Also, I have installed strongSwan using synaptic, that generated server sertificates and placed them in /etc/ipsec.d/certs/ directory.<br><br>There was no certificate under /etc/ipsec.d/cacerts/ directory, so I generated them using :<br>
"<span style="color: rgb(0, 0, 153);">openssl req -x509 -days 1460 -newkey rsa:2048 -keyout strongswanKey.pem -out strongswanCert.pem</span>"<br><br>I have not changed the server certificates.<br><br>I did same on roadwarrior machine...is that proper to do?<br>
<br clear="all">Regards<br>Pankaj Gupta<br>
<br><br><div class="gmail_quote">On Thu, Apr 15, 2010 at 7:22 PM, pankaj gupta <span dir="ltr"><<a href="mailto:beckman16@gmail.com">beckman16@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Also, does anyone have any virtual machine configured as strongSwan gateway?...I would be of great help if anyone have.<div><br clear="all">Regards<br><font color="#888888">Pankaj Gupta</font><div><div></div><div class="h5">
<br>
<br><br><div class="gmail_quote">On Thu, Apr 15, 2010 at 7:21 PM, pankaj gupta <span dir="ltr"><<a href="mailto:beckman16@gmail.com" target="_blank">beckman16@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Hi community,<div><br></div><div>I am pretty desperate to make strongSwan work since last one week, but didnt succeded.</div><div><br></div><div>I configured using README of strongswan 4.3.6 but connection is not working.</div>
<div><br></div><div><div>I configured /etc/ipsec.conf for roadwarrior case with:</div><div><br></div><div><font color="#000099"> <a href="http://10.1.0.0/16" target="_blank">10.1.0.0/16</a> -- | 192.168.1.24 | === | 192.168.1.21 |</font></div>
<div><font color="#000099"> karmic-net karmic pankaj-desktop</font></div><div><br></div><div>contents of /etc/ipsec.conf:</div></div><blockquote style="border: medium none ; margin: 0pt 0pt 0pt 40px; padding: 0px;">
<div><div><font color="#000099">config setup</font></div></div><div><div><font color="#000099"> plutodebug=control</font></div></div><div><div><font color="#000099"> crlcheckinterval=180</font></div>
</div><div><div><font color="#000099"> strictcrlpolicy=no</font></div></div><div><div><font color="#000099"> charonstart=no</font></div></div><div><div><font color="#000099"><br>
</font></div></div><div><div><font color="#000099"># Add connections here.</font></div></div><div><div><font color="#000099"><br></font></div></div><div><div><font color="#000099">conn %default</font></div>
</div><div><div><font color="#000099"> ikelifetime=60m</font></div></div><div><div><font color="#000099"> keylife=20m</font></div></div><div><div><font color="#000099"> rekeymargin=3m</font></div>
</div><div><div><font color="#000099"> keyingtries=1</font></div></div><div><div><font color="#000099"> left=192.168.1.24</font></div></div><div><div><font color="#000099"> leftcert=karmicCert.pem</font></div>
</div><div><div><font color="#000099"> leftid=@karmic</font></div></div><div><div><font color="#000099"> leftfirewall=yes</font></div></div><div><div><font color="#000099"><br>
</font></div></div><div><div><font color="#000099">conn net-net</font></div></div><div><div><font color="#000099"> leftsubnet=<a href="http://10.1.0.0/16" target="_blank">10.1.0.0/16</a></font></div>
</div><div><div><font color="#000099"> right=192.168.1.21</font></div></div><div><div><font color="#000099"> rightsubnet=<a href="http://10.2.0.0/16" target="_blank">10.2.0.0/16</a></font></div>
</div><div><div><font color="#000099"> rightid=@pankaj-desktop</font></div></div><div><div><font color="#000099"> auto=add</font></div></div><div><div><font color="#000099"><br>
</font></div></div><div><div><font color="#000099">conn host-host</font></div></div><div><div><font color="#000099"> right=192.168.1.21</font></div></div><div><div>
<font color="#000099"> rightid=@pankaj-desktop</font></div></div><div><div><font color="#000099"> auto=add</font></div></div><div><div><font color="#000099"><br>
</font></div></div><div><div><font color="#000099">conn rw</font></div></div><div><div><font color="#000099"> left=192.168.1.21</font></div></div><div><div><font color="#000099"> leftsubnet=<a href="http://10.1.0.0/16" target="_blank">10.1.0.0/16</a></font></div>
</div><div><div><font color="#000099"> leftcert=karmicCert.pem</font></div></div><div><div><font color="#000099"> right=%any</font></div></div><div><div><font color="#000099"> auto=add</font></div>
</div></blockquote><div><div><br></div><div><br></div><div>I have configured certificates and roadwarrior machine(pankaj-desktop) as well.</div><div><br></div><div>Now, I cannot ping 10.1.0.1 from pankaj-desktop(roadwarrior).</div>
<div>Also commands like 'ipsec status', 'ipsec listcerts' they are not showing any result.</div><div><br></div><div>Do you see any problem in this configuration?</div><div><br></div><div>Please help me configuring this. Let me know any other diagnosis result you need to know in this regard.</div>
