Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [strongswan]

The tag has no usage guidance.

0
votes
0answers
8 views

Binding Update and Binding ACK [on hold]

I would like to know if a home agent can send a Binding Ack to a mobile node located in the same home network where the home agent also is located using strongSwan or it sends it just if the mobile ...
0
votes
0answers
12 views

No test for echainiv(authenc(hmac(sha256),cbc(aes))) (echainiv(authenc(hmac(sha256-generic),cbc-aes-aesni)))

I am getting this message in my log file while trying to setup a tunnel between a home agent and a mobile node using StrongSwan with mip6d. I can't make the tunnel work between them so I'm wandering ...
0
votes
1answer
26 views

FreeBSD 11.2: how to add the aesni plugin to strongswan?

I installed strongswan using pkg install strongswan But now I've realized I need to have the aesni plugin enabled to optimize my IPsec tunnel. I've already enabled aesni at the OS level. The ...
0
votes
0answers
25 views

how to optimize performance of nfs running inside Strongswan ipsec transport on 10Gb network

Host1: Ubuntu 18.04 Host2: Freebsd 11.2 Here is my situation... I have 2 hosts on a 10G lan that have Strongswan IPsec transport configured between them to secure nfsv3. (Yes, I know nfsv3 is old ...
-1
votes
0answers
22 views

Setup mobility ipv6 [closed]

I am trying to setup a Mobile IPv6 testbed with StrongSwan to implement the IPSec protocol (just with an Home Agent and a Mobile node within a LAN in a virtual box). The problem comes after setting ...
0
votes
1answer
28 views

Logs starting “ipsec start” command

I am trying to take the Mobile IPv6 HOWTO (https://wiki.strongswan.org/projects/strongswan/wiki/HomeAgentSetup) as an example of configuration but when I run the "ipsec start" command I have just one ...
2
votes
1answer
38 views

StrongSwan - ipsec pki command

I would like to know why the first time I run the "ipsec pki" command to get a private key this key is generated quickly, but the next time you try to run the same command to get this key because you ...
0
votes
0answers
69 views

strongswan IKEv2 disable reauth (NetworkManager)

I've set up a VPN connection using IKEv2 to my Draytek router which works for one hour then just disconnects (and I can't reconnect unless I reboot). From what I found so far it might be related to ...
0
votes
0answers
11 views

Geneve Tunnel not working over IPsec encrypted IPv6 connection

I've created a tunnel device pair of type geneve on two nodes connected via IPv6. As long as the connection is "plain" the tunnel works well. nodeA tun ip4/6 <-> nodeA eth ip6 <- -> nodeB ...
1
vote
0answers
95 views

Problem to configure strongSwan on a new machine? [closed]

I'm trying to migrate my strongSwan VPN server to a new machine but it does not work. My public IP address is dynamic and I use DDNS to access my home network from the outside. When I establish a VPN ...
1
vote
1answer
33 views

Routes removed when connecting to multiple VPN connections

When I connect to multiple VPN connections, I lose routes (of the first connected VPN).. Setup 2 strongSwan servers - local_ts: 10.0.64.0/20 - local_ts: 10.0.80.0/20 1 osx client Routing ...
6
votes
1answer
349 views

NAT outbound IPSEC packets using pf on FreeBSD 11 and StrongSwan x FortiGATE

I've been working for more than a week trying to get outbound packets nat'ed to fit a Security Association. This is my (example) scenario: LAN: 1.1.1.0/24 FreeBSD interface: xn0 (Amazon EC2 ...
0
votes
0answers
159 views

Strongswan VPN goes up but no traffic passes

I'm trying to setup a VPN using Strongswan on VPS CentOS Machine with a Cisco device a remote peer. I've done this with success a few times before on Ubuntu boxes but this is the first time I try ...
0
votes
1answer
139 views

strongswan get RANDOM dns

I'm getting a really strange issue on fresh Fedora 28 MATE with an IKEv2 IPSEC VPN. First thing: this VPN is currently used by some other clients (some windows and my old Fedora 26) with NO issue. ...
0
votes
0answers
125 views

Masquerading strongswan ipsec ikev2 RAS clients

I've a VPS in sweden and I want to establish an IKEv2 RAS connection. The connection is established and a valid SA was created. Now I want to masquerade the traffic for 0.0.0.0/0 through the wan ...
1
vote
0answers
110 views

Strongswan - 1:1 NAT [closed]

I would like to start with StrongSwan which looks like the best idea to create an IPSec tunnel with IKEv2, however I`m not sure for which way I should go with configuration. I want to connect 3 sites ...
0
votes
0answers
93 views

Track traffic usage for StrongSwan connection using telegraf

I'm looking to track total traffic usage by a StrongSwan IPSec connection. The initiators and responder are behind NAT so my plan was to have an updown script which adds the necessary firewall rule, ...
0
votes
1answer
247 views

strongswan loads connections but cannot act on them [closed]

I have strongswan setup with a couple of connections in a Centos 7 box. When I do strongswan restart --debug-all it shows me that it's restarting the service and includes the connections in the output....
0
votes
1answer
59 views

