Hi community,<div><br></div><div>I am pretty desperate to make strongSwan work since last one week, but didnt succeded.</div><div><br></div><div>I configured using README of strongswan 4.3.6 but connection is not working.</div>
<div><br></div><div><div>I configured /etc/ipsec.conf for roadwarrior case with:</div><div><br></div><div><font class="Apple-style-span" color="#000099"> <a href="http://10.1.0.0/16">10.1.0.0/16</a> -- | 192.168.1.24 | === | 192.168.1.21 |</font></div>
<div><font class="Apple-style-span" color="#000099"> karmic-net karmic pankaj-desktop</font></div><div><br></div><div>contents of /etc/ipsec.conf:</div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;">
<div><div><font class="Apple-style-span" color="#000099">config setup</font></div></div><div><div><font class="Apple-style-span" color="#000099"> plutodebug=control</font></div></div><div><div><font class="Apple-style-span" color="#000099"> crlcheckinterval=180</font></div>
</div><div><div><font class="Apple-style-span" color="#000099"> strictcrlpolicy=no</font></div></div><div><div><font class="Apple-style-span" color="#000099"> charonstart=no</font></div></div><div><div><font class="Apple-style-span" color="#000099"><br>
</font></div></div><div><div><font class="Apple-style-span" color="#000099"># Add connections here.</font></div></div><div><div><font class="Apple-style-span" color="#000099"><br></font></div></div><div><div><font class="Apple-style-span" color="#000099">conn %default</font></div>
</div><div><div><font class="Apple-style-span" color="#000099"> ikelifetime=60m</font></div></div><div><div><font class="Apple-style-span" color="#000099"> keylife=20m</font></div></div><div><div><font class="Apple-style-span" color="#000099"> rekeymargin=3m</font></div>
</div><div><div><font class="Apple-style-span" color="#000099"> keyingtries=1</font></div></div><div><div><font class="Apple-style-span" color="#000099"> left=192.168.1.24</font></div></div><div><div><font class="Apple-style-span" color="#000099"> leftcert=karmicCert.pem</font></div>
</div><div><div><font class="Apple-style-span" color="#000099"> leftid=@karmic</font></div></div><div><div><font class="Apple-style-span" color="#000099"> leftfirewall=yes</font></div></div><div><div><font class="Apple-style-span" color="#000099"><br>
</font></div></div><div><div><font class="Apple-style-span" color="#000099">conn net-net</font></div></div><div><div><font class="Apple-style-span" color="#000099"> leftsubnet=<a href="http://10.1.0.0/16">10.1.0.0/16</a></font></div>
</div><div><div><font class="Apple-style-span" color="#000099"> right=192.168.1.21</font></div></div><div><div><font class="Apple-style-span" color="#000099"> rightsubnet=<a href="http://10.2.0.0/16">10.2.0.0/16</a></font></div>
</div><div><div><font class="Apple-style-span" color="#000099"> rightid=@pankaj-desktop</font></div></div><div><div><font class="Apple-style-span" color="#000099"> auto=add</font></div></div><div><div><font class="Apple-style-span" color="#000099"><br>
</font></div></div><div><div><font class="Apple-style-span" color="#000099">conn host-host</font></div></div><div><div><font class="Apple-style-span" color="#000099"> right=192.168.1.21</font></div></div><div><div>
<font class="Apple-style-span" color="#000099"> rightid=@pankaj-desktop</font></div></div><div><div><font class="Apple-style-span" color="#000099"> auto=add</font></div></div><div><div><font class="Apple-style-span" color="#000099"><br>
</font></div></div><div><div><font class="Apple-style-span" color="#000099">conn rw</font></div></div><div><div><font class="Apple-style-span" color="#000099"> left=192.168.1.21</font></div></div><div><div><font class="Apple-style-span" color="#000099"> leftsubnet=<a href="http://10.1.0.0/16">10.1.0.0/16</a></font></div>
</div><div><div><font class="Apple-style-span" color="#000099"> leftcert=karmicCert.pem</font></div></div><div><div><font class="Apple-style-span" color="#000099"> right=%any</font></div></div><div><div><font class="Apple-style-span" color="#000099"> auto=add</font></div>
</div></blockquote><div><div><br></div><div><br></div><div>I have configured certificates and roadwarrior machine(pankaj-desktop) as well.</div><div><br></div><div>Now, I cannot ping 10.1.0.1 from pankaj-desktop(roadwarrior).</div>
<div>Also commands like 'ipsec status', 'ipsec listcerts' they are not showing any result.</div><div><br></div><div>Do you see any problem in this configuration?</div><div><br></div><div>Please help me configuring this. Let me know any other diagnosis result you need to know in this regard.</div>
<div><br></div><div>this is part of the log from /usr/log/auth.log:</div><div><br></div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div><font class="Apple-style-span" color="#000099">Apr 15 18:35:01 karmic CRON[24082]: pam_unix(cron:session): session closed for user root</font></div>
</div><div><div><font class="Apple-style-span" color="#000099">Apr 15 18:38:32 karmic ipsec_starter[24120]: Starting strongSwan 4.3.6 IPsec [starter]...</font></div></div><div><div><font class="Apple-style-span" color="#000099">Apr 15 18:38:43 karmic ipsec_starter[24133]: pluto too long to start... - kill kill</font></div>
