0

I should switch from the racoon daemon (discarded) to the new demove charon strongswan. In practice I have about a dozen suppliers with which to change all the vpn in a "single" shot. I recreated all the configurations "copying" them from the racoon to the strongswan. Out of 10 only three cannot be connected. Now for simplicity, just list one of these. In practice, phase 1 is able to connect, but fails to establish the phase 2 tunnel. In some cases (not in this log) or generally at the first start the tunnel is set up and there is connectivity but after a few minutes the tunnel goes down and no longer works

racoon conf (working)

remote 2.2.2.2 {
        my_identifier address 1.1.1.1;
        exchange_mode main;
        nat_traversal off;
        initial_contact on;
        #generate_policy on;

        lifetime time 86400 sec;

        nonce_size 16;
        support_proxy on;
        proposal_check obey;    # obey, strict or claim

        proposal {
                encryption_algorithm 'aes 256';
                authentication_method pre_shared_key;
                hash_algorithm sha1;
                dh_group 5;
        }
}

sainfo address 1.1.1.1/32 any address 2.2.2.2/32 any {
        encryption_algorithm 'aes 256';
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
        lifetime time 3600 sec;
        pfs_group 5;
}

sainfo address 2.2.2.2/32 any address 1.1.1.1/32 any {
        encryption_algorithm 'aes 256';
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
        lifetime time 3600 sec;
        pfs_group 5;
}

sainfo address 172.16.0.0/29 any address 10.1.0.0/19 any {
        encryption_algorithm 'aes 256';
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
        lifetime time 3600 sec;
        pfs_group 5;
}

sainfo address 10.1.0.0/19 any address 172.16.0.0/29 any {
        encryption_algorithm 'aes 256';
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
        lifetime time 3600 sec;
        pfs_group 5;
}

ipsec-tools.conf
spdadd 1.1.1.1/32      2.2.2.2/32     any -P out ipsec
       esp/tunnel/1.1.1.1-2.2.2.2/require;
spdadd 2.2.2.2/32       1.1.1.1/32    any -P in  ipsec
       esp/tunnel/2.2.2.2-1.1.1.1/require;

spdadd 172.16.0.0/29        10.1.0.0/19       any -P out ipsec
       esp/tunnel/1.1.1.1-2.2.2.2/require;
spdadd 10.1.0.0/19         172.16.0.0/29      any -P in  ipsec
       esp/tunnel/2.2.2.2-1.1.1.1/require;

conn.conf (strongswan)

conn conn
   type=tunnel
   authby=secret
   auto=route
   compress=no
   leftfirewall=yes
   rightfirewall=yes
   rekey=yes
   reauth=no
   mobike=no
   left=1.1.1.1
   leftsourceip=1.1.1.1
   leftsubnet=172.16.0.0/29
   # Clients
   right=2.2.2.2
   rightsubnet=10.1.0.0/19
   # recommended dpd/liveness to cleanup vanished clients
   dpdaction=none
   #dpddelay=30
   #dpdtimeout=120
   aggressive=no
   keyexchange=ikev1
   ike=aes256-sha1-modp1536!
   ikelifetime=24h
   fragmentation=no
   esp=aes256-sha1-modp1536!
   lifetime=1h

ipsec statusall

Connections:
    conn:  1.1.1.1...2.2.2.2  IKEv1, dpddelay=30s
    conn:   local:  [1.1.1.1] uses pre-shared key authentication
    conn:   remote: [2.2.2.2] uses pre-shared key authentication
    conn:   child:  172.16.0.0/29 === 10.1.0.0/19 TUNNEL, dpdaction=clear
Routed Connections:
    conn{1}:  ROUTED, TUNNEL, reqid 1
    conn{1}:   172.16.0.0/29 === 10.1.0.0/19
Security Associations (1 up, 0 connecting):
    conn[3]: ESTABLISHED 11 seconds ago, 1.1.1.1[1.1.1.1]...2.2.2.2[2.2.2.2]
    conn[3]: IKEv1 SPIs: f8b3195f00f2368e_i* 311a423d5e714f05_r, rekeying in 23 hours
    conn[3]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
    conn[3]: Tasks queued: QUICK_MODE
    conn[3]: Tasks active: MODE_CONFIG

