NoPaste

ipsec up ike

von thunder11

SNIPPET_TEXT:
  1. root@XFCE:~# ipsec up ike
  2. initiating IKE_SA ike[13] to 146.70.111.134
  3. generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
  4. sending packet: from 192.168.0.40[500] to 146.70.111.134[500] (940 bytes)
  5. received packet: from 146.70.111.134[500] to 192.168.0.40[500] (38 bytes)
  6. parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]
  7. peer didn't accept DH group CURVE_25519, it requested MODP_2048
  8. initiating IKE_SA ike[13] to 146.70.111.134
  9. generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
  10. sending packet: from 192.168.0.40[500] to 146.70.111.134[500] (1164 bytes)
  11. received packet: from 146.70.111.134[500] to 192.168.0.40[500] (460 bytes)
  12. parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(MULT_AUTH) ]
  13. selected proposal: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
  14. local host is behind NAT, sending keep alives
  15. remote host is behind NAT
  16. no IDi configured, fall back on IP address
  17. establishing CHILD_SA ike{10}
  18. generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_6_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
  19. sending packet: from 192.168.0.40[4500] to 146.70.111.134[4500] (380 bytes)
  20. received packet: from 146.70.111.134[4500] to 192.168.0.40[4500] (1248 bytes)
  21. parsed IKE_AUTH response 1 [ EF(1/4) ]
  22. received fragment #1 of 4, waiting for complete IKE message
  23. received packet: from 146.70.111.134[4500] to 192.168.0.40[4500] (1248 bytes)
  24. parsed IKE_AUTH response 1 [ EF(2/4) ]
  25. received fragment #2 of 4, waiting for complete IKE message
  26. received packet: from 146.70.111.134[4500] to 192.168.0.40[4500] (1248 bytes)
  27. parsed IKE_AUTH response 1 [ EF(3/4) ]
  28. received fragment #3 of 4, waiting for complete IKE message
  29. received packet: from 146.70.111.134[4500] to 192.168.0.40[4500] (664 bytes)
  30. parsed IKE_AUTH response 1 [ EF(4/4) ]
  31. received fragment #4 of 4, reassembled fragmented IKE message (4236 bytes)
  32. parsed IKE_AUTH response 1 [ IDr CERT CERT AUTH EAP/REQ/ID ]
  33. received end entity cert "CN=rs2-auto-ikev.ptoserver.com"
  34. received issuer cert "C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA"
  35.  using certificate "CN=rs2-auto-ikev.ptoserver.com"
  36.  using untrusted intermediate certificate "C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA"
  37.  using trusted ca certificate "C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority"
  38. certificate policy 1.3.6.1.4.1.6449.1.2.2.7 for 'CN=rs2-auto-ikev.ptoserver.com' not allowed by trustchain, ignored
  39. certificate policy 2.23.140.1.2.1 for 'CN=rs2-auto-ikev.ptoserver.com' not allowed by trustchain, ignored
  40.  reached self-signed root ca with a path length of 1
  41. checking certificate status of "CN=rs2-auto-ikev.ptoserver.com"
  42.  requesting ocsp status from 'http://ocsp.sectigo.com' ...
  43. unable to fetch from http://ocsp.sectigo.com, no capable fetcher found
  44. ocsp request to http://ocsp.sectigo.com failed
  45. ocsp check failed, fallback to crl
  46. certificate status is not available
  47. checking certificate status of "C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA"
  48.   requesting ocsp status from 'http://ocsp.usertrust.com' ...
  49. unable to fetch from http://ocsp.usertrust.com, no capable fetcher found
  50. ocsp request to http://ocsp.usertrust.com failed
  51. ocsp check failed, fallback to crl
  52.   fetching crl from 'http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl' ...
  53. unable to fetch from http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl, no capable fetcher found
  54. crl fetching failed
  55. certificate status is not available
  56. authentication of 'pointtoserver.com' with RSA_EMSA_PKCS1_SHA2_384 successful
  57. server requested EAP_IDENTITY (id 0x00), sending 'purevpnxxxxxxx'
  58. generating IKE_AUTH request 2 [ EAP/RES/ID ]
  59. sending packet: from 192.168.0.40[4500] to 146.70.111.134[4500] (84 bytes)
