IPsec VPN Main Mode IKEv1 – SysLog-Analyse

Eine Standortvernetzung per IPsec ist eine sicherer Möglichkeit unterschiedliche IP-Adressbereiche miteinander zu verbinden.

Bei der Einrichtung eines solchen VPN-Tunnels ist es zwingend notwendig, dass beide VPN-Partner (VPN-Server und VPN-Client) mit zueinander passenden Einstellungen arbeiten.

Stimmen die Parameter einer Seite nicht mit der anderen Seite überein, so findet kein Verbindungsaufbau statt oder Routingprobleme sind die Folge.

Insbesondere dann, wenn einer der beiden Partner kein DrayTek-Router ist und sich somit die Konfigurationsmöglichkeiten, -oberflächen und Begriffe unterscheiden, ist es hilfreich zu wissen wo man in einem DrayTek-Router nachschauen kann, um herauszufinden woran die IPsec-VPN-Verbindung scheitert.

Wie jeder anständige Router besitzen auch die DrayTek-Modelle eine Log-Funktion – das SysLog.
Dieses finden Sie im Routermenü unter Diagnostics >> Syslog Explorer. Wahlweise kann dieses auch mit dem Menü System Maintenance >> SysLog/ Mail Alert auf einem Syslog-Server geschrieben werden.
Hier können Sie sich die Logeinträge zu den verschiedenen Funktionen des Routers anzeigen lassen. So natürlich auch alles zum Thema VPN.

In dem folgenden Dokument zeigen wir Ihnen wie ein funktionierender Verbindungsaufbau im Log auszusehen hat und welche VPN-Einstellungen Sie sich anschauen sollten, wenn eine Einwahl nicht zustande kommt.

Der IPsec Main Mode Verbindungsaufbau besteht aus 2 Phasen.
Die Phase 1 dient der Erstellung der IKE-SA und die Phase 2 der Erstellung der IPsec-SA.

Die Phase 1 beinhaltet, in der Regel, 6 Nachrichten, die Phase 2, 3 Nachrichten. Nachfolgend mit I (=Initiator) und R (=Responder) gekennzeichnet.

IPsec-Verbindungsaufbau IPsec-Verbindungsaufbau IPsec-Verbindungsaufbau IPsec-Verbindungsaufbau

Main I1 / Main R1:
Dient zur Aushandlung der Authentifikationsmethode (PSK oder RSA),
dem Hash-Algorithmus (MD5, SHA1, SHA2), dem Verschlüsselungsalgorithmus (DES, 3DES, AES), der SA Key Lifetime und DPD (Dead Peer Detection).
Wobei der Initiator die Werte vorschlägt und der Responder nur akzeptiert oder ablehnt.

Main I2 / Main R2:
Dient dem Austausch der DH-Gruppe und des Schlüssels und der Erstellung des Master-Schlüssels.

Main I3 / Main R3:
Dient zur gegenseitigen Authentifizierung

Quick I1/ Quick R1:
Dient zur Aushandlung des IPsec-Protokolls (AH, ESP), dem Hash-Algorithmus (MD5, SHA1, SHA2), PFS (Perfect Forward Secret) und der Network-IDs (Subnetze).

Aufbau:

Aufbau Aufbau Aufbau Aufbau

Beispiele für einen fehlgeschlagenen Verbindungsaufbau:

#1 Phase 1 Proposal stimmen nicht überein

0:00:28 Dialing Node1 (2865) : 80.74.28.65
00:00:28 Initiating IKE Main Mode to 80.74.28.65
00:00:28 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] Initiating IKE Main Mode
00:00:28 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
00:00:40 [IPSEC][L2L][1:2865][@80.74.28.65] IKE link timeout: state linking

00:33:15 IKE [lt]==, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
00:33:15 Responding to Main Mode from 80.74.28.62
00:33:15 Matching General Setup key for dynamic ip client...
00:33:15 IPsec Security Level[Medium]: Ignore Phase1 SA proposals of DES/3DES/MD5/DH G1 G2/
00:33:15 [IPSEC/IKE][Local][34:-][@80.74.28.62] state transition fail: STATE_MAIN_R0