VPN site to site via VPS [closed]

I would like to do connection: MY_PC (Private IP) <==> VPS (Public IP) <==> Raspberry Pi (GSM - Private IP). What soultion are You prefare for this connection? I would like to have a MY_PC and a ...
0
votes
0answers
1k views

Routing LAN traffic through ipsec tunnel

I have a linux host ip 172.31.29.44 establishing an ipsec tunnel with a Juniper SRX. The left subnet is 172.31.29.0/24 and the right subnet is 10.32.0.0/11. The tunnel has been established and I am ...
4
votes
0answers
3k views

IPsec VPN with strongSwan to FortiGate

I'm trying to connect to a FortiGate and access our continuous integration server via an IPsec VPN tunnel. I have no control over the FortiGate's configuration. On my laptop running Windows 10, I ...
0
votes
0answers
168 views

Iptables commands causes crash and hangs the root account

I'm setting up a StrongSwan VPN server on an Amazon Ubuntu Server (16.04LTS) instance. I am using this guide. I've completed almost all of the steps, I'm now trying to create iptables rules to allow ...
0
votes
1answer
288 views

how overlapping subnet in 2 SA in strongswan determine which tunnel to go?

i have 2 tunnels of ikev1, with overlapping in leftsubnet and rightsubnet ,how the packet that send know to which tunnel it forward to tunnel first_4a010003 whay is that and how i decide i nwhch ...
0
votes
2answers
2k views

How to create a strongswan VPN connection in Ubuntu 16.04?

The drop down in Edit connections... -> Add -> choose connection type of the network-manager only shows the Point-to-Point Tunneling Protocol (PPTP) although strongswan VPN is installed. Why and ...
1
vote
1answer
242 views

Which vpn service can be implemented without need for Win/Android/iOS client software?

I've configured OpenVPN on CentOS7 to access my office network and it's working fine too. For authentication, it queries an LDAP server and it requires third-party software "OpenVPN client" in windows....
0
votes
0answers
69 views

IPSec - src and dst mac don't change from encrypted to decrypted packets

I am trying to debug an IPSec setup. I have 4 virtualbox vms: client a in address 192.168.224.2/24 My own IPSec gateway with addresses 192.168.224.5/24 and 192.168.10.100/24 A strongswan IPSec ...
1
vote
1answer
789 views

strongswan ikev2 cisco traffic selectors inacceptable [closed]

Trying to connect StrongSwan to a Cisco ASA (not mine) But I get traffic selectors inacceptable In the following logs Shouldn't 172.17.100.198/32 be a public ip address? looking for a child config ...
0
votes
2answers
427 views

bind mounts get removed with network namespaces?

Strongswan daemon puts its .pid and .ctl files in /var/run to detect if it is already running. I want to run multiple of these daemons on the same machine within different network namespaces. I am ...
1
vote
1answer
2k views

How to install missing kernel modules? Is it possible?

My machine: An Ubuntu server 16.04 LTS on a PINE64 with an ARM 64-bit processor (Linux pine64 3.10.105-0-pine64-longsleep #3 SMP PREEMPT Sat Mar 11 16:05:53 CET 2017 aarch64 aarch64 aarch64 GNU/Linux)...
0
votes
1answer
1k views

Strongswan VPN not working unless pinging out manually

We have successfully set up a strongswan vpn on our network to communicate with Google Cloud VPN. Sometimes we leave it idle for a while, let's say a night, that's when the issue appear. If I try to ...
6
votes
1answer
6k views

Strongswan: several right subnets

I have a Strongswan installation on CentOS7 connecting to a Palo Alto router. I have no access to the config on the remote router. I want to configure two subnets on the other side - one is only a ...
2
votes
1answer
2k views

Strongswan forwarding traffic between two IPsec tunnels where one is a host

I'm facing a similar question as described here, but the solution did not work in my scenario. I have a VPN server A with a static external IP address AA.AA.AA.AA, an internal IP of 192.168.1.1 and ...
3
votes
1answer
1k views

Why use strongswan rather than native vpn support

As far as I understand, FreeBSD comes with the native ability to make vpn connections. Ist strongswan a package, that comes on top of the freebsd ipsec stack or is it a replacement?
0
votes
1answer
593 views

VPN configuration: shared secret PSK format

I am using as a customer a commercial VPN for OS/X and iPhone. I am also provisioning VNPs at work for iOS/MacOs, and have a Debian based VPN at home with StrongSwan. I have captured the ....
3
votes
1answer
567 views

Problem with strongSwan

I have a VPN server with Ubuntu and IKEv2 protocol using strongSwan. We create clients using the bash user.sh script, but we have a problem as shown below. When the number of clients increases - to ...
1
vote
1answer
555 views

StrongSwan 5.2.1 on Debian Jessie vs Juniper SSG 550M - Short connection life time

We are trying to establish a persistent VPN connection against a Juniper box. However there is some misconfiguration. When we start the StrongSwan service, the tunnel is up and all traffic go fine. ...