Date: Fri, 23 Mar 2001 23:54:59 -0500 From: "Jeremy Karteczka" <jerkart@mw.mediaone.net> To: <freebsd-security@FreeBSD.ORG> Subject: Trying to set up an IKE vpn between FreeBSD and Checkpoint FW-1 Message-ID: <05c501c0b41e$97277d20$0200a8c0@jose>
next in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
Greetings,
I am trying to get an IKE vpn going between a 4.2-RELEASE machine (using racoon
for key exchange) and a Checkpoint firewall (v4.1 SP3). I have tried both sha1
and md5. Every time I try to establish a connection phase 1 negotiation
succeeds and phase 2 says it succeeds in the racoon log file, but then I get
this message at the bottom of /var/log/messages:
When using md5:
key_mature: invalid AH key length 128 (160-160 allowed)
with sha1:
key_mature: invalid AH key length 160 (128-128 allowed)
I was able to speak with Checkpoint Tech support on this and they did confirm
that Firewall-1 uses a 128-bit key for md5 and a 160-bit key for sha1.
I have looked for RFCs to find out which is the accepted standard but could not
find one that specifically states how long the key should be for each hash
method.
Can anyone point me to the proper RFCs and/or tell me if there is a way I can
reverse the expected key lenght on the FreeBSD side? The Checkpoint tech I
spoke with stated that Firewall-1 is compliant with RFCs 2408 and 2409 but I see
no mention of AH key length for hash methods.
I have attached a copy of the racoon log (the external IPs have been cleansed)
and the conf used for an attempt to connect while using sha1.
Thanks in advance,
Jeremy
[-- Attachment #2 --]
"(:racoon.tar \[oFg[]W;I#7`w1Xź،%Q!v{)ʺڢl'bt:*&=D+ K~`4 11+ ~iYկEsW~^0:rL3W^e+OnPAVχYHeյ+hW;:#kȋ; 4w_pÃʁQ>-`&>k=rQnU2NG:t5F|yWe#(p(t^bk\#P$/=oO[,0:gxlI^umBZ
y\eFר#W]ypP8;qw\tl.!|v5-j|\.A$[W@C"=*U^_=Khh'LeX
V0kp\[vfU]<xqBm)Ykz
Q$<pUnTC3q
g|y;f7pT՛7ҝ4WU6I1xcѤm|=2,s![%ʽϷhėU) HlF+RxzMDza4MCտ~L?3h<RF3/)4B?c3'~>O3}*~<>__<v$C7(Y1d./]SSߠ+s_ݢC끁H>ib`>cCho-%χ7YՃ몚!θ,zswWC8
b9Iu:_4aPd~xm!B5ve0K`VgX85Z&!,Ҏ
ovG+>auG7vO7Au7qY|6G+&E:U2mtaef;D-d8J:7Nch+1@OTj`+wi_^bS̻;HB{oJ{/,"fdefCq,v_/S$IdOV,r'Y h.JÈ~Ah2h`<EH!
] XV_UsUhήmhnn|ޅKoʃkҧP.Pf(_}},O`߽=f'%LY?crɸhhi'f1Clo}m{|j aK.`EKL,}z1@i͖0G. 2Srz!JVXJ OQWJG~Kn%2sFɴ[$_ !^^ݼr݁)݁ȷ ۟C<P>KOn :
;HgPNA2 stt-aD?<4O 7hr,|S8AYw<+T($U]NU(ްC'"ðM}-bnK2xIqRPE[kCߡla0 $a"6"HJlH&|oqpzPm@wk`8uᡨGd~}=t@UMwGX{u_!(#.t4i\hp @|wpP=Ul2DHď"tv[i<A8G刭B3gm
wqqy#M܋C:.lN.NX-Ӯ`ũ:M2[4ϩOObhv&>A0s=ڙ:_nS@蘑⋤Z&b? ۅ2
FjRE`A(UMJjs?_l0.6mo .y@5ު.۹n]x!瀯s`>3 :Ç.[L )pw6љ
htNDZ.YRO6