Folgende Parameter sollten im VPN-Client kontrolliert werden:

  • Phase 1 Proposal
Phase 1 Proposal Phase 1 Proposal Phase 1 Proposal Phase 1 Proposal

#2 IP oder Hostname des VPN-Servers im VPN-Client ist nicht korrekt oder der IPsec-VPN-Dienst im VPN-Server ist nicht eingeschaltet

00:27:00 DrayTek Dialing Node1 (2865) : 80.74.28.56
00:27:00 DrayTek Initiating IKE Main Mode to 80.74.28.56
00:27:00 DrayTek [IPSEC/IKE][L2L][1:2865][@80.74.28.56] Initiating IKE Main Mode
00:27:00 DrayTek IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
00:27:12 DrayTek [IPSEC][L2L][1:2865][@80.74.28.56] IKE link timeout: state linking

Keine Einträge beim VPN-Server.

Folgende Parameter sollten im VPN-Client kontrolliert werden:

  • Die IP oder den Hostnamen des VPN-Servers
IP VPN-Server. IP VPN-Server. IP VPN-Server. IP VPN-Server.

Ist diese vorgenommene Einstellung korrekt und Sie erhalten dennoch die gezeigte Log-Meldung, dann sollten Sie sich unbedingt auch die Hardware vor dem VPN-Server anschauen. Eventuell wurde dort vergessen die erforderlichen VPN-Ports weiterzuleiten bzw. etwaige eigene VPN-Dienste zu deaktivieren.

VPN-Server

  • Die VPN-Dienste
Client - VPN services Client - VPN services Client - VPN services Client - VPN services

#3 Die Ausgehende WAN-Schnittstelle ist nicht korrekt

00:34:28 DrayTek [IPSEC][L2L][1:2865][@0.0.0.0] network error

Keine Einträge auf dem VPN-Server.

Folgende Einstellung sollte im VPN-Client kontrolliert werden:

  • Die ausgehende WAN-Schnittstelle
VPN WAN Port VPN WAN Port VPN WAN Port VPN WAN Port

#4 Der Pre-Shared Key ist nicht korrekt

01:47:40 Dialing Node1 (2865) : 80.74.28.65
01:47:40 Initiating IKE Main Mode to 80.74.28.65
01:47:40 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] Initiating IKE Main Mode
01:47:40 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
01:47:40 IKE [lt]==, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
01:47:40 Accept Phase1 proposals : ENCR OAKLEY_AES_CBC, HASH OAKLEY_SHA
01:47:40 IKE ==>, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
01:47:40 IKE [lt]==, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
01:47:40 NAT-Traversal: Using RFC 3947, no NAT detected
01:47:40 IKE ==>, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
01:47:43 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] duplicate packet(3), stuck at state? STATE_MAIN_I3
01:47:49 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] duplicate packet(3), stuck at state? STATE_MAIN_I3
01:47:52 [IPSEC][L2L][1:2865][@80.74.28.65] IKE link timeout: state linking

02:11:54 IKE [lt]==, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
02:11:54 Responding to Main Mode from 80.74.28.62
02:11:54 Matching General Setup key for dynamic ip client...
02:11:54 Find Phase1 proposal: SHA2_256
02:11:54 Matching General Setup key for dynamic ip client...
02:11:54 Accept Phase1 proposals : ENCR OAKLEY_AES_CBC, HASH OAKLEY_SHA
02:11:54 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
02:11:54 IKE [lt]==, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
02:11:54 NAT-Traversal: Using RFC 3947, no NAT detected
02:11:54 Matching General Setup key for dynamic ip client...
02:11:54 IKE ==>, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
02:11:54 Phase error : next payload type of ISAKMP Identification Payload has an unknown value: 171
02:11:54 [IPSEC/IKE][Local][34:-][@80.74.28.62] smalformed payload: probable authentication (preshared secret) failure:

