> -----Urspr|ngliche Nachricht-----

quoted text
> Von: Christoph Leser

> Gesendet: Freitag, 21. September 2007 16:44

> An: 'misc@openbsd.ord'

> Betreff: Re: isakmp phase 2 negotiation failed

>

>

> >                 w

> >#	$OpenBSD: ipsec.conf,v 1.5 2006/09/14 15:10:43 hshoexer Exp $

> >#

> ># See ipsec.conf(5) for syntax and examples.

>

> >ike esp from 10.192.0.0/16 to 10.0.0.0/8 \

> >	peer gw.vpn.cobbled.net \

> >	main auth hmac-sha enc 3des-cbc \

> >	quick auth hmac-md5 enc des-cbc \

> >	srcid caley01.vpn.cobbled.net dstid gw.vpn.cobbled.net

> ># isakmpd configuration

>

> >[General]

> >Listen-on=		83.104.36.71

>

> >[X509-Certificates]

> >CA-directory=		/etc/isakmpd/ca/

> >Cert-directory=		/etc/isakmpd/certs/

> >Private-key=		/etc/isakmpd/private/local.key

>

> >[Phase 1]

> >#84.203.180.117=	gw.vpn.cobbled.net

>

> >[caley01.vpn.cobbled.net]

> >ID-Type=		FQDN

> >Name=			caley01.vpn.cobbled.net

>

> >[gw.vpn.cobbled.net]

> >ID-Type=		FQDN

> >Name=			gw.vpn.cobbled.net

>

> >[Phase 2]

> >Connections=		cobbled-caley

>

> >[cobbled_net-gw]

> >Phase=			1

> >Configuration=		low-crypto

> >Address=		84.203.180.117

> >ID=			caley01.vpn.cobbled.net

> >Remote-ID=		gw.vpn.cobbled.net

>

> >[cobbled-caley]

> >Phase=                  2

> >ISAKMP-peer=            cobbled_net-gw

> >Configuration=		low-crypto-quick

> >Local-ID=               cobbled_net-caley

> >Remote-ID=              cobbled_net-all

>

> >[cobbled_net-all]

> >ID-Type=                IPV4_ADDR_SUBNET

> >Network=                10.0.0.0

> >Netmask=                255.0.0.0

>

> >[cobbled_net-caley]

> >ID-Type=                IPV4_ADDR_SUBNET

> >Network=                10.192.0.0

> >Netmask=                255.255.0.0

>

> >[low-crypto]

> >DOI=                    IPSEC

> >EXCHANGE_TYPE=          ID_PROT

> >Transforms=             3DES-SHA-RSA_SIG

>

> >[low-crypto-quick]

> >DOI=                    IPSEC

> >EXCHANGE_TYPE=          QUICK_MODE

> >Transforms=             QM-ESP-DES-MD5-SUITE

>

>

>

>

>

 Maybe there is a problem with your isakmpd.conf:

 The hierachy should be as follows ( that's at least what I

 read from man isakmpd.conf:
 Connections lists s: cobbled-caley
  names : low-crypto-quick
  names  QM-ESP-DES-MD5-SUITE  !!

 so maybe it should be
 [low-crypto-quick]

 DOI=                    IPSEC

 EXCHANGE_TYPE=          QUICK_MODE

 Suites=                 QM-ESP-DES-MD5-SUITE
 i.e. transforms is not a valid parameter in the

 IPsec-configuration section
 let me know ...
 regards
 christoph