log charon

Dec  3 22:21:31 moon charon: 14[KNL] creating acquire job for policy 1.1.1.10/32[tcp/46993] === 2.2.2.50/32[tcp/1414] with reqid {1}
Dec  3 22:21:31 moon charon: 14[IKE] queueing ISAKMP_VENDOR task
Dec  3 22:21:31 moon charon: 14[IKE] queueing ISAKMP_CERT_PRE task
Dec  3 22:21:31 moon charon: 14[IKE] queueing MAIN_MODE task
Dec  3 22:21:31 moon charon: 14[IKE] queueing ISAKMP_CERT_POST task
Dec  3 22:21:31 moon charon: 14[IKE] queueing ISAKMP_NATD task
Dec  3 22:21:31 moon charon: 14[IKE] queueing QUICK_MODE task
Dec  3 22:21:31 moon charon: 14[IKE] activating new tasks
Dec  3 22:21:31 moon charon: 14[IKE]   activating ISAKMP_VENDOR task
Dec  3 22:21:31 moon charon: 14[IKE]   activating ISAKMP_CERT_PRE task
Dec  3 22:21:31 moon charon: 14[IKE]   activating MAIN_MODE task
Dec  3 22:21:31 moon charon: 14[IKE]   activating ISAKMP_CERT_POST task
Dec  3 22:21:31 moon charon: 14[IKE]   activating ISAKMP_NATD task
Dec  3 22:21:31 moon charon: 14[IKE] sending XAuth vendor ID
Dec  3 22:21:31 moon charon: 14[ENC] added payload of type VENDOR_ID_V1 to message
Dec  3 22:21:31 moon charon: 14[IKE] sending DPD vendor ID
Dec  3 22:21:31 moon charon: 14[ENC] added payload of type VENDOR_ID_V1 to message
Dec  3 22:21:31 moon charon: 14[IKE] sending FRAGMENTATION vendor ID
Dec  3 22:21:31 moon charon: 14[ENC] added payload of type VENDOR_ID_V1 to message
Dec  3 22:21:31 moon charon: 14[IKE] sending NAT-T (RFC 3947) vendor ID
Dec  3 22:21:31 moon charon: 14[ENC] added payload of type VENDOR_ID_V1 to message
Dec  3 22:21:31 moon charon: 14[IKE] sending draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Dec  3 22:21:31 moon charon: 14[ENC] added payload of type VENDOR_ID_V1 to message
Dec  3 22:21:31 moon charon: 14[IKE] initiating Main Mode IKE_SA conn[2] to 2.2.2.2
Dec  3 22:21:31 moon charon: 14[IKE] IKE_SA conn[2] state change: CREATED => CONNECTING
...
ec  3 22:21:31 moon charon: 16[IKE] received DPD vendor ID
Dec  3 22:21:31 moon charon: 16[IKE] received NAT-T (RFC 3947) vendor ID
Dec  3 22:21:31 moon charon: 16[ENC] received unknown vendor ID: 69:93:69:22:87:41:c6:d4:ca:09:4c:93:e2:42:c9:de:19:e7:b7:c6:00:00:00:05:00:00:05:00
Dec  3 22:21:31 moon charon: 16[IKE] reinitiating already active tasks
Dec  3 22:21:31 moon charon: 16[IKE]   ISAKMP_VENDOR task
Dec  3 22:21:31 moon charon: 16[IKE]   MAIN_MODE task
Dec  3 22:21:31 moon charon: 16[ENC] added payload of type KEY_EXCHANGE_V1 to message
Dec  3 22:21:31 moon charon: 16[ENC] added payload of type NONCE_V1 to message
...
Dec  3 22:21:31 moon charon: 16[ENC] added payload of type NAT_D_V1 to message
Dec  3 22:21:31 moon charon: 16[ENC] generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
Dec  3 22:21:31 moon charon: 16[ENC] not encrypting payloads
Dec  3 22:21:31 moon charon: 16[ENC] generating payload of type HEADER
Dec  3 22:21:31 moon charon: 16[ENC]   generating rule 0 IKE_SPI
...
Dec  3 22:21:31 moon charon: 06[ENC] parsed ID_PROT response 0 [ ID HASH ]
Dec  3 22:21:31 moon charon: 06[IKE] IKE_SA conn[2] established between 1.1.1.1[1.1.1.1]...2.2.2.2[2.2.2.2]
Dec  3 22:21:31 moon charon: 06[IKE] IKE_SA conn[2] state change: CONNECTING => ESTABLISHED
Dec  3 22:21:31 moon charon: 06[IKE] scheduling rekeying in 85857s
Dec  3 22:21:31 moon charon: 06[IKE] maximum IKE_SA lifetime 86397s
Dec  3 22:21:31 moon charon: 06[IKE] queueing MODE_CONFIG task
Dec  3 22:21:31 moon charon: 06[IKE] activating new tasks
Dec  3 22:21:31 moon charon: 06[IKE]   activating MODE_CONFIG task
Dec  3 22:21:31 moon charon: 06[ENC] added payload of type CONFIGURATION_V1 to message
Dec  3 22:21:31 moon charon: 06[ENC] order payloads in message
Dec  3 22:21:31 moon charon: 06[ENC] added payload of type CONFIGURATION_V1 to message
Dec  3 22:21:31 moon charon: 06[ENC] generating TRANSACTION request 1557479715 [ HASH CPRQ(ADDR DNS) ]
Dec  3 22:21:31 moon charon: 06[ENC] insert payload HASH_V1 into encrypted payload
