<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:arial, helvetica, sans-serif;font-size:12pt"><div><br></div><div>I swapped the plugin socket-raw for socket-default and now the charon daemon will accept connections from the far end.</div><div><br></div><div>Thanks again for your help,</div><div>Bill</div><div><br></div><div style="font-family:arial, helvetica, sans-serif;font-size:12pt"><br><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><font size="2" face="Tahoma"><hr size="1"><b><span style="font-weight: bold;">From:</span></b> William Greene <wgreene9617@yahoo.com><br><b><span style="font-weight: bold;">To:</span></b> Andreas Steffen <andreas.steffen@strongswan.org><br><b><span style="font-weight: bold;">Cc:</span></b> users@lists.strongswan.org<br><b><span style="font-weight: bold;">Sent:</span></b> Wed, November 17, 2010 3:57:17 PM<br><b><span
style="font-weight: bold;">Subject:</span></b> Re: [strongSwan] StrongSwan to accept IKE initiated from other end?<br></font><br>
<div style="font-family:arial, helvetica, sans-serif;font-size:12pt;"><div><br></div><div>Charon and socket-raw. The SA listed was started from Strongswan to the far end.</div><div><br></div><div>Thanks,</div><div>Bill</div><div><br></div><div><div>[root@KAP8 etc]# ipsec statusall</div><div>Status of IKEv2 charon daemon (strongSwan 4.5.0):</div><div> uptime: 112 minutes, since Nov 17 14:01:20 2010</div><div> malloc: sbrk 253952, mmap 0, used 158000, free 95952</div><div> worker threads: 9 idle of 16, job queue load: 0, scheduled events: 5</div><div> loaded plugins: aes des sha1 sha2 md5 random x509 revocation pubkey pkcs1 pgp pem openssl gcrypt fips-prf gmp xcbc hmac gcm attr kernel-netlink resolve socket-raw stroke updown </div><div>Listening IP
addresses:</div><div> 10.168.80.8</div><div> 2005:a8::21e:c9ff:feff:124</div><div> 2004:a8::21e:c9ff:feff:124</div><div>Connections:</div><div> testipsec: 10.168.80.8...10.168.65.1</div><div> testipsec: local: [10.168.80.8] uses pre-shared key authentication</div><div> testipsec: remote: [10.168.65.1] uses any authentication</div><div> testipsec: child: dynamic[tcp] === dynamic[tcp] </div><div>Security Associations:</div><div> testipsec[3]: ESTABLISHED 12 seconds ago, 10.168.80.8[10.168.80.8]...10.168.65.1[10.168.65.1]</div><div> testipsec[3]: IKE SPIs: 05aa819c100c902b_i* 50e302f1e37239ad_r, pre-shared key reauthentication in 56 minutes</div><div> testipsec[3]: IKE proposal: AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_2048</div><div> testipsec{9}: INSTALLED,
TRANSPORT, ESP SPIs: c8a2210e_i e8bef2ae_o</div><div> testipsec{9}: NULL_AES_GMAC_256, 0 bytes_i, 0 bytes_o, rekeying in 16 minutes</div><div> testipsec{9}: 10.168.80.8/32[tcp] === 10.168.65.1/32[tcp] </div><div>[root@KAP8 etc]# </div></div><div><br></div><div style="font-family:arial, helvetica, sans-serif;font-size:12pt;"><br><div style="font-family:arial, helvetica, sans-serif;font-size:13px;"><font size="2" face="Tahoma"><hr size="1"><b><span style="font-weight:bold;">From:</span></b> Andreas Steffen <andreas.steffen@strongswan.org><br><b><span style="font-weight:bold;">To:</span></b> William Greene <wgreene9617@yahoo.com><br><b><span style="font-weight:bold;">Cc:</span></b> users@lists.strongswan.org<br><b><span style="font-weight:bold;">Sent:</span></b> Wed, November 17, 2010 3:52:32 PM<br><b><span style="font-weight:bold;">Subject:</span></b> Re: [strongSwan] StrongSwan to accept IKE
initiated from other end?<br></font><br>
Hello Bill,<br><br>which socket plugin are you using for charon? (The command<br>ipsec statusall shows a list of all loaded plugins.)<br><br>If both charon and pluto are running you *must* load the<br>socket-raw plugin and if charon only is running then<br>you *can* use either the socket-default plugin which binds to<br>UDP ports 500/4500 or of course keep socket-raw but never<br>load both together.<br><br>Regards<br><br>Andreas<br><br>On 11/17/2010 08:18 PM, William Greene wrote:<br>><br>> I can't for some reason get StrongSwan to accept an IKE initiated<br>> connection from the other end. In ipsec.conf I've tried "auto=add" and<br>> "auto=route" but I can only get the ipsec connection going from the<br>> StrongSwan end via the command "ipsec up testipsec".<br>><br>> tcpdump on the far end shows that messages are going out, but the<br>> charon.log shows nothing. When I issue the command "ipsec up testipsec",<br>> I see isakmp
1.0 and isakmp 2.0 logs on the far end and the charon.log<br>> show alot of messages and the ipsec connection functions as expected.<br>><br>> Only outgoing ike/ipsec initiated connections works, not incoming. Any<br>> ideas?<br>><br>> Thanks in advance for any comments or suggestions.<br>> Bill<br>><br>><br>><br>> [root@KAP8 etc]# cat ipsec.conf<br>> # ipsec.conf - strongSwan IPsec configuration file<br>><br>> # basic configuration<br>><br>> config setup<br>> # plutodebug=all<br>> # crlcheckinterval=600<br>> # strictcrlpolicy=yes<br>> # cachecrls=yes<br>> # nat_traversal=yes<br>> # charonstart=no<br>> plutostart=no<br>><br>> # Add connections here.<br>><br>> conn %default<br>> ikelifetime=60m<br>> keylife=20m<br>> rekeymargin=3m<br>> keyingtries=1<br>> mobike=no<br>> authby=secret<br>> keyexchange=ikev2<br>>
#ike=aes128-sha1-modp2048,3des-sha1-modp1536<br>> # gcm256<br>> #esp=aes256gcm16-modp1024-modp2048!<br>> # gcm128<br>> #esp=aes128gcm16-modp1024-modp2048!<br>> # gmac128<br>> #ike=aes128-sha256-modp2048!<br>> #iesp=aes128gmac-modp2048!<br>> # gmac256<br>> ike=aes256-sha384-modp2048!<br>> esp=aes256gmac-modp2048!<br>><br>> conn testipsec<br>> type=transport<br>> left=10.168.80.8<br>> leftprotoport=tcp/%any<br>> #leftid=kap<br>> right=10.168.65.1<br>> rightprotoport=tcp/%any<br>> #rightid=cep<br>> auto=add<br>> [root@KAP8 etc]#<br><br>======================================================================<br>Andreas Steffen <a rel="nofollow" ymailto="mailto:andreas.steffen@strongswan.org" target="_blank" href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>strongSwan - the Linux VPN
Solution!
<a rel="nofollow" target="_blank" href="http://www.strongswan.org">www.strongswan.org</a><br>Institute for Internet Technologies and Applications<br>University of Applied Sciences Rapperswil<br>CH-8640 Rapperswil (Switzerland)<br>===========================================================[ITA-HSR]==<br></div></div><div style=""></div>
</div><br>
</div></div><div style="position:fixed"></div>
</div><br>
</body></html>