Re: isakmpd INVALID_PAYLOAD_TYPE

[Philipp Buehler <lists_(_at_)_fips_(_dot_)_de>]

Angelos D. Keromytis wrote Cc misc_(_at_)_openbsd_(_dot_)_org:
> >Hm. Or some other point missed in the automated keying?
> No, I mean you haven't configured correctly isakmpd on the two gateways (or
> hosts).
Ok, here are the two configs:
Additional comment: the 172.1x.1/24 are aliases to lo0, maybe
this is the/a problem ?

Host A:
[Phase 1]
192.168.1.58=          testbox
[Phase 2]
Connections=            VIVA-FIPS
[testbox]
Phase=                  1
Transport=              udp
Address=                192.168.1.58
Configuration=          Default-main-mode
Authentication=         XXXdeleted
[VIVA-FIPS]
Phase=                  2
ISAKMP-peer=            testbox
Configuration=          Default-quick-mode
Local-ID=               viva-cgn-internal
Remote-ID=              testbox-internal
[viva-cgn-internal]
ID-type=                IPV4_ADDR_SUBNET
Network=                172.16.1.0
Netmask=                255.255.255.0
[testbox-internal]
ID-type=                IPV4_ADDR_SUBNET
Network=                172.17.1.0
Netmask=                255.255.255.0
[Default-main-mode]
DOI=                    IPSEC
EXCHANGE_TYPE=          ID_PROT
Transforms=             3DES-SHA
[Default-quick-mode]
DOI=                    IPSEC
EXCHANGE_TYPE=          QUICK_MODE
Suites=                 QM-ESP-3DES-SHA-SUITE

Host B:
[Phase 1]
192.168.1.54=          fw-cgn
[Phase 2]
Connections=            VIVA-FIPS
[fw-cgn]
Phase=                  1
Transport=              udp
Address=                192.168.1.54
Configuration=          Default-main-mode
Authentication=         XXXdeleted
[VIVA-FIPS]
Phase=                  2
ISAKMP-peer=            fw-cgn
Configuration=          Default-quick-mode
Local-ID=               testbox-internal
Remote-ID=              viva-cgn-internal
[viva-cgn-internal]
ID-type=                IPV4_ADDR_SUBNET
Network=                172.16.1.0
Netmask=                255.255.255.0
[testbox-internal]
ID-type=                IPV4_ADDR_SUBNET
Network=                172.17.1.0
Netmask=                255.255.255.0
[Default-main-mode]
DOI=                    IPSEC
EXCHANGE_TYPE=          ID_PROT
Transforms=             3DES-SHA
[Default-quick-mode]
DOI=                    IPSEC
EXCHANGE_TYPE=          QUICK_MODE
Suites=                 QM-ESP-3DES-SHA-SUITE


-- 
Philipp Buehler, aka fIpS | sysfive.com GmbH | BOfH | NUCH | <double-p> 

%SYSTEM-F-TOOEARLY, please contact your sysadmin at a sensible time.
Artificial Intelligence stands no chance against Natural Stupidity.