Dec  3 22:21:31 moon charon: 06[ENC] insert payload CONFIGURATION_V1 into encrypted payload
Dec  3 22:21:31 moon charon: 06[ENC] generating payload of type HEADER
Dec  3 22:21:31 moon charon: 06[ENC]   generating rule 0 IKE_SPI
...
Dec  3 22:21:31 moon charon: 08[ENC] parsed content of encrypted payload
Dec  3 22:21:31 moon charon: 08[ENC] insert decrypted payload of type HASH_V1 at end of list
Dec  3 22:21:31 moon charon: 08[ENC] verifying message structure
Dec  3 22:21:31 moon charon: 08[ENC] found payload of type HASH_V1
Dec  3 22:21:31 moon charon: 08[ENC] payload of type CONFIGURATION_V1 not occurred 1 times (0)
Dec  3 22:21:31 moon charon: 08[IKE] **message verification failed**
Dec  3 22:21:31 moon charon: 08[ENC] added payload of type NOTIFY_V1 to message
Dec  3 22:21:31 moon charon: 08[ENC] order payloads in message
Dec  3 22:21:31 moon charon: 08[ENC] added payload of type NOTIFY_V1 to message
Dec  3 22:21:31 moon charon: 08[ENC] generating INFORMATIONAL_V1 request 3329228680 [ HASH N(PLD_MAL) ]
Dec  3 22:21:31 moon charon: 08[ENC] insert payload HASH_V1 into encrypted payload
Dec  3 22:21:31 moon charon: 08[ENC] insert payload NOTIFY_V1 into encrypted payload
...
Dec  3 22:21:31 moon charon: 08[ENC]   generating rule 14 SPI
Dec  3 22:21:31 moon charon: 08[ENC]   generating rule 15 CHUNK_DATA
Dec  3 22:21:31 moon charon: 08[ENC] generating NOTIFY_V1 payload finished
Dec  3 22:21:31 moon charon: 08[ENC] generated content in encrypted payload
Dec  3 22:21:31 moon charon: 08[ENC] generating payload of type ENCRYPTED_V1
Dec  3 22:21:31 moon charon: 08[ENC]   generating rule 0 ENCRYPTED_DATA
Dec  3 22:21:31 moon charon: 08[ENC] generating ENCRYPTED_V1 payload finished
Dec  3 22:21:31 moon charon: 08[NET] sending packet: from 1.1.1.1[500] to 2.2.2.2[500] (76 bytes)
Dec  3 22:21:31 moon charon: 08[IKE] TRANSACTION response with message ID 1557479715 processing failed
Dec  3 22:21:35 moon charon: 05[IKE] sending retransmit 1 of request message ID 1557479715, seq 4
Dec  3 22:21:35 moon charon: 05[NET] sending packet: from 1.1.1.1[500] to 2.2.2.2[500] (76 bytes)
Dec  3 22:21:37 moon charon: 03[ENC] parsing header of message
Dec  3 22:21:37 moon charon: 03[ENC] parsing HEADER payload, 248 bytes left
Dec  3 22:21:37 moon charon: 03[ENC]   parsing rule 0 IKE_SPI
Dec  3 22:21:37 moon charon: 03[ENC]   parsing rule 1 IKE_SPI
Dec  3 22:21:37 moon charon: 03[ENC]   parsing rule 2 U_INT_8
...
Dec  3 22:22:19 moon charon: 03[ENC]   parsing rule 12 FLAG
Dec  3 22:22:19 moon charon: 03[ENC]   parsing rule 13 FLAG
Dec  3 22:22:19 moon charon: 03[ENC]   parsing rule 14 U_INT_32
Dec  3 22:22:19 moon charon: 03[ENC]   parsing rule 15 HEADER_LENGTH
Dec  3 22:22:19 moon charon: 03[ENC] parsing HEADER payload finished
Dec  3 22:22:19 moon charon: 03[ENC] parsed a ID_PROT message header
Dec  3 22:22:27 moon charon: 00[DMN] signal of type SIGINT received. Shutting down
Dec  3 22:22:27 moon charon: 00[IKE] queueing ISAKMP_DELETE task
Dec  3 22:22:27 moon charon: 00[IKE] activating new tasks
Dec  3 22:22:27 moon charon: 00[IKE]   activating ISAKMP_DELETE task
Dec  3 22:22:27 moon charon: 00[IKE] deleting IKE_SA conn[2] between 1.1.1.1[1.1.1.1]...2.2.2.2[2.2.2.2]
Dec  3 22:22:27 moon charon: 00[ENC] added payload of type DELETE_V1 to message
Dec  3 22:22:27 moon charon: 00[IKE] sending DELETE for IKE_SA conn[2]
Dec  3 22:22:27 moon charon: 00[IKE] IKE_SA conn[2] state change: ESTABLISHED => DELETING
Dec  3 22:22:27 moon charon: 00[ENC] order payloads in message
Dec  3 22:22:27 moon charon: 00[ENC] added payload of type DELETE_V1 to message
Dec  3 22:22:27 moon charon: 00[ENC] generating INFORMATIONAL_V1 request 4291887391 [ HASH D ]
Dec  3 22:22:27 moon charon: 00[ENC] insert payload HASH_V1 into encrypted payload
Dec  3 22:22:27 moon charon: 00[ENC] insert payload DELETE_V1 into encrypted payload
Dec  3 22:22:27 moon charon: 00[ENC] generating payload of type HEADER
Dec  3 22:22:27 moon charon: 00[ENC]   generating rule 0 IKE_SPI

