malformed payload in packet. Probable authentication failure (mismatch of preshared secrets?)

Question

I am trying to configure ipsec Site-to-site VPN between the Head and branch offices. The Head office is a Sophos UTM SG 210 configured as the responder (Repond-Only), and the branch Firewall is a Sophos XGS configured as the initiator. 
 The Head office SG210 firewall had three other site-to-site VPN connections all in respond-Only mode to the SG210 
 After the configuration was established the following error Log kept showing:

NAT-Traversal: Result using RFC 3947: no NAT detected 
 #37767: next payload type of ISAKMP Identification Payload has an unknown value: 187 
 #37767: Preshared secret failed to decrypt message. Trying next one. 
 #37767: next payload type of ISAKMP Identification Payload has an unknown value: 93 
 #37767: malformed payload in packet. Probable authentication failure (mismatch of preshared secrets?) 
 #37767: sending encrypted notification PAYLOAD_MALFORMED to 188.155.89.10:500 
 #37767: next payload type of ISAKMP Identification Payload has an unknown value: 93 
 #37767: malformed payload in packet. Probable authentication failure (mismatch of preshared secrets?)

Please I need help with the solution

Vivek Jagad · Accepted Answer

pre-shared key looks good, try something very simple like just numeric only or alphabetic only and ensure to deactive the tunnel completely and then re-initiate it again. You can keep XG on respond only and UTM 9 to initiate the connection. Like mentioned here - Configure a Site-to-site IPsec VPN connection between Sophos Firewall and UTM using a preshared key

Vivek Jagad · Answer

Hello Izuchukwu Edeh ,

Thank you for reaching out to the community, looks like a policy mismatch, request you to disable data compression, PFS and try again. I'd recommend create a custom policy rather than using any default policy. And may we know firmware version currently active on SG 210 ?

malformed payload in packet. Probable authentication failure (mismatch of preshared secrets?)

Top Replies