Folgende Einstellung sollte im VPN-Client kontrolliert werden:

  • IPsec Pre-Shared Key

VPN-Client

Client - PSK Client - PSK Client - PSK Client - PSK

VPN-Server

Server - PSK Server - PSK Server - PSK Server - PSK

#5 Das Entfernte Subnetz im VPN Client ist nicht korrekt

18:56:50 Dialing Node1 (2865) : 80.74.28.65
18:56:50 Initiating IKE Main Mode to 80.74.28.65
18:56:50 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] Initiating IKE Main Mode
18:56:50 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
18:56:50 IKE [lt]==, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
18:56:50 Accept Phase1 proposals : ENCR OAKLEY_AES_CBC, HASH OAKLEY_SHA
18:56:50 IKE ==>, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
18:56:50 IKE [lt]==, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
18:56:50 NAT-Traversal: Using RFC 3947, no NAT detected
18:56:50 IKE ==>, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
18:56:50 IKE [lt]==, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
18:56:50 ISAKMP SA #7553 will be replaced after 20700 seconds
18:56:50 #7553 ISAKMP SA established with 80.74.28.65. In/Out Index: 0/-1
18:56:50 Start IKE Quick Mode to 80.74.28.65
18:56:50 IKE ==>, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x20, Message ID = 0x5cd302e3
18:56:50 Client L2L remote network setting is 192.168.56.0/24
18:56:50 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] quick_outI1: match network
18:56:50 IKE [lt]==, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x5, Message ID = 0xc9b672a6
18:56:50 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] delete_state: IKE ISAKMP info. (protected)
18:57:02 [IPSEC][L2L][1:2865][@80.74.28.65] IKE link timeout: state linking

17:56:20 IKE [lt]==, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
17:56:20 Responding to Main Mode from 80.74.28.62
17:56:20 Matching General Setup key for dynamic ip client...
17:56:20 Find Phase1 proposal: SHA2_256
17:56:20 Matching General Setup key for dynamic ip client...
17:56:20 Accept Phase1 proposals : ENCR OAKLEY_AES_CBC, HASH OAKLEY_SHA
17:56:20 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
17:56:20 IKE [lt]==, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
17:56:20 NAT-Traversal: Using RFC 3947, no NAT detected
17:56:20 Matching General Setup key for dynamic ip client...
17:56:20 IKE ==>, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
17:56:20 IKE [lt]==, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
17:56:20 IKE ==>, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
17:56:20 sent MR3, ISAKMP SA established with 80.74.28.62. In/Out Index: 34/0
17:56:20 IKE [lt]==, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x20, Message ID = 0x94695619
17:56:20 Receive client L2L remote network setting is 192.168.56.0/24
17:56:20 [IPSEC/IKE][Local][34:-][@80.74.28.62] quick_inI1_outR1: match network
17:56:20 [IPsec dial-in] Client subnet 192.168.1.0/24 match VPN[0] remote subnet setting.
17:56:20 Client L2L remote network setting 192.168.56.0/24 do not match VPN local subnet setting 192.168.65.0/24 ,Reject!!!
17:56:20 [IPSEC/IKE][Local][34:-][@80.74.28.62] subnet match fail
17:56:20 [IPSEC/IKE][Local][34:-][@80.74.28.62] subnet match fail
17:56:20 Parse phase2 SA proposals failed
17:56:20 IKE ==>, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x5, Message ID = 0x146cfe5b
17:56:20 [IPSEC/IKE][Local][34:-][@80.74.28.62] state transition fail: STATE_QUICK_R0
17:56:20 [IPSEC/IKE][Local][34:-][@80.74.28.62] may be security method/subnet setting/GRE setting unmatched?

