New thread .. after some new test..

And stiill the same ... shit !

Here is the LAn/WAn network


192.168.0/24(lan)-->Netgear DG 834 (adsl + NAT + ipsec +ip fix A)
                                                 |
                                         <---WEB--->
                                                  |
                                 Openbsd 4.2 
(ipsec.conf+isakmpd.policy+ip fix B+ NAT) --> 10.7.22.0/24(lan)  


Here are the conf :

netgear :

local lan : 192.168.0.0/24
remote lan : 10.7.22.0/24
IKE :
direction : initiator & respond
mode : main
diffie-Hellman : Groupe 2 (1024)
local id : IP wan
remote id: IP

Params
Crypto algo : 3DES
Algo auth : SHA-1
pre shared key : 123456789
SA life time : 36000


Openbsd :
ipsec.conf

ike passive esp tunnel from IP_A to IP_B \
     main auth hmac-sha1 enc 3des group modp1024 \
     quick auth hmac-sha1 enc 3des  psk 123456789

ike dynamic esp tunnel from 192.168.0.0/24 to 10.7.22.0/24 peer IP_A \
     main auth hmac-sha1 enc 3des group modp1024 \
     quick auth hmac-sha1 enc 3des psk 123456789

   i have tried passive & dynamic for ike esp .. it's the same

isakmpd.policy

KeyNote-Version: 2
Authorizer: "POLICY"

pf.conf

pass in on $ext_if1 proto udp from $IP_A to $IP_B port {500,4500}
pass out on $ext_if1 proto udp from $IP_B to $IP_A port {500,4500}

pass in  on $IP_B proto esp from $IP_A to $IP_B
pass out on $IP_B proto esp from $IP_B to $IP_A

pass in on enc0 proto ipencap from $IP_A to $IP_B keep state (if-bound)
pass out on enc0 proto ipencap from $IP_B to $IP_A keep state (if-bound)

pass in on enc0 from 192.168.0.0/24 to 10.7.22.0/24 keep state (if-bound)
pass out on enc0 from 10.7.22.0/24 to 192.168.0.0/24 keep state (if-bound)

i have a rule for nat on $IP_B


enc0 is up and running

i start my vpn with

isakmpd -dv -D 8=99


And Finally here is the Trouble , i got this on isakmpd console

151330.400513 Negt 30 message_negotiate_sa: transform 0 proto 1 proposal 
0 ok
151330.400933 Negt 20 ike_phase_1_validate_prop: success
151330.401046 Negt 30 message_negotiate_sa: proposal 0 succeeded
151357.435134 Default transport_send_messages: giving up on exchange 
peer-IP_A, no response from peer IP_A:500

And this on the DG834

Fri, 2007-11-23 14:13:30 - [idle] initiating Main Mode
Fri, 2007-11-23 14:13:40 - [idle] STATE_MAIN_I1: retransmission; will 
wait 20s for response
Fri, 2007-11-23 14:14:00 - [idle] STATE_MAIN_I1: retransmission; will 
wait 40s for response
Fri, 2007-11-23 14:14:40 - [idle] max number of retransmissions reached 
STATE_MAIN_I1.  No acceptable response to our first IKE message


and finally ( As wanted for those who try to help me .. thanks)

echo "p on" > /var/run/isakmpd.fif and tcpdump -r /var/run/isakmpd.pcap 
-vvn


tcpdump: WARNING: snaplen raised from 96 to 65536
11:40:31.600710 IP_A.500 > IP_B.500: [udp sum ok] isakmp v1.0 exchange 
ID_PROT
        cookie: cb79617a4b409a8f->0000000000000000 msgid: 00000000 len: 100
        payload: SA len: 52 DOI: 1(IPSEC) situation: IDENTITY_ONLY
            payload: PROPOSAL len: 40 proposal: 0 proto: ISAKMP spisz: 0 
xforms: 1
                payload: TRANSFORM len: 32
                    transform: 0 ID: ISAKMP
                        attribute LIFE_TYPE = SECONDS
                        attribute LIFE_DURATION = 3600
                        attribute ENCRYPTION_ALGORITHM = 3DES_CBC
                        attribute HASH_ALGORITHM = SHA
                        attribute AUTHENTICATION_METHOD = PRE_SHARED
                        attribute GROUP_DESCRIPTION = MODP_1024
        payload: VENDOR len: 20 (supports DPD v1.0) [ttl 0] (id 1, len 128)
11:40:31.601712 IP_B.500 > IP_A.500: [udp sum ok] isakmp v1.0 exchange 
ID_PROT
        cookie: cb79617a4b409a8f->76316a628a99ce2b msgid: 00000000 len: 180
        payload: SA len: 52 DOI: 1(IPSEC) situation: IDENTITY_ONLY
            payload: PROPOSAL len: 40 proposal: 0 proto: ISAKMP spisz: 0 
xforms: 1
                payload: TRANSFORM len: 32
                    transform: 0 ID: ISAKMP
                        attribute LIFE_TYPE = SECONDS
                        attribute LIFE_DURATION = 3600
                        attribute ENCRYPTION_ALGORITHM = 3DES_CBC
                        attribute HASH_ALGORITHM = SHA
                        attribute AUTHENTICATION_METHOD = PRE_SHARED
                        attribute GROUP_DESCRIPTION = MODP_1024
        payload: VENDOR len: 20 (supports OpenBSD-4.0)
        payload: VENDOR len: 20 (supports v2 NAT-T, 
draft-ietf-ipsec-nat-t-ike-02)
        payload: VENDOR len: 20 (supports v3 NAT-T, 
draft-ietf-ipsec-nat-t-ike-03)
        payload: VENDOR len: 20 (supports NAT-T, RFC 3947)
        payload: VENDOR len: 20 (supports DPD v1.0) [ttl 0] (id 1, len 208)



And then nothing !!!!

it is not related to my FAI i have tried with 2 different.. it is the same


For me it is around pf.conf .. but i can't find where

jc