<div><br></div><div>this is part of the log from /usr/log/auth.log:</div><div><br></div></div><blockquote style="border: medium none ; margin: 0pt 0pt 0pt 40px; padding: 0px;"><div><div><font color="#000099">Apr 15 18:35:01 karmic CRON[24082]: pam_unix(cron:session): session closed for user root</font></div>
</div><div><div><font color="#000099">Apr 15 18:38:32 karmic ipsec_starter[24120]: Starting strongSwan 4.3.6 IPsec [starter]...</font></div></div><div><div><font color="#000099">Apr 15 18:38:43 karmic ipsec_starter[24133]: pluto too long to start... - kill kill</font></div>
</div><div><div><font color="#000099">Apr 15 18:38:45 karmic ipsec_starter[24135]: Starting strongSwan 4.3.6 IPsec [starter]...</font></div></div><div><div><font color="#000099">Apr 15 18:38:55 karmic ipsec_starter[24160]: pluto too long to start... - kill kill</font></div>
</div><div><div><font color="#000099">Apr 15 18:38:56 karmic ipsec_starter[24160]: connect(pluto_ctl) failed: No such file or directory</font></div></div><div><div><font color="#000099">Apr 15 18:39:01 karmic last message repeated 3 times</font></div>
</div><div><div><font color="#000099">Apr 15 18:39:02 karmic ipsec_starter[24160]: starter_stop_pluto(): pluto does not respond, sending KILL</font></div></div><div><div><font color="#000099">Apr 15 18:39:03 karmic ipsec_starter[24160]: starter_stop_pluto(): can't stop pluto !!!</font></div>
</div><div><div><font color="#000099">Apr 15 18:39:03 karmic starter[24160]: ipsec starter stopped</font></div></div><div><div><font color="#000099">Apr 15 18:40:01 karmic CRON[24190]: pam_unix(cron:session): session opened for user root by (uid=0)</font></div>
</div></blockquote><div><div><br></div><div>when I run starter with debugging:</div><div><br></div></div><blockquote style="border: medium none ; margin: 0pt 0pt 0pt 40px; padding: 0px;"><div><div><font color="#000099">root@karmic:~# /usr/libexec/ipsec/starter --debug-all</font></div>
</div><div><div><font color="#000099">Starting strongSwan 4.3.6 IPsec [starter]...</font></div></div><div><div><font color="#000099">| Default route found: iface=eth0, addr=192.168.1.24, nexthop=192.168.1.1</font></div>
</div><div><div><font color="#000099">| Loading config setup</font></div></div><div><div><font color="#000099">| plutodebug=all</font></div></div><div><div><font color="#000099"><br>
</font></div></div><div><div><font color="#000099">| crlcheckinterval=180</font></div></div><div><div><font color="#000099">| strictcrlpolicy=no</font></div></div><div>
<div><font color="#000099">| charonstart=no</font></div></div><div><div><font color="#000099">| Loading conn %default</font></div></div><div><div><font color="#000099"><br>
</font></div></div><div><div><font color="#000099">| ikelifetime=60m</font></div></div><div><div><font color="#000099">| keylife=20m</font></div></div><div><div><font color="#000099">| rekeymargin=3m</font></div>
</div><div><div><font color="#000099">| keyingtries=1</font></div></div><div><div><font color="#000099">| left=192.168.1.24</font></div></div><div><div><font color="#000099">| leftcert=karmicCert.pem</font></div>
</div><div><div><font color="#000099">| leftid=@karmic</font></div></div><div><div><font color="#000099">| leftfirewall=yes</font></div></div><div><div><font color="#000099">| Loading conn 'net-net'</font></div>
</div><div><div><font color="#000099"><br></font></div></div><div><div><font color="#000099">| leftsubnet=<a href="http://10.1.0.0/16" target="_blank">10.1.0.0/16</a></font></div></div>
<div><div><font color="#000099">| right=192.168.1.21</font></div></div><div><div><font color="#000099">| rightsubnet=<a href="http://10.2.0.0/16" target="_blank">10.2.0.0/16</a></font></div>
</div><div><div><font color="#000099">| rightid=@pankaj-desktop</font></div></div><div><div><font color="#000099">| auto=add</font></div></div><div><div><font color="#000099">| Loading conn 'host-host'</font></div>
</div><div><div><font color="#000099"><br></font></div></div><div><div><font color="#000099">| right=192.168.1.21</font></div></div><div><div><font color="#000099">| rightid=@pankaj-desktop</font></div>
</div><div><div><font color="#000099">| auto=add</font></div></div><div><div><font color="#000099">| Loading conn 'rw'</font></div></div><div><div><font color="#000099"><br>
</font></div></div><div><div><font color="#000099">| left=192.168.1.21</font></div></div><div><div><font color="#000099">| leftsubnet=<a href="http://10.1.0.0/16" target="_blank">10.1.0.0/16</a></font></div>
</div><div><div><font color="#000099">| leftcert=karmicCert.pem</font></div></div><div><div><font color="#000099">| right=%any</font></div></div><div><div><font color="#000099">| auto=add</font></div>
</div><div><div><font color="#000099">| Found netkey IPsec stack</font></div></div></blockquote><div><div><br></div><div>that means starter is working fine, right?</div><div><br></div></div>
<div>Regards<br>Pankaj Gupta<br>
</div>
</blockquote></div><br></div></div></div>
</blockquote></div><br>