Folgende Einstellung sollte im VPN-Client kontrolliert werden:

  • Die Adressangabe des Ziel-Subnetzes
Client - Remote IP Client - Remote IP Client - Remote IP Client - Remote IP

#6 Das lokale Subnetz im VPN-Server ist nicht korrekt

19:21:28 Dialing Node1 (2865) : 80.74.28.65
19:21:28 Initiating IKE Main Mode to 80.74.28.65
19:21:28 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] Initiating IKE Main Mode
19:21:28 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:21:28 IKE [lt]==, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:21:28 Accept Phase1 proposals : ENCR OAKLEY_AES_CBC, HASH OAKLEY_SHA
19:21:28 IKE ==>, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:21:28 IKE [lt]==, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:21:28 NAT-Traversal: Using RFC 3947, no NAT detected
19:21:28 IKE ==>, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:21:28 IKE [lt]==, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:21:28 ISAKMP SA #7737 will be replaced after 18000 seconds
19:21:28 #7737 ISAKMP SA established with 80.74.28.65. In/Out Index: 0/-1
19:21:28 Start IKE Quick Mode to 80.74.28.65
19:21:28 IKE ==>, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x20, Message ID = 0xeafea8ce
19:21:28 Client L2L remote network setting is 192.168.65.0/24
19:21:28 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] quick_outI1: match network
19:21:28 IKE [lt]==, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x5, Message ID = 0x987f7e6a
19:21:28 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] delete_state: IKE ISAKMP info. (protected)
19:21:40 [IPSEC][L2L][1:2865][@80.74.28.65] IKE link timeout: state linking

19:12:49 IKE [lt]==, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:12:49 Responding to Main Mode from 80.74.28.62
19:12:49 Matching General Setup key for dynamic ip client...
19:12:49 Find Phase1 proposal: SHA2_256
19:12:49 Matching General Setup key for dynamic ip client...
19:12:49 Accept Phase1 proposals : ENCR OAKLEY_AES_CBC, HASH OAKLEY_SHA
19:12:49 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:12:49 IKE [lt]==, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:12:49 NAT-Traversal: Using RFC 3947, no NAT detected
19:12:49 Matching General Setup key for dynamic ip client...
19:12:49 IKE ==>, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:12:49 IKE [lt]==, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:12:49 IKE ==>, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:12:49 sent MR3, ISAKMP SA established with 80.74.28.62. In/Out Index: 34/0
19:12:49 IKE [lt]==, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x20, Message ID = 0x4c440e54
19:12:49 Receive client L2L remote network setting is 192.168.65.0/24
19:12:49 [IPSEC/IKE][Local][34:-][@80.74.28.62] quick_inI1_outR1: match network
19:12:49 [IPsec dial-in] Client subnet 192.168.1.0/24 match VPN[0] remote subnet setting.
19:12:49 Client L2L remote network setting 192.168.65.0/24 do not match VPN local subnet setting 192.168.56.0/24 ,Reject!!!
19:12:49 [IPSEC/IKE][Local][34:-][@80.74.28.62] subnet match fail
19:12:49 [IPSEC/IKE][Local][34:-][@80.74.28.62] subnet match fail
19:12:49 Parse phase2 SA proposals failed
19:12:49 IKE ==>, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x5, Message ID = 0x6c550465
19:12:49 [IPSEC/IKE][Local][34:-][@80.74.28.62] state transition fail: STATE_QUICK_R0
19:12:49 [IPSEC/IKE][Local][34:-][@80.74.28.62] may be security method/subnet setting/GRE setting unmatched?

Folgende Einstellung sollte im VPN-Server kontrolliert werden:

  • Die Adressangabe des lokalen Subnetzes
Server - Remote IP Server - Remote IP Server - Remote IP Server - Remote IP

