RE: vpn mystery

Hi,

Here it is:

Router#debug crypto isakmp error

Crypto ISAKMP Error debugging is on

Router#

*Mar 1 20:20:38.374: ISAKMP (0:3): Encryption algorithm offered does not
match policy!

*Mar 1 20:20:38.374: ISAKMP (0:3): atts are not acceptable. Next payload is
3

*Mar 1 20:20:38.374: ISAKMP (0:3): Encryption algorithm offered does not
match policy!

*Mar 1 20:20:38.374: ISAKMP (0:3): atts are not acceptable. Next payload is
3

*Mar 1 20:20:38.374: ISAKMP (0:3): Encryption algorithm offered does not
match policy!

*Mar 1 20:20:38.374: ISAKMP (0:3): atts are not acceptable. Next payload is
3

*Mar 1 20:20:38.374: ISAKMP (0:3): Encryption algorithm offered does not
match policy!

*Mar 1 20:20:38.374: ISAKMP (0:3): atts are not acceptable. Next payload is
3

*Mar 1 20:20:38.374: ISAKMP (0:3): Encryption algorithm offered does not
match policy!

*Mar 1 20:20:38.374: ISAKMP (0:3): atts are not acceptable. Next payload is
3

*Mar 1 20:20:38.374: ISAKMP (0:3): Encryption algorithm offered does not
match policy!

*Mar 1 20:20:38.374: ISAKMP (0:3): atts are not acceptable. Next payload is
3

*Mar 1 20:20:38.374: ISAKMP (0:3): Encryption algorithm offered does not
match policy!

*Mar 1 20:20:38.374: ISAKMP (0:3): atts are not acceptable. Next payload is
3

*Mar 1 20:20:38.374: ISAKMP (0:3): Encryption algorithm offered does not
match policy!

*Mar 1 20:20:38.374: ISAKMP (0:3): atts are not acceptable. Next payload is
3

*Mar 1 20:20:38.702: ISAKMP (0:3): FSM action returned error: 4

*Mar 1 20:20:41.718: ISAKMP (0:3): FSM action returned error: 4 Unknown Attr:
0x7000 Unknown Attr: 0x7001 Unknown Attr: 0x7003 Unknown Attr: 0x7007 Unknown
Attr: 0x700B Unknown Attr: 0x7009 Unknown Attr: 0x700C Unknown Attr: 0x7008
Unknown Attr: 0x700A Unknown Attr: 0x7005

*Mar 1 20:20:41.750: ISAKMP (0/3): Unknown Attr: UNKNOWN (0x7000)

*Mar 1 20:20:41.750: ISAKMP (0/3): Unknown Attr: UNKNOWN (0x7001)

*Mar 1 20:20:41.750: ISAKMP (0/3): Unknown Attr: UNKNOWN (0x7003)

*Mar 1 20:20:41.750: ISAKMP (0/3): Unknown Attr: UNKNOWN (0x7007)

*Mar 1 20:20:41.750: ISAKMP (0/3): Unknown Attr: UNKNOWN (0x700B)

*Mar 1 20:20:41.750: ISAKMP (0/3): Unknown Attr: UNKNOWN (0x7009)

*Mar 1 20:20:41.750: ISAKMP (0/3): Unknown Attr: UNKNOWN (0x700C)

*Mar 1 20:20:41.750: ISAKMP (0/3): Unknown Attr: UNKNOWN (0x7008)

*Mar 1 20:20:41.750: ISAKMP (0/3): Unknown Attr: UNKNOWN (0x700A)

*Mar 1 20:20:41.750: ISAKMP (0/3): Unknown Attr: UNKNOWN (0x7005)

*Mar 1 20:20:41.770: ISAKMP (0:3): IPSec policy invalidated proposal

*Mar 1 20:20:41.770: ISAKMP (0:3): IPSec policy invalidated proposal

*Mar 1 20:20:41.774: ISAKMP (0:3): IPSec policy invalidated proposal

Router#debug crypto ipsec error

Crypto IPSEC Error debugging is on

Router#

*Mar 1 20:18:54.334: IPSEC(validate_transform_proposal): transform proposal
not supported for identity:

    {esp-aes 256 esp-md5-hmac comp-lzs }

*Mar 1 20:18:54.334: IPSEC(validate_transform_proposal): transform proposal
not supported for identity:

    {esp-aes 256 esp-sha-hmac comp-lzs }

*Mar 1 20:18:54.338: IPSEC(validate_transform_proposal): transform proposal
not supported for identity:

    {esp-aes esp-md5-hmac comp-lzs }

*Mar 1 20:18:54.338: IPSEC(validate_transform_proposal): transform proposal
not supported for identity:

    {esp-aes esp-sha-hmac comp-lzs }

*Mar 1 20:18:54.342: IPSEC(validate_transform_proposal): transform proposal
not supported for identity:

    {esp-aes 256 esp-md5-hmac }

*Mar 1 20:18:54.342: IPSEC(validate_transform_proposal): transform proposal
not supported for identity:

    {esp-aes 256 esp-sha-hmac }

*Mar 1 20:18:54.342: IPSEC(validate_transform_proposal): transform proposal
not supported for identity:

    {esp-aes esp-md5-hmac }

*Mar 1 20:18:54.346: IPSEC(validate_transform_proposal): transform proposal
not supported for identity:

    {esp-aes esp-sha-hmac }

*Mar 1 20:18:54.346: IPSEC(validate_transform_proposal): transform proposal
not supported for identity:

    {esp-3des esp-md5-hmac comp-lzs }

*Mar 1 20:18:54.346: IPSEC(validate_transform_proposal): transform proposal
not supported for identity:

    {esp-3des esp-sha-hmac comp-lzs }

*Mar 1 20:18:54.350: IPSEC(validate_transform_proposal): transform proposal
not supported for identity:

    {esp-3des esp-md5-hmac }

> Date: Tue, 20 Oct 2009 22:55:59 +0200
> Subject: Re: vpn mystery
> From: piotr_at_ccie1.com
> To: a_sadki1_at_hotmail.com
> CC: ccielab_at_groupstudy.com
>
> OK, can you debug whole ISAKMP ("deb crypto isakmp") and paste a few more
> lines before and after that error message? This is because there might be
> wrong something different which causes ISAKMP fail and generates that
> message.
>
> --
> Piotr Matusiak
> CCIE #19860 (R&S, SEC)
> Technical Instructor
> MicronicsTraining.com
>
> If you can't explain it simply, you don't understand it well enough -
> Albert Einstein
>
>
> 2009/10/20 abderrahim sadki <a_sadki1_at_hotmail.com>
>
> > Hi Piotr,
> >
> > i used a cisco vpn client(windoes software).
> >
> > Thanks for the netmask tip!
> >
> > Abderrahim
> >
> > _________________________________________________________________
> > Windows Live: Make it easier for your friends to see what you re up to on
> > Facebook.
> >
> >
>
http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/soci
> >
>
al-network-basics.aspx?ocid=PID23461::T:WLMTAGL:ON:WL:en-xm:SI_SB_2:092009<ht
>
tp://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/soci%0
>
Aal-network-basics.aspx?ocid=PID23461::T:WLMTAGL:ON:WL:en-xm:SI_SB_2:092009>
> >
> >
> > Blogs and organic groups at http://www.ccie.net
> >
> > _______________________________________________________________________
> > Subscription information may be found at:
> > http://www.groupstudy.com/list/CCIELab.html
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
>
>
>
>
>
>
>
Received on Wed Oct 21 2009 - 11:38:15 ART