NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
S2S VPN with Cisco RV340 - "ERROR: ID mismatched with subjectAltName."
We are in the process of setting up a new Cisco RV340 in a site to site with a FVS336Gv3. We are using certificates, and have generated a cert for the RV340 and have successfully set it up with a S2S to a Cisco 1921.
We are trying the Netgear, and are getting the following log output from the VPN log:
Mon Sep 04 15:01:34 2017 (GMT -0500): [FVS336GV3] [IKE] ERROR: Ignore information because ISAKMP-SA has not been established yet. Mon Sep 04 15:01:34 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: Sending Informational Exchange: notify payload[INVALID-ID-INFORMATION] Mon Sep 04 15:01:34 2017 (GMT -0500): [FVS336GV3] [IKE] ERROR: ID mismatched with subjectAltName. Mon Sep 04 15:01:33 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: NAT not detected Mon Sep 04 15:01:33 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: NAT-D payload matches for CISCO_IP[500] Mon Sep 04 15:01:33 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: NAT-D payload matches for NETGEAR_IP[500] Mon Sep 04 15:01:32 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: NAT not detected Mon Sep 04 15:01:32 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: NAT-D payload matches for CISCO_IP[500] Mon Sep 04 15:01:32 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: NAT-D payload matches for NETGEAR_IP[500] Mon Sep 04 15:01:31 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: For CISCO_IP[500], Selected NAT-T version: RFC 3947 Mon Sep 04 15:01:31 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: Received Vendor ID: RFC 3947 Mon Sep 04 15:01:31 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: Received Vendor ID: DPD Mon Sep 04 15:01:31 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: Received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt Mon Sep 04 15:01:31 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: For CISCO_IP[500], Selected NAT-T version: RFC 3947 Mon Sep 04 15:01:31 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: Received Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Mon Sep 04 15:01:31 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: Received Vendor ID: RFC 3947 Mon Sep 04 15:01:31 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: Received Vendor ID: DPD Mon Sep 04 15:01:31 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: Received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt Mon Sep 04 15:01:31 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: Beginning Identity Protection mode. Mon Sep 04 15:01:31 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: Received request for new phase 1 negotiation: NETGEAR_IP[500]<=>CISCO_IP[500] Mon Sep 04 15:01:31 2017 (GMT -0500): [FVS336GV3] [IKE] INFO: Configuration found for CISCO_IP[500].
The message "ID mismatched with subjectAltName" is where this is failing. The Cisco's cert does not have any data in the subjectAlternativeName field. I have regenerated with the value Cisco.site as the subjectAltName, but the Netgear produces the same error.
-What does the message "ID mismatched with subjectAltName." mean? If you put it in quotes on Google you literally get 10 results on the entire internet, most of which are for the source code for some program called "raccoon".
6 Replies
Hi train_wreck,
It seems that you were trying to connect the NETGEAR VPN firewall to your Cisco with a site-to-site connection. As per checking on your logs that the NAT is also not detected. Is there a conflict between the LAN of the 2 routers? It also shows that the Netgear and the cisco has already seen each other as the negotiation on phase 1 is connected. You were stuck on phase 2. May you be able to check that?
Please refer on this article.
Regards,
Here are IKE & IPsec SA configs. Pretty sure everything matches....
Netgear IKENetgear IPsec SACisco IKE & SA configCisco IPSec Profile
Thank you for the attachments.
I see that you do have the same configurations for IPSec on both routers. "ID mismatch with subjectAltName" refers to your identifiers which is the local and remote certificates that you are using. May I know if your Netgear router is running on its latest firmware version?
Regards,
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