** N.B. ... message verification failed

... TRANSACTION response with message ID 1557479715 processing failed **

The SPIs do not match because unfortunately the memory of the console was finished!

The counterpart is not managed by me, in this case I don't know which router they use (maybe a Cisco) and then very complicated to ask for changes, while for the other 2 cases I know that they use Checkpoint and Zeroshell routers.

  • You've (had to) split your question into three parts because of its length. I will be removing the other two parts, which were erroneously posted as "Answers". Please consider which portion(s) of the content are most critical to the question and then edit them into your question. Thank you! – Jeff Schaller Dec 4 '19 at 13:04
  • the log is used to correctly understand the nature of my question, cutting it to lose the sense of the log – manstt Dec 4 '19 at 13:21
  • If you absolutely cannot fit the important parts into your question, you could look into third-party "paste bin" type sites; or, wait for a knowledgeable person to visit your question and ask for the pertinent pieces, which could then be edited in. – Jeff Schaller Dec 4 '19 at 13:31
  • ok thank you, i try to cut my log – manstt Dec 4 '19 at 14:06
  • You probably don't want to configure leftsourceip, it triggers a Mode Config exchange to request a virtual IP address from the peer, which it probably doesn't expect and you don't need anyway for a site-to-site tunnel. – ecdsa Dec 4 '19 at 17:37
0

Configuring leftsourceip causes strongSwan to request a virtual IP address from the responder. These are mostly useful for remote-access/roadwarrrior scenarios but not so much for site-to-site connections, which the traffic selectors (left|rightsubnet) imply here (i.e. they are both subnets).

For IKEv1, requesting a virtual IP means a Mode Config (TRANSACTION) exchange in which configuration attributes are requested (there are two modes actually, but "pull" mode is the default). If the peer doesn't expect such an additional exchange, as seems to be the case here, the connection will never be established successfully. So to fix this, just remove/comment the leftsourceip option.

The actual source IP used by this host inside the tunnel is determined by the negotiated local traffic selector (leftsubnet). If the host has an IP address in one of the negotiated local subnets, strongSwan will automatically install routes in routing table 220 to force that IP address as source for traffic into the remote subnets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.