<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri, sans-serif" size="2">
<div>Hi all,</div>
<div> </div>
<div>Does anyone know how to turn on ECDH groups for IKEv1 negotiation in Strongswan? Here is what I did for my test and it didn’t work.</div>
<div> </div>
<div>1/ Download latest strongswan tarball v4.3.6.</div>
<div> </div>
<div>2/ Install strongswan.</div>
<div> </div>
<div>./configure –enable-openssl</div>
<div>make</div>
<div>make install</div>
<div> </div>
<div>3/ Configure p1 proposal with ecdh group for strongswan conn.</div>
<div><font face="Times New Roman, serif"> </font></div>
<div> ike=3des-sha1-ecp256</div>
<div><font face="Times New Roman, serif"> </font></div>
<div>4/ Initiate peer connection with DH group 19. I got the following error from strongswan log.</div>
<div><font face="Times New Roman, serif"> </font></div>
<div style="padding-left: 7pt; padding-right: 7pt; "><font face="SimSun">*****parsse ISAKMP oakley attribute:</font></div>
<div style="padding-left: 7pt; padding-right: 7pt; "><font face="SimSun"> af+type: OAKLEY_GROUP_DESCRIPTION</font></div>
<div style="padding-left: 7pt; padding-right: 7pt; "><font face="SimSun"> length/value: 19</font></div>
<div style="padding-left: 7pt; padding-right: 7pt; "><font face="SimSun"> [19 is ECP_256]</font></div>
<div style="padding-left: 7pt; padding-right: 7pt; "><font face="SimSun">"ssg20" #1: ECP_256 is not supported.</font></div>
<div style="padding-left: 7pt; padding-right: 7pt; "><font face="SimSun">"ssg20" #1: no acceptable oakley transform</font></div>
<div><font face="SimSun">"ssg20" #1: sending notification NO_PROPOSAL_CHOSE to 10.158.30.23:500</font></div>
<div><font face="Times New Roman, serif"> </font></div>
<div>5/ Here is what I got from “sudo ipsec listalgs”. I don’t see ECC groups being listed.</div>
<div><font face="Times New Roman, serif"> </font></div>
<div>test:~/strongswan-4.3.6$ sudo ipsec version</div>
<div>Linux strongSwan U4.3.6/K2.6.15-27-386</div>
<div>Institute for Internet Technologies and Applications</div>
<div>University of Applied Sciences Rapperswil, Switzerland</div>
<div>See 'ipsec --copyright' for copyright information.</div>
<div><font face="Courier New, monospace" size="3"> </font></div>
<div>test:~/strongswan-4.3.6$ sudo ipsec listalgs</div>
<div>000 </div>
<div>000 List of registered IKEv1 Algorithms:</div>
<div>000 </div>
<div>000 encryption: 3DES_CBC AES_CBC</div>
<div>000 integrity: HMAC_MD5 HMAC_SHA1 HMAC_SHA2_256 HMAC_SHA2_384 HMAC_SHA2_512</div>
<div>000 dh-group: MODP_1024 MODP_1536 MODP_2048 MODP_3072 MODP_4096 MODP_6144 MODP_8192</div>
<div>000 </div>
<div>000 List of registered ESP Algorithms:</div>
<div>000 </div>
<div>000 encryption: DES_CBC 3DES_CBC BLOWFISH_CBC NULL AES_CBC AES_CCM_8 AES_CCM_12 AES_CCM_16 AES_GCM_8 AES_GCM_12 AES_GCM_16 SERPENT_CBC TWOFISH_CBC</div>
<div>000 integrity: HMAC_MD5 HMAC_SHA1 HMAC_SHA2_256 NULL HMAC_SHA2_256_96</div>
<div><font face="Times New Roman, serif"> </font></div>
<div>Thanks.<br>
Songling</div>
<div><font face="Times New Roman, serif"> </font></div>
</font>
</body>
</html>