2084)
ld State = IKE_R_MM3 New State = IKE_R_MM3
Jan 12 08:30:41.471: ISAKMP-PAK: (2084):sending packet to 39.110.248.243 my_port 500 peer_port 500 (R) MM_KEY_EXCH
Jan 12 08:30:41.471: ISAKMP: (2084)
ending an IKE IPv4 Packet.
Jan 12 08:30:41.471: ISAKMP: (2084):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Jan 12 08:30:41.471: ISAKMP: (2084)
ld State = IKE_R_MM3 New State = IKE_R_MM4
Jan 12 08:30:41.531: ISAKMP-PAK: (2084):received packet from 39.110.248.243 dport 500 sport 500 Global (R) MM_KEY_EXCH
Jan 12 08:30:41.531: ISAKMP: (2084):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Jan 12 08:30:41.531: ISAKMP: (2084)
ld State = IKE_R_MM4 New State = IKE_R_MM5
Jan 12 08:30:41.531: ISAKMP: (2084)
rocessing ID payload. message ID = 0
Jan 12 08:30:41.531: ISAKMP: (2084):ID payload
next-payload : 8
type : 1
Jan 12 08:30:41.531: ISAKMP: (2084): address : 39.110.248.243
Jan 12 08:30:41.531: ISAKMP: (2084): protocol : 17
port : 500
length : 12
Jan 12 08:30:41.531: ISAKMP: (0)
eer matches *none* of the profiles
Jan 12 08:30:41.531: ISAKMP: (2084)
rocessing HASH payload. message ID = 0
Jan 12 08:30:41.531: ISAKMP: (2084)
A authentication status:
authenticated
Jan 12 08:30:41.531: ISAKMP: (2084)
A has been authenticated with 39.110.248.243
Jan 12 08:30:41.531: ISAKMP: (2084):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Jan 12 08:30:41.531: ISAKMP: (2084)
ld State = IKE_R_MM5 New State = IKE_R_MM5
Jan 12 08:30:41.531: ISAKMP: (2084)
A is doing
Jan 12 08:30:41.531: ISAKMP: (2084)
re-shared key authentication using id type ID_IPV4_ADDR
Jan 12 08:30:41.531: ISAKMP: (2084):ID payload
next-payload : 8
type : 1
Jan 12 08:30:41.531: ISAKMP: (2084): address : 39.110.248.241
Jan 12 08:30:41.531: ISAKMP: (2084): protocol : 17
port : 500
length : 12
Jan 12 08:30:41.531: ISAKMP: (2084):Total payload length: 12
Jan 12 08:30:41.531: ISAKMP-PAK: (2084):sending packet to 39.110.248.243 my_port 500 peer_port 500 (R) MM_KEY_EXCH
Jan 12 08:30:41.531: ISAKMP: (2084)
ending an IKE IPv4 Packet.
Jan 12 08:30:41.531: ISAKMP: (2084):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Jan 12 08:30:41.531: ISAKMP: (2084)
ld State = IKE_R_MM5 New State = IKE_P1_COMPLETE
Jan 12 08:30:41.531: ISAKMP: (2084):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
Jan 12 08:30:41.531: ISAKMP: (2084)
ld State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE