Questions tagged [strongswan]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
24 views

Building strongSwan from source

I'm having huge trouble with getting strongswan to work. I'd like to try the newest version and customize it with plugins. I'm following the instruction available here: https://wiki.strongswan.org/...
1
vote
0answers
104 views

Ubuntu IKEv1 IPSec alternative to strongSwan

I'm trying to connect to my work VPN which uses IKEv1/IPSec and authenticates with a preshared key however it appears strongSwan has a PSK limitation restricting PSKs to 20 characters or longer (even ...
0
votes
0answers
104 views

strongSwan IPSec VPN connection - peer not responding

NOTE: IPs shown here are not the actual IPs I'm using. They are random just IPs. I have created a tunnel from an Ubuntu server to a Cisco device, using strongSwan. The tunnel looks ok. status of IKE ...
0
votes
1answer
29 views

How do I route traffic back over a VPN to other servers

I am currently setting up an environment in 2 sites. all servers are linux/ubuntu. First site is my office and second site is AWS. I have 2 servers in AWS within a VPC with site to site VPN Web01 - ...
0
votes
0answers
224 views

Dealing with XFRM policies Using Strongswan VTI tunnel with Amazon VPC

I can't make CentOS Strongswan VTI route-based connection to AWS VPC Connection to Work. I did successful BGP connection. But when trying to ping the AWS instance from That Linux box I see that the ...
1
vote
1answer
316 views

networkmanager-strongswan vpn - routing specific ip through VPN

I'm trying to setting a VPN on Linux Mint 19.2. I'm using the network-manager-strongswan so I added this file named VPN under /etc/NetworkManager/system-connections/ [connection] id=VPN uuid=...
0
votes
1answer
50 views

Strongswan only last person connected routed through tunnel

I have site2site VPN tunnel using StrongSwan. Everything seems to work - except only last connected person gets the access. I.e. I connect from PC1, can ping server on the other side, connect from PC2,...
2
votes
0answers
60 views

Strongswan AUTH_FAILED

I am trying to configure VPN server Strongswan and have a problem: the server always sends to the clients the following response: IKE_AUTH [ N(AUTH_FAILED) ] I've tried to change log level editing ...
0
votes
0answers
26 views

force network routing out different interface

I have 3 interfaces: eth0 accepts vpn connections from two networks, eth2 should route traffic from netA through it, and eth3 should route traffic from netB through it. netA eth2 &...
0
votes
0answers
25 views

improving IPSec traffic on Centos 7

I need suggestions for improving IPSec performance on Centos 7 with Strongswan. I got quite good server with 4 x X710 (10GbE). So far - with ~4 IPSec tunnels i'm able to get ~2GB/s of mixed in and out ...
1
vote
1answer
203 views

Network Manager plugin for Strongswan won't show pre shred key authentication option

this was originally the second part of my question here How to start a swanctl.conf configured tunnel automatically Environment: Debian 10, KDE, Full desktop # ipsec --version Linux strongSwan U5.7....
1
vote
1answer
2k views

How to start a swanctl.conf configured tunnel automatically

Environment: Debian 10, KDE, Full desktop # ipsec --version Linux strongSwan U5.7.2/K4.19.0-6-amd64 # swanctl --version strongSwan swanctl 5.7.2 # systemctl status strongswan ● strongswan.service - ...
0
votes
0answers
60 views

StrongSwan IKE2 policy based routing

I'm using StringSwan 5.7.2 on Debian One as roadwarrior server and second is a client I used the configuration from the official examples It works nice. But, I'd like to have separate interfaces for ...
0
votes
1answer
260 views

Replace racoon with strongswan

I should switch from the racoon daemon (discarded) to the new demove charon strongswan. In practice I have about a dozen suppliers with which to change all the vpn in a "single" shot. I recreated all ...
2
votes
1answer
72 views

Strongswan several subnet problem with vpn racoon

I should migrate the current racoon daemon to strongswan on some routers. To do this in operation I have to be able to install strongswan a little at a time, which will have to run a vpn with the ...
0
votes
2answers
497 views

Route (docker) container traffic through IPSec

I have a ipsec (strongswan) connection to work, which in itself works fine, however traffic from containers doesn't seem to go through the ipsec tunnel. This is not expected from an end-user ...
0
votes
1answer
388 views

Roadwarrior scenario strongswan- Iphone setup

I'm working on trying to set up a roadwarrior client scenarion VPN with Stringswan on a raspberry pi. The server config looks like this: pi@raspberrypi:~ $ sudo cat /etc/ipsec.conf # ipsec.conf - ...
0
votes
0answers
1k views

