<html><body>
<p><font size="2">Hi, </font><br>
<font size="2">I am trying to setup a "host to host" strongswan solution using strongSwan 4.3.4 on OpenSuse 10.2.</font><br>
<br>
<font size="2">I think I have everything setup correctly but I cannot pass encrypted traffic between the host.</font><br>
<br>
<font size="2">I have two servers radius02 and radius03</font><br>
<br>
<font size="2">I think part of my problems lies in this error</font><br>
<font size="2">failed to create a builder for credential type CRED_CERTIFICATE, subtype (1)</font><br>
<br>
<font size="2">Also, do i need some kind of iptables our routing conig to make everything work the documentation is unclear.</font><br>
<br>
<br>
<br>
<font size="2">config for radius02 -> please note where it says sanitized an IP would go there or email address in some cases.</font><br>
<br>
<font size="2">config setup</font><br>
<font size="2"> crlcheckinterval=180</font><br>
<font size="2"> strictcrlpolicy=no</font><br>
<br>
<font size="2">conn host-host</font><br>
<font size="2"> left=%defaultroute</font><br>
<font size="2"> leftcert=radius02Cert.pem</font><br>
<font size="2"> leftsendcert=never</font><br>
<font size="2"> right=sanitized </font><br>
<font size="2"> rightid="C=US, ST=NV, O=allegiant, OU=it, CN=radius03"</font><br>
<font size="2"> rightcert=radius03Cert.pem</font><br>
<font size="2"> auto=start</font><br>
<br>
<br>
<font size="2">Apr 26 14:55:09 radius02 kernel: imklog 4.4.1, log source = /proc/kmsg started.</font><br>
<font size="2">Apr 26 14:55:09 radius02 rsyslogd: [origin software="rsyslogd" swVersion="4.4.1" x-pid="1619" x-info="http://www.rsyslog.com"] (re)start</font><br>
<font size="2">Apr 26 14:55:13 radius02 ipsec_starter[8047]: Starting strongSwan 4.3.4 IPsec [starter]...</font><br>
<font size="2">Apr 26 14:55:13 radius02 modprobe: WARNING: All config files need .conf: /etc/modprobe.d/vmware-tools, it will be ignored in a future release.</font><br>
<font size="2">Apr 26 14:55:13 radius02 modprobe: WARNING: All config files need .conf: /etc/modprobe.d/vmware-tools, it will be ignored in a future release.</font><br>
<font size="2">Apr 26 14:55:13 radius02 modprobe: WARNING: All config files need .conf: /etc/modprobe.d/vmware-tools, it will be ignored in a future release.</font><br>
<font size="2">Apr 26 14:55:13 radius02 modprobe: WARNING: All config files need .conf: /etc/modprobe.d/vmware-tools, it will be ignored in a future release.</font><br>
<font size="2">Apr 26 14:55:13 radius02 modprobe: WARNING: All config files need .conf: /etc/modprobe.d/vmware-tools, it will be ignored in a future release.</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: Starting IKEv1 pluto daemon (strongSwan 4.3.4) THREADS SMARTCARD VENDORID CISCO_QUIRKS</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: loaded plugins: curl ldap aes des sha1 sha2 md5 random pubkey openssl gcrypt hmac gmp </font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: including NAT-Traversal patch (Version 0.6c) [disabled]</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: failed to load pkcs11 module '/usr/lib64/opensc-pkcs11.so'</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: Using Linux 2.6 IPsec interface code</font><br>
<font size="2">Apr 26 14:55:13 radius02 ipsec_starter[8055]: pluto (8056) started after 20 ms</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 01[DMN] Starting IKEv2 charon daemon (strongSwan 4.3.4)</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 01[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'</font><br>
<b><font size="2">Apr 26 14:55:13 radius02 charon: 01[LIB] failed to create a builder for credential type CRED_CERTIFICATE, subtype (1)</font></b><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 01[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 01[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 01[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 01[CFG] loading crls from '/etc/ipsec.d/crls'</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 01[CFG] loading secrets from '/etc/ipsec.secrets'</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 01[CFG] loaded private key file '/etc/ipsec.d/private/strongswanKey.pem'</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 01[CFG] loaded private key file '/etc/ipsec.d/private/radius02Key.pem'</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 01[DMN] loaded plugins: aes des sha1 md5 sha2 hmac gmp random pubkey xcbc stroke x509 </font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 01[JOB] spawning 16 worker threads</font><br>
<font size="2">Apr 26 14:55:13 radius02 ipsec_starter[failed to create a builder for credential type CRED_CERTIFICATE, subtype (1)8055]: charon (8069) started after 20 ms</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 05[CFG] received stroke: add connection 'host-host'</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 05[CFG] left nor right host is our side, assuming left=local</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 05[LIB] loaded certificate file '/etc/ipsec.d/certs/radius02Cert.pem'</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 05[LIB] loaded certificate file '/etc/ipsec.d/certs/radius03Cert.pem'</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 05[CFG] peerid C=US, ST=NV, O=allegiant, OU=it, CN=radius03 not confirmed by certificate, defaulting to subject DN: C=US, ST=NV, O=allegiant, OU=it, CN=radius03, E=sanitized@allegiantair.com</font><br>
<font size="2">Apr 26 14:55:13 radius02 charon: 05[CFG] added configuration 'host-host'</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: Changing to directory '/etc/ipsec.d/cacerts'</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: loaded CA cert file 'strongswanCert.der' (1183 bytes)</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: Changing to directory '/etc/ipsec.d/aacerts'</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: Changing to directory '/etc/ipsec.d/ocspcerts'</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: Changing to directory '/etc/ipsec.d/crls'</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: Changing to directory '/etc/ipsec.d/acerts'</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: listening for IKE messages</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: adding interface eth1/eth1 10.10.0.5:500</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: adding interface lo/lo 127.0.0.2:500</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: adding interface lo/lo 127.0.0.1:500</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: adding interface lo/lo ::1:500</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: loading secrets from "/etc/ipsec.secrets"</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: loaded private key file '/etc/ipsec.d/private/strongswanKey.pem' (1751 bytes)</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: loaded private key file '/etc/ipsec.d/private/radius02Key.pem' (963 bytes)</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: loaded host cert file '/etc/ipsec.d/certs/radius02Cert.pem' (4066 bytes)</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: loaded host cert file '/etc/ipsec.d/certs/radius03Cert.pem' (1342 bytes)</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: added connection description "host-host"</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: "host-host" #1: initiating Main Mode</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: "host-host" #1: ignoring Vendor ID payload [strongSwan 4.3.4]</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: "host-host" #1: ignoring Vendor ID payload [Cisco-Unity]</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: "host-host" #1: received Vendor ID payload [XAUTH]</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: "host-host" #1: received Vendor ID payload [Dead Peer Detection]</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: "host-host" #1: we have a cert but are not sending it </font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: "host-host" #1: Peer ID is ID_DER_ASN1_DN: 'C=US, ST=NV, O=allegiant, OU=it, CN=radius03, E=sanitized@allegiantair.com'</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: "host-host" #1: ISAKMP SA established</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: "host-host" #2: initiating Quick Mode PUBKEY+ENCRYPT+TUNNEL+PFS+UP {using isakmp#1}</font><br>
<font size="2">Apr 26 14:55:13 radius02 pluto[8056]: "host-host" #2: sent QI2, IPsec SA established {ESP=>0x6d76b463 <0x19a9a64b}</font><br>
<br>
<font size="2">-Eric</font></body></html>