Mailing List Archive

vpnc nortel/mac troubles
I finally got back to trying vpnc for mac/lion as described here:
http://www.macfreek.nl/memory/VPNC_for_Nortel_on_Mac

It gives me some output as:

add net XXXX gateway: YYYYY
add host ZZZZZ gateway 10.0.1.1
delete net default
add net default gateway AAAAAA
VPNC starts in background(pid: 4531)…


but it appears to die very quickly with no output.

I tried with --natt-mode force-natt
but this didn't appear to make any difference.

thoughts?

thanks
phil
_______________________________________________
vpnc-devel mailing list
vpnc-devel@unix-ag.uni-kl.de
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/
Re: vpnc nortel/mac troubles [ In reply to ]
I have similar problem. but connection doesn't die - it just won't pass any
traffic through it

log from debug mode: if someone can decrypt it


$sudo vpnc --natt-mode force-natt --debug 2

Enter PIN for myaccount@vpn.myoffice.com: 9338

Enter password for myaccount@vpn.myoffice.com: 547714



vpnc version 0.5.3-464M


S1 init_sockaddr

[2012-01-24 23:01:30]


S2 make_socket

[2012-01-24 23:01:30]


S3 setup_tunnel

[2012-01-24 23:01:30]

using interface tun0


S4 do_phase1_am

[2012-01-24 23:01:30]


S4.1 create_nonce

[2012-01-24 23:01:30]


S4.2 dh setup

[2012-01-24 23:01:30]


S4.3 AM packet_1

[2012-01-24 23:01:30]


S4.4 AM_packet2

[2012-01-24 23:01:33]

(Nortel Contivity)

IKE SA selected psk-3des-sha1

NAT status: no NAT-T VID seen


S4.5 AM_packet3

[2012-01-24 23:01:33]


S4.6 cleanup

[2012-01-24 23:01:33]


S5 do_phase2_xauth [1]

[2012-01-24 23:01:33]


S5.1 xauth_request

[2012-01-24 23:01:33]


S5.2 notice_check

[2012-01-24 23:01:33]


S5.3 type-is-xauth check

[2012-01-24 23:01:33]


S5.4 xauth type check

[2012-01-24 23:01:33]


S5.5 do xauth reply

[2012-01-24 23:01:33]


S5.2 notice_check

[2012-01-24 23:01:33]


S5.3 type-is-xauth check

[2012-01-24 23:01:33]


S5.6 process xauth set

[2012-01-24 23:01:33]


S5.8 xauth done

[2012-01-24 23:01:33]


S6 do_phase2_config [1]

[2012-01-24 23:01:33]


S6.2 phase2_config receive modecfg

[2012-01-24 23:01:34]

unknown attribute 6 / 0x6

unknown attribute 16392 / 0x4008

unknown attribute 16393 / 0x4009

unknown attribute 16394 / 0x400A

unknown attribute 16396 / 0x400C

unknown attribute 16409 / 0x4019

unknown attribute 16398 / 0x400E

unknown attribute 16397 / 0x400D

unknown attribute 16397 / 0x400D

unknown attribute 16403 / 0x4013

unknown attribute 16400 / 0x4010

got address 10.127.240.8


S6 do_phase2

[2012-01-24 23:01:34]


do_phase2: S7.5 QM_packet2 check reject offer

[2012-01-24 23:01:34]


do_phase2: S7.6 QM_packet2 check and process proposal

[2012-01-24 23:01:34]

got ipsec lifetime attributes: 28800 seconds

IPSEC SA selected 3des-md5


do_phase2: S7.1 QM_packet1

[2012-01-24 23:01:34]

get_spi: 151.193.128.253 -> 192.168.1.4, spi 0x82f2e09a


do_phase2: S7.7 QM_packet3 sent - run script

[2012-01-24 23:01:34]


S7 setup_link (phase 2 + main_loop)

[2012-01-24 23:01:34]


S7.0 run interface setup script

[2012-01-24 23:01:34]

add host 151.193.128.253: gateway 192.168.1.1

delete net default

add net default: gateway 10.127.240.8


S7.8 setup ipsec tunnel

[2012-01-24 23:01:34]


S7.9 main loop (receive and transmit ipsec packets)

[2012-01-24 23:01:34]

remote -> local spi: 0x9ae0f282

local -> remote spi: 0xea9da18c

VPNC started in background (pid: 945)...



If someone would give me a hint, what is the problem with it, i'll be very
appreciated
What other options to try?
Regards
Victor



On 24 January 2012 02:00, phil swenson <phil.swenson@gmail.com> wrote:

> I finally got back to trying vpnc for mac/lion as described here:
> http://www.macfreek.nl/memory/VPNC_for_Nortel_on_Mac
>
> It gives me some output as:
>
> add net XXXX gateway: YYYYY
> add host ZZZZZ gateway 10.0.1.1
> delete net default
> add net default gateway AAAAAA
> VPNC starts in background(pid: 4531)…
>
>
> but it appears to die very quickly with no output.
>
> I tried with --natt-mode force-natt
> but this didn't appear to make any difference.
>
> thoughts?
>
> thanks
> phil
> _______________________________________________
> vpnc-devel mailing list
> vpnc-devel@unix-ag.uni-kl.de
> https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
> http://www.unix-ag.uni-kl.de/~massar/vpnc/
>
Re: vpnc nortel/mac troubles [ In reply to ]
On Tue, Jan 24, 2012 at 8:00 AM, phil swenson <phil.swenson@gmail.com> wrote:
> I finally got back to trying vpnc for mac/lion as described here:
> http://www.macfreek.nl/memory/VPNC_for_Nortel_on_Mac
>
> It gives me some output as:
>
> add net XXXX gateway: YYYYY
> add host ZZZZZ gateway 10.0.1.1
> delete net default
> add net default gateway AAAAAA
> VPNC starts in background(pid: 4531)…
>
>
> but it appears to die very quickly with no output.
>
> I tried with --natt-mode force-natt
> but this didn't appear to make any difference.
>
> thoughts?
>
> thanks
> phil

Hi Phil,

today there are two modes to use vpnc Nortel on Mac:

1) easy way!
Use the latest code available in svn, but with option "--natt-mode
nortel-udp"
This will *not* work if your server refuses UDP mode and asks for ESP

2) Kernel mode, still in development.
Use the old code patched as explained in
http://www.macfreek.nl/memory/VPNC_for_Nortel_on_Mac
to use ESP encapsulation if case 1) above does not work.

There is no way to use AH encapsulation or compression with current vpnc code.

Any other option for "--natt-mode" will not work in Nortel mode.
I have just committed a patch that checks nat-mode vs vendor, to be
sure these options are correctly used.

Best Regards,
Antonio Borneo
_______________________________________________
vpnc-devel mailing list
vpnc-devel@unix-ag.uni-kl.de
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/