Strongswan ikev2 “unable to resolve %any, initiate aborted”

I'm trying to get started with strongswan. I've got the following config file: pi@raspberrypi:~ $ cat /etc/ipsec.conf #ipsec.conf - strongSwan IPsec configuration file config setup uniqueids=never ...
1
vote
0answers
169 views

Connecting Win 10 roadwarrior to AWS strongSwan VPN - not able to find a certificate usable with Extensible Authentication Protocol

I managed to connect two AWS subnets in different zones over strongSwan VPN using ike2 with the aes256 encryption. So, Master CA key is created, self-signed CA certificate, as well as private and ...
2
votes
0answers
299 views

strongSwan lan to lan / PKI RSA self CA - tunnel (0 up, 1 connecting), just the RSA tunnel without using of the self CA works fine

I am trying to create an x.509 based tunnel by using a self-signed CA certificate. I am creating the solution at the AWS, and VPN gateways are Debian Stretch machines version Linux ip-10-0-0-208 4....
3
votes
1answer
589 views

IPsec IKEv2 succesful but Linux VTI does not work with SNAT

If you think troubleshooting IPsec is tedious, please forget about my logs and just let me know the implementation process, I'm still confused and any information is helpful. I removed SPIs and here ...
1
vote
1answer
362 views

Install Linux Kernel modules

I'm setting up IPSec VPN and I have met an error which upon searching I found the error actually means required kernel modules are missing. That prompted me to check that with lsmod and kmod list but ...
1
vote
0answers
501 views

Fedora 30 - VPN L2TP IPSEC disconnects short after connection successfully

I am having some problems when configuring VPN in my envrionment. For Mac and Windows users works normally but for me it connects and disconnects shortly after. The Router alghoritm: My IPSEC ...
0
votes
1answer
233 views

fedora strongswan resolvconf: Interface can't be the loopback interface

I am getting this error when trying to use sudo strongswan up CONNECTION_NAME on Fedora 29 installing DNS server ###.##.#.## via resolvconf resolvconf: Interface can't be the loopback interface (lo). ...
0
votes
1answer
307 views

FreeBSD 11.2: how to add the aesni plugin to strongswan?

I installed strongswan using pkg install strongswan But now I've realized I need to have the aesni plugin enabled to optimize my IPsec tunnel. I've already enabled aesni at the OS level. The ...
0
votes
0answers
510 views

how to optimize performance of nfs running inside Strongswan ipsec transport on 10Gb network

Host1: Ubuntu 18.04 Host2: Freebsd 11.2 Here is my situation... I have 2 hosts on a 10G lan that have Strongswan IPsec transport configured between them to secure nfsv3. (Yes, I know nfsv3 is old ...
0
votes
1answer
1k views

Logs starting “ipsec start” command

I am trying to take the Mobile IPv6 HOWTO (https://wiki.strongswan.org/projects/strongswan/wiki/HomeAgentSetup) as an example of configuration but when I run the "ipsec start" command I have just one ...
2
votes
1answer
209 views

StrongSwan - ipsec pki command

I would like to know why the first time I run the "ipsec pki" command to get a private key this key is generated quickly, but the next time you try to run the same command to get this key because you ...
1
vote
1answer
49 views

Routes removed when connecting to multiple VPN connections

When I connect to multiple VPN connections, I lose routes (of the first connected VPN).. Setup 2 strongSwan servers - local_ts: 10.0.64.0/20 - local_ts: 10.0.80.0/20 1 osx client Routing ...
6
votes
1answer
858 views

NAT outbound IPSEC packets using pf on FreeBSD 11 and StrongSwan x FortiGATE

I've been working for more than a week trying to get outbound packets nat'ed to fit a Security Association. This is my (example) scenario: LAN: 1.1.1.0/24 FreeBSD interface: xn0 (Amazon EC2 ...
0
votes
1answer
264 views

strongswan get RANDOM dns

I'm getting a really strange issue on fresh Fedora 28 MATE with an IKEv2 IPSEC VPN. First thing: this VPN is currently used by some other clients (some windows and my old Fedora 26) with NO issue. ...
0
votes
0answers
399 views

Masquerading strongswan ipsec ikev2 RAS clients

I've a VPS in sweden and I want to establish an IKEv2 RAS connection. The connection is established and a valid SA was created. Now I want to masquerade the traffic for 0.0.0.0/0 through the wan ...
0
votes
0answers
253 views

Track traffic usage for StrongSwan connection using telegraf

I'm looking to track total traffic usage by a StrongSwan IPSec connection. The initiators and responder are behind NAT so my plan was to have an updown script which adds the necessary firewall rule, ...
1
vote
1answer
1k views

strongswan loads connections but cannot act on them [closed]