#7 Das lokale Subnetz im VPN-Client ist nicht korrekt

19:30:48 Dialing Node1 (2865) : 80.74.28.65
19:30:48 Initiating IKE Main Mode to 80.74.28.65
19:30:48 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] Initiating IKE Main Mode
19:30:48 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:30:48 IKE [lt]==, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:30:48 Accept Phase1 proposals : ENCR OAKLEY_AES_CBC, HASH OAKLEY_SHA
19:30:48 IKE ==>, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:30:48 IKE [lt]==, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:30:48 NAT-Traversal: Using RFC 3947, no NAT detected
19:30:48 IKE ==>, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:30:48 IKE [lt]==, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:30:48 ISAKMP SA #7807 will be replaced after 21375 seconds
19:30:48 #7807 ISAKMP SA established with 80.74.28.65. In/Out Index: 0/-1
19:30:48 Start IKE Quick Mode to 80.74.28.65
19:30:48 IKE ==>, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x20, Message ID = 0xac951b85
19:30:48 Client L2L remote network setting is 192.168.65.0/24
19:30:48 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] quick_outI1: match network
19:30:48 IKE [lt]==, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x5, Message ID = 0x51764906
19:30:48 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] delete_state: IKE ISAKMP info. (protected)
19:31:00 [IPSEC][L2L][1:2865][@80.74.28.65] IKE link timeout: state linking

19:22:11 IKE [lt]==, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:22:11 Responding to Main Mode from 80.74.28.62
19:22:11 Matching General Setup key for dynamic ip client...
19:22:11 Find Phase1 proposal: SHA2_256
19:22:11 Matching General Setup key for dynamic ip client...
19:22:11 Accept Phase1 proposals : ENCR OAKLEY_AES_CBC, HASH OAKLEY_SHA
19:22:11 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:22:11 IKE [lt]==, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:22:11 NAT-Traversal: Using RFC 3947, no NAT detected
19:22:11 Matching General Setup key for dynamic ip client...
19:22:11 IKE ==>, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:22:11 IKE [lt]==, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:22:11 IKE ==>, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:22:11 sent MR3, ISAKMP SA established with 80.74.28.62. In/Out Index: 34/0
19:22:11 IKE [lt]==, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x20, Message ID = 0x615920a9
19:22:11 Receive client L2L remote network setting is 192.168.65.0/24
19:22:11 [IPSEC/IKE][Local][34:-][@80.74.28.62] quick_inI1_outR1: match network
19:22:11 [IPsec dial-in] Client subnet 192.168.11.0/255.255.255.0 match failed.
19:22:11 Parse phase2 SA proposals failed
19:22:11 IKE ==>, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x5, Message ID = 0x1d053877
19:22:11 [IPSEC/IKE][Local][34:-][@80.74.28.62] state transition fail: STATE_QUICK_R0
19:22:11 [IPSEC/IKE][Local][34:-][@80.74.28.62] may be security method/subnet setting/GRE setting unmatched?


Folgende Einstellung sollte im VPN-Client kontrolliert werden:

  • Die Adressangabe der lokalen IP
Client - Local IP Client - Local IP Client - Local IP Client - Local IP

#8 Das Entfernte Subnetz im VPN-Server ist nicht korrekt

19:36:14 Dialing Node1 (2865) : 80.74.28.65
19:36:14 Initiating IKE Main Mode to 80.74.28.65
19:36:14 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] Initiating IKE Main Mode
19:36:14 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:36:14 IKE [lt]==, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:36:14 Accept Phase1 proposals : ENCR OAKLEY_AES_CBC, HASH OAKLEY_SHA
19:36:14 IKE ==>, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:36:14 IKE [lt]==, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:36:14 NAT-Traversal: Using RFC 3947, no NAT detected
19:36:14 IKE ==>, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:36:14 IKE [lt]==, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:36:14 ISAKMP SA #7846 will be replaced after 21375 seconds
19:36:14 Start IKE Quick Mode to 80.74.28.65
19:36:14 IKE ==>, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x20, Message ID = 0x187dda6d
19:36:14 Client L2L remote network setting is 192.168.65.0/24
19:36:14 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] quick_outI1: match network
19:36:14 IKE [lt]==, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x5, Message ID = 0x96ac27a
19:36:14 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] delete_state: IKE ISAKMP info. (protected)
19:36:26 [IPSEC][L2L][1:2865][@80.74.28.65] IKE link timeout: state linking