  60. received packet: from 146.70.111.134[4500] to 192.168.0.40[4500] (92 bytes)
  61. parsed IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]
  62. server requested EAP_MSCHAPV2 authentication (id 0x01)
  63. generating IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]
  64. sending packet: from 192.168.0.40[4500] to 146.70.111.134[4500] (140 bytes)
  65. received packet: from 146.70.111.134[4500] to 192.168.0.40[4500] (108 bytes)
  66. parsed IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]
  67. EAP-MS-CHAPv2 succeeded: '(null)'
  68. generating IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]
  69. sending packet: from 192.168.0.40[4500] to 146.70.111.134[4500] (68 bytes)
  70. received packet: from 146.70.111.134[4500] to 192.168.0.40[4500] (68 bytes)
  71. parsed IKE_AUTH response 4 [ EAP/SUCC ]
  72. EAP method EAP_MSCHAPV2 succeeded, MSK established
  73. authentication of '192.168.0.40' (myself) with EAP
  74. generating IKE_AUTH request 5 [ AUTH ]
  75. sending packet: from 192.168.0.40[4500] to 146.70.111.134[4500] (84 bytes)
  76. received packet: from 146.70.111.134[4500] to 192.168.0.40[4500] (316 bytes)
  77. parsed IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) ]
  78. authentication of 'pointtoserver.com' with EAP successful
  79. installing DNS server 146.70.111.131 via resolvconf
  80. resolvconf: Dropped protocol specifier '.inet.ipsec.146.70.111.131' from 'lo.inet.ipsec.146.70.111.131'. Using 'lo' (ifindex=1).
  81. resolvconf: Failed to set DNS configuration: Unit dbus-org.freedesktop.network1.service not found.
  82. removing DNS server 146.70.111.131 via resolvconf
  83. resolvconf: Dropped protocol specifier '.inet.ipsec.146.70.111.131' from 'lo.inet.ipsec.146.70.111.131'. Using 'lo' (ifindex=1).
  84. resolvconf: Failed to revert interface configuration: Unit dbus-org.freedesktop.network1.service not found.
  85. adding DNS server failed
  86. installing DNS server 146.70.111.131 via resolvconf
  87. resolvconf: Dropped protocol specifier '.inet.ipsec.146.70.111.131' from 'lo.inet.ipsec.146.70.111.131'. Using 'lo' (ifindex=1).
  88. resolvconf: Failed to set DNS configuration: Unit dbus-org.freedesktop.network1.service not found.
  89. removing DNS server 146.70.111.131 via resolvconf
  90. resolvconf: Dropped protocol specifier '.inet.ipsec.146.70.111.131' from 'lo.inet.ipsec.146.70.111.131'. Using 'lo' (ifindex=1).
  91. resolvconf: Failed to revert interface configuration: Unit dbus-org.freedesktop.network1.service not found.
  92. adding DNS server failed
  93. handling INTERNAL_IP4_DNS attribute failed
  94. installing DNS server 146.70.111.133 via resolvconf
  95. resolvconf: Dropped protocol specifier '.inet.ipsec.146.70.111.133' from 'lo.inet.ipsec.146.70.111.133'. Using 'lo' (ifindex=1).
  96. resolvconf: Failed to set DNS configuration: Unit dbus-org.freedesktop.network1.service not found.
  97. removing DNS server 146.70.111.133 via resolvconf
  98. resolvconf: Dropped protocol specifier '.inet.ipsec.146.70.111.133' from 'lo.inet.ipsec.146.70.111.133'. Using 'lo' (ifindex=1).
  99. resolvconf: Failed to revert interface configuration: Unit dbus-org.freedesktop.network1.service not found.
  100. adding DNS server failed
  101. handling INTERNAL_IP4_DNS attribute failed
  102. installing new virtual IP 10.69.5.191
  103. peer supports MOBIKE
  104. IKE_SA ike[13] established between 192.168.0.40[192.168.0.40]...146.70.111.134[pointtoserver.com]
  105. scheduling reauthentication in 9730s
  106. maximum IKE_SA lifetime 10270s
  107. selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ
  108. CHILD_SA ike{10} established with SPIs cfc72bf2_i c46ae05b_o and TS 10.69.5.191/32 === 0.0.0.0/0
  109. connection 'ike' established successfully
  110. root@XFCE:~#

Quellcode

Hier kannst du den Code kopieren und ihn in deinen bevorzugten Editor einfügen. PASTEBIN_DOWNLOAD_SNIPPET_EXPLAIN

Verlinken

URL: alles markieren
https://nopaste.debianforum.de/41902

BBCode: alles markieren
[NP]41902[/NP]

LATEST_SNIPPETS