I have strongswan setup with a couple of connections in a Centos 7 box. When I do strongswan restart --debug-all it shows me that it's restarting the service and includes the connections in the output....
0
votes
1answer
326 views

VPN site to site via VPS [closed]

I would like to do connection: MY_PC (Private IP) <==> VPS (Public IP) <==> Raspberry Pi (GSM - Private IP). What soultion are You prefare for this connection? I would like to have a MY_PC and a ...
7
votes
1answer
9k views

IPsec VPN with strongSwan to FortiGate

I'm trying to connect to a FortiGate and access our continuous integration server via an IPsec VPN tunnel. I have no control over the FortiGate's configuration. On my laptop running Windows 10, I ...
0
votes
0answers
434 views

Iptables commands causes crash and hangs the root account

I'm setting up a StrongSwan VPN server on an Amazon Ubuntu Server (16.04LTS) instance. I am using this guide. I've completed almost all of the steps, I'm now trying to create iptables rules to allow ...
0
votes
1answer
735 views

how overlapping subnet in 2 SA in strongswan determine which tunnel to go?

i have 2 tunnels of ikev1, with overlapping in leftsubnet and rightsubnet ,how the packet that send know to which tunnel it forward to tunnel first_4a010003 whay is that and how i decide i nwhch ...
0
votes
2answers
6k views

How to create a strongswan VPN connection in Ubuntu 16.04?

The drop down in Edit connections... -> Add -> choose connection type of the network-manager only shows the Point-to-Point Tunneling Protocol (PPTP) although strongswan VPN is installed. Why and ...
1
vote
1answer
423 views

Which vpn service can be implemented without need for Win/Android/iOS client software?

I've configured OpenVPN on CentOS7 to access my office network and it's working fine too. For authentication, it queries an LDAP server and it requires third-party software "OpenVPN client" in windows....
1
vote
1answer
2k views

strongswan ikev2 cisco traffic selectors inacceptable [closed]

Trying to connect StrongSwan to a Cisco ASA (not mine) But I get traffic selectors inacceptable In the following logs Shouldn't 172.17.100.198/32 be a public ip address? looking for a child config ...
2
votes
3answers
947 views

bind mounts get removed with network namespaces?

Strongswan daemon puts its .pid and .ctl files in /var/run to detect if it is already running. I want to run multiple of these daemons on the same machine within different network namespaces. I am ...
2
votes
1answer
4k views

How to install missing kernel modules? Is it possible?

My machine: An Ubuntu server 16.04 LTS on a PINE64 with an ARM 64-bit processor (Linux pine64 3.10.105-0-pine64-longsleep #3 SMP PREEMPT Sat Mar 11 16:05:53 CET 2017 aarch64 aarch64 aarch64 GNU/Linux)...
0
votes
1answer
2k views

Strongswan VPN not working unless pinging out manually

We have successfully set up a strongswan vpn on our network to communicate with Google Cloud VPN. Sometimes we leave it idle for a while, let's say a night, that's when the issue appear. If I try to ...
6
votes
1answer
13k views

Strongswan: several right subnets

I have a Strongswan installation on CentOS7 connecting to a Palo Alto router. I have no access to the config on the remote router. I want to configure two subnets on the other side - one is only a ...
2
votes
1answer
4k views

Strongswan forwarding traffic between two IPsec tunnels where one is a host

I'm facing a similar question as described here, but the solution did not work in my scenario. I have a VPN server A with a static external IP address AA.AA.AA.AA, an internal IP of 192.168.1.1 and ...
4
votes
1answer
2k views

Why use strongswan rather than native vpn support

As far as I understand, FreeBSD comes with the native ability to make vpn connections. Ist strongswan a package, that comes on top of the freebsd ipsec stack or is it a replacement?
0
votes
1answer
937 views

VPN configuration: shared secret PSK format

I am using, as a customer, a commercial VPN for OS/X and iPhone. I am also provisioning VNPs at work for iOS/MacOs, and have a Debian based VPN at home with StrongSwan. I have captured the ....
2
votes
1answer
759 views

Problem with strongSwan

I have a VPN server with Ubuntu and IKEv2 protocol using strongSwan. We create clients using the bash user.sh script, but we have a problem as shown below. When the number of clients increases - to ...
1
vote
1answer
694 views

StrongSwan 5.2.1 on Debian Jessie vs Juniper SSG 550M - Short connection life time

We are trying to establish a persistent VPN connection against a Juniper box. However there is some misconfiguration. When we start the StrongSwan service, the tunnel is up and all traffic go fine. ...