I try to setup an Ipsec vpn between and Draytek 2960 and my own ER-lite.
But I can't get it running. My own config is:
vpn {
ipsec {
auto-firewall-nat-exclude disable
}
esp-group FOO1 {
proposal 1 {
encryption aes128
hash sha1
}
}
ike-group FOO1 {
proposal 1 {
dh-group 2
encryption aes128
hash sha1
}
}
site-to-site {
peer friendip {
authentication {
mode pre-shared-secret
pre-shared-secret ****************
}
connection-type initiate
description Martijn
ike-group FOO1
local-address myownip
tunnel 1 {
esp-group FOO1
local {
prefix 172.20.92.0/24
}
remote {
prefix 172.16.4.0/24
}
}
}
}
}
The other side (draytek)
When I do a swanctl --log i get the following errors:
05[ENC] generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
05[NET] sending packet: from myownip[500] to friendip[500] (236 bytes)
16[NET] received packet: from friendip[500] to myownip[500] (60 bytes)
16[ENC] invalid ID_V1 payload length, decryption failed?
16[ENC] could not decrypt payloads
16[IKE] message parsing failed
16[ENC] generating INFORMATIONAL_V1 request 3437709852 [ HASH N(PLD_MAL) ]
16[NET] sending packet: from myownip[500] to friendip[500] (76 bytes)
16[IKE] ID_PROT request with message ID 0 processing failed
15[NET] received packet: from friendip[500] to myownip[500] (40 bytes)
15[ENC] parsed INFORMATIONAL_V1 request 1737192136 [ N(PLD_MAL) ]
15[ENC] ignoring unprotected INFORMATIONAL from friendip
15[IKE] message verification failed
15[IKE] ignore malformed INFORMATIONAL request
15[IKE] INFORMATIONAL_V1 request with message ID 1737192136 processing failed
11[JOB] deleting half open IKE_SA after timeout
03[NET] received packet: from friendip[500] to myownip[500] (60 bytes)
03[ENC] invalid ID_V1 payload length, decryption failed?
03[ENC] could not decrypt payloads
03[IKE] message parsing failed
03[ENC] generating INFORMATIONAL_V1 request 1731319519 [ HASH N(PLD_MAL) ]
03[NET] sending packet: from myownip[500] to friendip[500] (76 bytes)
03[IKE] ID_PROT request with message ID 0 processing failed
09[NET] received packet: from friendip[500] to myownip[500] (40 bytes)
09[ENC] parsed INFORMATIONAL_V1 request 1755395298 [ N(PLD_MAL) ]
09[ENC] ignoring unprotected INFORMATIONAL from friendip
09[IKE] message verification failed
09[IKE] ignore malformed INFORMATIONAL request
09[IKE] INFORMATIONAL_V1 request with message ID 1755395298 processing failed
04[NET] received packet: from friendip[500] to myownip[500] (60 bytes)
04[ENC] invalid ID_V1 payload length, decryption failed?
04[ENC] could not decrypt payloads
04[IKE] message parsing failed
04[ENC] generating INFORMATIONAL_V1 request 1155512890 [ HASH N(PLD_MAL) ]
04[NET] sending packet: from myownip[500] to friendip[500] (76 bytes)
04[IKE] ID_PROT request with message ID 0 processing failed
05[NET] received packet: from friendip[500] to myownip[500] (40 bytes)
05[ENC] parsed INFORMATIONAL_V1 request 512819685 [ N(PLD_MAL) ]
05[ENC] ignoring unprotected INFORMATIONAL from friendip
05[IKE] message verification failed
05[IKE] ignore malformed INFORMATIONAL request
05[IKE] INFORMATIONAL_V1 request with message ID 512819685 processing failed
03[JOB] deleting half open IKE_SA after timeout
09[NET] received packet: from friendip[500] to myownip[500] (292 bytes)
09[ENC] parsed ID_PROT request 0 [ SA V V V V V V V ]
09[ENC] received unknown vendor ID: 4f:45:7d:78:54:60:50:75:7b:70:72:45
09[IKE] received DPD vendor ID
09[IKE] received NAT-T (RFC 3947) vendor ID
09[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID
09[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID
09[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
09[IKE] received draft-ietf-ipsec-nat-t-ike-00 vendor ID
09[IKE] friendip is initiating a Main Mode IKE_SA
09[ENC] generating ID_PROT response 0 [ SA V V V ]
09[NET] sending packet: from myownip[500] to friendip[500] (136 bytes)
07[NET] received packet: from friendip[500] to myownip[500] (220 bytes)
07[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
07[ENC] generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
07[NET] sending packet: from myownip[500] to friendip[500] (236 bytes)
14[NET] received packet: from friendip[500] to myownip[500] (60 bytes)
14[ENC] invalid ID_V1 payload length, decryption failed?
14[ENC] could not decrypt payloads
14[IKE] message parsing failed
14[ENC] generating INFORMATIONAL_V1 request 3088244074 [ HASH N(PLD_MAL) ]
14[NET] sending packet: from myownip[500] to friendip[500] (76 bytes)
14[IKE] ID_PROT request with message ID 0 processing failed
09[NET] received packet: from friendip[500] to myownip[500] (40 bytes)
09[ENC] parsed INFORMATIONAL_V1 request 2803791549 [ N(PLD_MAL) ]
09[ENC] ignoring unprotected INFORMATIONAL from friendip
09[IKE] message verification failed
09[IKE] ignore malformed INFORMATIONAL request
I doublechecked the psk and everything seems fine so does anybody has a clue what is going wrong?