19:27:41 IKE [lt]==, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:27:41 Responding to Main Mode from 80.74.28.62
19:27:41 Matching General Setup key for dynamic ip client...
19:27:41 Find Phase1 proposal: SHA2_256
19:27:41 Matching General Setup key for dynamic ip client...
19:27:41 Accept Phase1 proposals : ENCR OAKLEY_AES_CBC, HASH OAKLEY_SHA
19:27:41 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:27:41 IKE [lt]==, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:27:41 NAT-Traversal: Using RFC 3947, no NAT detected
19:27:41 Matching General Setup key for dynamic ip client...
19:27:41 IKE ==>, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:27:41 IKE [lt]==, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:27:41 IKE ==>, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:27:41 sent MR3, ISAKMP SA established with 80.74.28.62. In/Out Index: 34/0
19:27:41 IKE [lt]==, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x20, Message ID = 0x19a44aa
19:27:41 Receive client L2L remote network setting is 192.168.65.0/24
19:27:41 [IPSEC/IKE][Local][34:-][@80.74.28.62] quick_inI1_outR1: match network
19:27:41 [IPsec dial-in] Client subnet 192.168.1.0/255.255.255.0 match failed.
19:27:41 Parse phase2 SA proposals failed
19:27:41 IKE ==>, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x5, Message ID = 0x31e609f6
19:27:41 [IPSEC/IKE][Local][34:-][@80.74.28.62] state transition fail: STATE_QUICK_R0
19:27:41 [IPSEC/IKE][Local][34:-][@80.74.28.62] may be security method/subnet setting/GRE setting unmatched?


Folgende Einstellung sollte im VPN-Server kontrolliert werden:

  • Die Adressangabe der lokalen IP
Server - Local IP-2 Server - Local IP-2 Server - Local IP-2 Server - Local IP-2

IPsec Main Mode mit fester Client-IP

#9 Die Angabe der öffentlichen IP des VPN-Clients ist nicht korrekt

19:49:42 Dialing Node1 (2865) : 80.74.28.65
19:49:42 Initiating IKE Main Mode to 80.74.28.65
19:49:42 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] Initiating IKE Main Mode
19:49:42 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:49:42 IKE [lt]==, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:49:42 Accept Phase1 proposals : ENCR OAKLEY_AES_CBC, HASH OAKLEY_SHA
19:49:42 IKE ==>, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:49:42 IKE [lt]==, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:49:42 NAT-Traversal: Using RFC 3947, no NAT detected
19:49:42 IKE ==>, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:49:42 IKE [lt]==, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:49:42 ISAKMP SA #7931 will be replaced after 19800 seconds
19:49:42 #7931 ISAKMP SA established with 80.74.28.65. In/Out Index: 0/-1
19:49:42 Start IKE Quick Mode to 80.74.28.65
19:49:42 IKE ==>, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x20, Message ID = 0xf563bb53
19:49:42 Client L2L remote network setting is 192.168.65.0/24
19:49:42 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] quick_outI1: match network
19:49:42 IKE [lt]==, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x5, Message ID = 0x6d4234bc
19:49:42 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] delete_state: IKE ISAKMP info. (protected)
19:49:54 [IPSEC][L2L][1:2865][@80.74.28.65] IKE link timeout: state linking

02:16:05 Responding to Main Mode from 80.74.28.62
02:16:05 Matching General Setup key for dynamic ip client...
02:16:05 Accept Phase1 proposals : ENCR OAKLEY_DES_CBC, HASH OAKLEY_MD5
02:16:05 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
02:16:05 IKE [lt]==, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
02:16:05 NAT-Traversal: Using RFC 3947, no NAT detected
02:16:05 Matching General Setup key for dynamic ip client...
02:16:05 IKE ==>, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
02:16:05 Phase error : next payload type of ISAKMP Identification Payload has an unknown value: 74
02:16:05 [IPSEC/IKE][Local][34:-][@80.74.28.62] smalformed payload: probable authentication (preshared secret) failure:


