I have checked with different mode that obey and found error no valid proposal and again i change lifetime too in bsd server. But I can't found where should i have to change those parameter in remote windows ipsec box.
Could you please suggest me.
Thankyou,
Regards,
John
VANHULLEBUS Yvan wrote: On Sat, Nov 17, 2007 at 01:06:32AM -0800, john decot wrote:
Hi.
> As per suggestion, The following are the logs generated by racoon :
[....]
Some people should learn that an RFC has been published for NAT-T :-)
[....]
Ok, your racoon found "an acceptable proposal", even if DB's lifetime
is really shorter than peer's one.
That means you're in CLAIN or OBEY checkmode. Those modes are well
known to generate as much problems as they solve, you should really
consider using exact or at least strict checkmode, and fix your
lifetime in your configuration (on the side you want, but have the
same lifetime on both peers).
[....]
[....]
May be an INITIAL-CONTACT sent a bit too early, or may also be a
negociation related INFORMATIONAL message.
Could you do a network capture of a negociation, and have a look at
that message in a tool like wireshark, to have more details ?
[....]
[....]
[....]
[....]
[....]
Really looks like the peer did not like the answer we sent, so did not
respond to it (or sent an informational which has not been handled).
Fix your lifetimes, switch to strict checkmode, fix any other
negociation parameter which may generate an error now you're in strict
checkmode, and if that still don't work, have a look at the
INFORMATIONAL message sent by your peer, and/or have a look at any log
on your peer.
