Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I checked our firewall logs today and found thousands of these messages:

Jul  3 15:59:36 sg580 Pluto[295]: packet from 218.185.86.50:500: initial Main Mode message received on xxx.xxx.xxx.xxx:500 but no connection has been authorized
Jul  3 15:59:44 sg580 Pluto[295]: packet from 218.185.86.50:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
Jul  3 15:59:44 sg580 Pluto[295]: packet from 218.185.86.50:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
Jul  3 15:59:44 sg580 Pluto[295]: packet from 218.185.86.50:500: ignoring Vendor ID payload [4048b7d56ebce885...]

Can anyone help me decipher this?

I've added policy routes to drop packets to/from 218.185.86.50 - but I'm still getting these blooming log messages.

Too much for me poor ol' noggin.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

The host at 218.185.86.50 is trying to set up an IPSEC VPN to you. Port 500 is the ISAKMP key exchange port.

JR

share|improve this answer
add comment

In addition to JR's correct answer.

Pluto[295] indicates respectively the name of the daemon and PID that has logged the message. Pluto is the IKE (IPsec Key Exchange) portion of the [Open|Free]Swan VPN project.

If you're not expecting a VPN to be terminating on that machine or you are only expecting VPN sessions from particular hosts then you should take a look at locking it down.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.