Folgende Einstellung sollten im VPN-Server kontrolliert werden:

  • Die Adressangabe des VPN-Clients
^
Server - Specify IP Server - Specify IP Server - Specify IP Server - Specify IP

#10 Die IPsec Security Method ist nicht korrekt

19:49:42 Dialing Node1 (2865) : 80.74.28.65
19:49:42 Initiating IKE Main Mode to 80.74.28.65
19:49:42 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] Initiating IKE Main Mode
19:49:42 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:49:42 IKE [lt]==, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
19:49:42 Accept Phase1 proposals : ENCR OAKLEY_AES_CBC, HASH OAKLEY_SHA
19:49:42 IKE ==>, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:49:42 IKE [lt]==, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
19:49:42 NAT-Traversal: Using RFC 3947, no NAT detected
19:49:42 IKE ==>, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:49:42 IKE [lt]==, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
19:49:42 ISAKMP SA #7931 will be replaced after 19800 seconds
19:49:42 #7931 ISAKMP SA established with 80.74.28.65. In/Out Index: 0/-1
19:49:42 Start IKE Quick Mode to 80.74.28.65
19:49:42 IKE ==>, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x20, Message ID = 0xf563bb53
19:49:42 Client L2L remote network setting is 192.168.65.0/24
19:49:42 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] quick_outI1: match network
19:49:42 IKE [lt]==, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x5, Message ID = 0x6d4234bc
19:49:42 [IPSEC/IKE][L2L][1:2865][@80.74.28.65] delete_state: IKE ISAKMP info. (protected)
19:49:54 [IPSEC][L2L][1:2865][@80.74.28.65] IKE link timeout: state linking

18:26:09 Responding to Main Mode from 80.74.28.62
18:26:09 Accept Phase1 proposals : ENCR OAKLEY_3DES_CBC, HASH OAKLEY_SHA2_256
14:26:09 IKE ==>, Next Payload=ISAKMP_NEXT_SA, Exchange Type = 0x2, Message ID = 0x0
18:26:09 IKE [lt]==, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
18:26:09 NAT-Traversal: Using RFC 3947, no NAT detected#
18:26:09 IKE ==>, Next Payload=ISAKMP_NEXT_KE, Exchange Type = 0x2, Message ID = 0x0
18:26:09 IKE [lt]==, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
18:26:09 IKE ==>, Next Payload=ISAKMP_NEXT_ID, Exchange Type = 0x2, Message ID = 0x0
18:26:09 #4136 sent MR3, ISAKMP SA established with 80.74.28.26. In/Out Index: -5/0
18:26:09 IKE [lt]==, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x20, Message ID = 0x7432a400
18:26:09 IKE ==>, Next Payload=ISAKMP_NEXT_HASH, Exchange Type = 0x5, Message ID = 0x1927a629
18:26:09 [IPSEC/IKE][L2L][5:2862][@80.74.28.62] state transition fail: STATE_QUICK_R0
18:26:09 [IPSEC/IKE][L2L][5:2862][@80.74.28.62] may be security method/subnet setting/GRE setting unmatched?


Folgende Einstellung sollten im VPN-Server kontrolliert werden:

  • Die IPsec Security Method
Server - Sec Method. Server - Sec Method. Server - Sec Method. Server - Sec Method.

VPN-Client

Client - Sec Method Client - Sec Method Client - Sec Method Client - Sec Method

#11 Der IPsec-VPN-Dienst des VPN-Clients ist nicht eingeschaltet

00:03:20 Dialing Node1 (2865) : 80.74.28.65
00:03:32 [IPSEC][L2L][1:2865][@80.74.28.65] IKE link timeout: state linking

Keine Einträge auf dem VPN-Server.

Folgende Einstellung sollte im VPN-Client kontrolliert werden:

  • Die VPN-Dienste
Client - VPN services Client - VPN services Client - VPN services Client - VPN services