</div><div><div><font class="Apple-style-span" color="#000099">Apr 15 18:38:45 karmic ipsec_starter[24135]: Starting strongSwan 4.3.6 IPsec [starter]...</font></div></div><div><div><font class="Apple-style-span" color="#000099">Apr 15 18:38:55 karmic ipsec_starter[24160]: pluto too long to start... - kill kill</font></div>
</div><div><div><font class="Apple-style-span" color="#000099">Apr 15 18:38:56 karmic ipsec_starter[24160]: connect(pluto_ctl) failed: No such file or directory</font></div></div><div><div><font class="Apple-style-span" color="#000099">Apr 15 18:39:01 karmic last message repeated 3 times</font></div>
</div><div><div><font class="Apple-style-span" color="#000099">Apr 15 18:39:02 karmic ipsec_starter[24160]: starter_stop_pluto(): pluto does not respond, sending KILL</font></div></div><div><div><font class="Apple-style-span" color="#000099">Apr 15 18:39:03 karmic ipsec_starter[24160]: starter_stop_pluto(): can't stop pluto !!!</font></div>
</div><div><div><font class="Apple-style-span" color="#000099">Apr 15 18:39:03 karmic starter[24160]: ipsec starter stopped</font></div></div><div><div><font class="Apple-style-span" color="#000099">Apr 15 18:40:01 karmic CRON[24190]: pam_unix(cron:session): session opened for user root by (uid=0)</font></div>
</div></blockquote><div><div><br></div><div>when I run starter with debugging:</div><div><br></div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div><font class="Apple-style-span" color="#000099">root@karmic:~# /usr/libexec/ipsec/starter --debug-all</font></div>
</div><div><div><font class="Apple-style-span" color="#000099">Starting strongSwan 4.3.6 IPsec [starter]...</font></div></div><div><div><font class="Apple-style-span" color="#000099">| Default route found: iface=eth0, addr=192.168.1.24, nexthop=192.168.1.1</font></div>
</div><div><div><font class="Apple-style-span" color="#000099">| Loading config setup</font></div></div><div><div><font class="Apple-style-span" color="#000099">| plutodebug=all</font></div></div><div><div><font class="Apple-style-span" color="#000099"><br>
</font></div></div><div><div><font class="Apple-style-span" color="#000099">| crlcheckinterval=180</font></div></div><div><div><font class="Apple-style-span" color="#000099">| strictcrlpolicy=no</font></div></div><div>
<div><font class="Apple-style-span" color="#000099">| charonstart=no</font></div></div><div><div><font class="Apple-style-span" color="#000099">| Loading conn %default</font></div></div><div><div><font class="Apple-style-span" color="#000099"><br>
</font></div></div><div><div><font class="Apple-style-span" color="#000099">| ikelifetime=60m</font></div></div><div><div><font class="Apple-style-span" color="#000099">| keylife=20m</font></div></div><div><div><font class="Apple-style-span" color="#000099">| rekeymargin=3m</font></div>
</div><div><div><font class="Apple-style-span" color="#000099">| keyingtries=1</font></div></div><div><div><font class="Apple-style-span" color="#000099">| left=192.168.1.24</font></div></div><div><div><font class="Apple-style-span" color="#000099">| leftcert=karmicCert.pem</font></div>
</div><div><div><font class="Apple-style-span" color="#000099">| leftid=@karmic</font></div></div><div><div><font class="Apple-style-span" color="#000099">| leftfirewall=yes</font></div></div><div><div><font class="Apple-style-span" color="#000099">| Loading conn 'net-net'</font></div>
</div><div><div><font class="Apple-style-span" color="#000099"><br></font></div></div><div><div><font class="Apple-style-span" color="#000099">| leftsubnet=<a href="http://10.1.0.0/16">10.1.0.0/16</a></font></div></div>
<div><div><font class="Apple-style-span" color="#000099">| right=192.168.1.21</font></div></div><div><div><font class="Apple-style-span" color="#000099">| rightsubnet=<a href="http://10.2.0.0/16">10.2.0.0/16</a></font></div>
</div><div><div><font class="Apple-style-span" color="#000099">| rightid=@pankaj-desktop</font></div></div><div><div><font class="Apple-style-span" color="#000099">| auto=add</font></div></div><div><div><font class="Apple-style-span" color="#000099">| Loading conn 'host-host'</font></div>
</div><div><div><font class="Apple-style-span" color="#000099"><br></font></div></div><div><div><font class="Apple-style-span" color="#000099">| right=192.168.1.21</font></div></div><div><div><font class="Apple-style-span" color="#000099">| rightid=@pankaj-desktop</font></div>
</div><div><div><font class="Apple-style-span" color="#000099">| auto=add</font></div></div><div><div><font class="Apple-style-span" color="#000099">| Loading conn 'rw'</font></div></div><div><div><font class="Apple-style-span" color="#000099"><br>
</font></div></div><div><div><font class="Apple-style-span" color="#000099">| left=192.168.1.21</font></div></div><div><div><font class="Apple-style-span" color="#000099">| leftsubnet=<a href="http://10.1.0.0/16">10.1.0.0/16</a></font></div>
</div><div><div><font class="Apple-style-span" color="#000099">| leftcert=karmicCert.pem</font></div></div><div><div><font class="Apple-style-span" color="#000099">| right=%any</font></div></div><div><div><font class="Apple-style-span" color="#000099">| auto=add</font></div>
</div><div><div><font class="Apple-style-span" color="#000099">| Found netkey IPsec stack</font></div></div></blockquote><div><div><br></div><div>that means starter is working fine, right?</div><div><br></div></div>
<div>Regards<br>Pankaj Gupta<br>
</div>