Connecting two Drayteks over IPSec

Posted on 2016-07-20
Last Modified: 2016-07-25
We are currently aiming to connect a Draytek VigorPro 5510 with a Draytek Vigor 3900 using an IPSec tunnel.  The 5510 is the dial out router and the 3900 the dial in.

The configs are as follows:
IKE Phase1 Proposal: AE128 G1
Authentication: SHA1/MD5
Phase2 Proposal 3DES without auth
Auth: All
Perfect forward Secret: Disabled

The error I can see in the Syslog are: Payload malformed and Payload malfornmed after IV

Were stumped on this one and would appreciate some input

Question by:itd-helpdesk
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 22

Accepted Solution

David Atkin earned 500 total points
ID: 41721321
According to this:

The message "Payload Malformed" was received during the IKE exchange. It means the Phase 1 algorithms doesn't match the gateway configuration.

Change the proposal on Phase1 to something else (on both Drayteks) and re-test.

There is a well written article by Draytek for IPSEC VPN Connections - See here:

You will have to register to view the article.

Author Comment

ID: 41727701
Thanks for the reply, I definatly have a good way forward from this.


Featured Post

Flexible connectivity for any environment

The KE6900 series can extend and deploy computers with high definition displays across multiple stations in a variety of applications that suit any environment. Expand computer use to stations across multiple rooms with dynamic access.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Office 365 vs. In-House 4 118
How to setup 3 isps on a redundant mode? 3 36
Grant drive/folder change permissions to VPN user 6 29
Cisco Anyconnect for Android 6 45
Do you have an old router lying around the house that you don’t know what to do with? Check the make and model, then refer to either of these links to see if its compatible. http://www.dd-wrt.c…
I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question