ipsec and update_nat (No algorithm specified) error

[Omer Faruk Sen]

Hi,

I have a problem with ipsec setup on my 2 box one of them is rhel4 Update
3 and other one is fedora core 4

I get the following error:

rhel 4.3 box:

Jul 12 19:07:32  racoon: INFO: NAT detected -> UDP encapsulation (ENC_MODE
1->61443).
Jul 12 19:07:32  racoon: INFO: NAT detected -> UDP encapsulation (ENC_MODE
1->61443).
Jul 12 19:07:32  racoon: INFO: Adjusting my encmode UDP-Tunnel->61441
Jul 12 19:07:32  racoon: INFO: Adjusting peer's encmode UDP-Tunnel->61441
Jul 12 19:07:32  racoon: INFO: Adjusting my encmode UDP-Tunnel->61441
Jul 12 19:07:32  racoon: INFO: Adjusting peer's encmode UDP-Tunnel->61441
Jul 12 19:07:32  racoon: ERROR: libipsec failed send update (No algorithm
specified)
Jul 12 19:07:32  racoon: ERROR: pfkey update failed.
Jul 12 19:07:32  racoon: ERROR: failed to process packet.
Jul 12 19:07:32 racoon: ERROR: phase2 negotiation failed.


fedora 4:

Jul 12 21:08:12 searchdb15 racoon: INFO: Adjusting my encmode
UDP-Tunnel->Tunnel
Jul 12 21:08:12 searchdb15 racoon: INFO: Adjusting peer's encmode
UDP-Tunnel(61443)->Tunnel(1)
Jul 12 21:08:12 searchdb15 racoon: INFO: Adjusting my encmode
UDP-Tunnel->Tunnel
Jul 12 21:08:12 searchdb15 racoon: INFO: Adjusting peer's encmode
UDP-Tunnel(61443)->Tunnel(1)
Jul 12 21:08:12 searchdb15 racoon: ERROR: libipsec failed send update_nat
(No algorithm specified)
Jul 12 21:08:12 searchdb15 racoon: ERROR: pfkey update failed.
Jul 12 21:08:12 searchdb15 racoon: ERROR: failed to process packet.
Jul 12 21:08:12 searchdb15 racoon: ERROR: phase2 negotiation failed.


The error is obvious:

libipsec failed send update_nat (No algorithm specified)

but where should I define this?

my configuration is as follows:

sainfo anonymous
{
        pfs_group modp768;
        encryption_algorithm 3des;
        authentication_algorithm hmac_md5;
        compression_algorithm deflate;

}
include "/etc/racoon/XX.XXX.XXX.conf";



XX.XXX.XXX.conf:

remote XX.XXX.XXX
{
        exchange_mode  main;
        nat_traversal on;
        proposal {
               encryption_algorithm 3des;
                hash_algorithm md5;
                authentication_method pre_shared_key;
                dh_group modp1024;
        }
}



By the way ipsec-tools version on fedora is  ipsec-tools-0.6.4-1.1 and on
rhel ipsec-tools-0.3.3-6.rhel4.1


-- 
Omer Faruk Sen
http://www.faruk.net