HgVt#|:{ޮ|`[>]ߔ̇Х56k:SmΣ !!m8p\l1_~ýmBm$WssI^V+goߦ6|7E.ԅf7Ea##ߧ2kZ=Y`|10os`cw8//FZؕ-i
o\ uJc&|sJ,I$SL$5 Y(R'1<AҀN^}xُܣ`|fX*c®;b:K(gyoπ0\$r!xJYL9>N^xt&JL)є<pI4V;7Jf^Ӕ8HF J$5k(q[T!b&.F)86V07Szx&F'Kl)EFǐVhHeb00v,ISM!xd嚦w]-4#r$ NfƂb.&j 4T"8cPB՚G8468ɑI"6J*psc.#$#B"2qR&y xġ'+B$r#)^Ѡ5RkE$ȥ<bmfZꮋ<
yǫAFK7~(>(O^.Mhp&3K[nZ0tcSDNH-/Bci;#gj͍%bًQh=[?g><h W,>7<;Y5ysdx҇״2{>#TbL1:_WuyN9R<aۘ(&x
Gf^à#ag֏٫t9 -I8Op?yqc53(cBaF'ijRyXf\˫yHQVe82GUc=rB*,A#>
cjv
b9Ӥb+2h(g-Us!uj_׆f06
(+-0>i
0`5/̄]|"'нBJ@wn :(k><^<^<7m
( e(NpV:xSijyy*,?b:&j{Zq^nΞ68ZQL-UpdE(zhvP?vXc=
x$DW>uTTRs.p(DJ!aHb9bbcq>0N"UݼpkM I R6݅q(fN`ccL#0͡D'Pj&/,a AރJc3i8&\c>PKX"u9'$N,.8T@$1&FIĴIl̄Gl$V;P(< &oTcĔa8$&P)vcDs&5WTヾ`cΗ*̤0"I"Hj=9?%IjNq'I6GXMwۿ牻y,"Musd?ٿIṕK2$@JYxR<#}N<JeyNLKx^ڈNl /,7*jG\Z$!Ϧ8Lhwk#lŏb\N 隻ZڛvBʰ3HtU:M
F7h^mF)Sp|ؖK {HMClx6ou1rG.F:Dy!JMVuOOXI-#R_s`MbF_%0B^uQEY*6`rM0">uv[!))vnpjjᢦQ[}ݣ_<D/gf|q3-T^ޜp.7Jh&;}\2y}fu[mnwBd#"u{>]h<dzo56(wN%ۈwxuW.&ZevD<64F7m== [ m73[YH$6w ֔h X4hXɈJkibdbNhWY ,(TS
3a(+TaiE5"K#ځ4"ȁoH8g(f*Z@.MבE:Pi1bFXod8X!D#LcIv_,ѮV2ջ=={ 漱q$W,A_ut;}agۛ;|wd4>6 <vݴt:|mQʾw̙zBZ_mj5gDjw?}qnuo(A5Ѳq[jHcB~+Ӈ/i#8#M}ZvMbd_yS{9J4."MM+@ۙT]fd3!rw_p^1#xw-ndWlguK&c,fo uvvȏST%Vܳg[G(R[5@.vZ:|^!&z.!fɕkB\|4^u!NK)ww +]ƳA++gM
@ud!LB%[;yݾX0f '^%6w2KN O]څu"bu?;W?@;hkֽ)BiHf-}6.ݦ#
#j6uYҰ?^bT; A~k 4r8{_O?˦:^wU*1hxpz#Jꇗlv߂,- Kě!;1}_ΨCE77/zyY=<=?_uU^TZ(jCP8MfڐUNm""ؗ>`!
/w|0z{ 14@ma8)08oV^s~)o_T@$ҝI9E"JmVO2JtmY˓)VHd=yꄝ0w,4qq6,pF- fIM8,ܳ$GoVHl=&yxP/H#],`=lMy<&xwl,氱<zGn ߎS] _~O~?~8t=p>TRY]AX ޢo=.6{(-R朗MZCC3$W5>vӗԘ41%JkU+ܙs+>"h*TK?yN&s) yg.ΨPן5@)T9_m%㡺XT+L17fނΑ(:gRd]+-h/FWxXNfR^u)*V,u|KKb^\qڶk{$,)ĮnV-콋)'ҭ/ƎCr]^ש7f/Ghd/^b4RVb0{YdFQb4"JPK=Y fbo6ا?z1KWz4l_% Dtޅ+C}@?IsZrŌ&$ew٨awr..
dJ+^Pr(HVS99rw#m;}Y't%(;o2Y8:ؔ5\7,|e95kvbx
5bbŔ
TmtFm|Ce,e_m9ԠИԩXRJ2UP0/tQA\+XWٓp
d\U=}ʡ䜅/2Bzf-PBMUy)㨺KcU%VxHqdIMMX,KJnt9VH'YSRY4䌲DAe $ZE%
MIADF@i%ۺYh1L3 lUцB_(Fla9Z,NFHZybr ki
\}ɒULB5
u+*cͩZv@9ҷ ^97u8yۚ_ԑ a)DT|um[rv=Dذ>dX]9ÚmSݔl~\S'.ľCK+ʈד5W0fm,}a]XqCƁ/fAz^dcyl*&Y,@I >? ?&M ;ǐʇ]pk/M_AUjZa_EKB
61Kܮui]ߝ'de8<ISB-?]OI4DwS6"-G[LnI߱Hnuc.M-5)Mi?{vI]L.&I]LbD359rrEJt9C"rrEt9ɶILmxbh/\(|8bxL|9Çv6~Nsg+PBUb%i0R)X4]pR Q*E7fYqlc
4tK*&h3)@v:xBQs2/DHtYNԕL7nsM3$~ɡ#תYy
K*leሁC[WD,L"u)* kUCH ,u]dKPdQrfR9hsICzfwem`. 1d$Y)
^QgWNH.>
A ^YNz1 "$9J`keոHݕr+@D(!t(1Rg6MBFi^Y*CM+QS5ܬΑt"{HQc)DKM1c28l`J;<2屜8D)= U97WU#IV/pPR<N+/yY=
'+y&9&/y`K+)$Vf.#>L <R$њ@J:YoyC/a"7K9 lӕд@)2e83*K*x"Ȃb>4΄TeA5beh[%݊Ki.5jV@
ba6/8C#@ѕr+x9E`|(>!F{`9."%ad1T 㷁dIq:u5ۗ\XЖ+(f?F/lc!b3@
JX+"nSUcjQ0USj@0/wl䉷?>%tyRom\Ꚛ65sE?"ݿM
M{M\
լCuة[jVf"Lu8eǮL@./3^ `^T0B24VA 5BwiL%'\fY1tT`:/DL5@3r6-߇ K )J&kc<