Thank you very much! All 3 options are working in my testbed now.<br><br>Regards<br>Richard<br><br><div class="gmail_quote">On Sun, Feb 13, 2011 at 3:43 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">Hello,<br>
<br>
because of the NAT situation you must define<br>
<br>
rightsubnet=<a href="http://10.10.124.14/32" target="_blank">10.10.124.14/32</a><br>
<br>
on the VPN hub or if you have several clients with addresses in<br>
the <a href="http://10.10.0.0/16" target="_blank">10.10.0.0/16</a> network<br>
<br>
rightsubnetwithin=<a href="http://10.10.0.0/16" target="_blank">10.10.0.0/16</a><br>
<br>
The third and best alternative would be for the VPN hub<br>
to assign a virtual IP address to each RA client:<br>
<br>
On the VPN hub<br>
<br>
rightsourceip=<a href="http://10.0.3.0/24" target="_blank">10.0.3.0/24</a> # choose any pool you like<br>
<br>
and on the RA client<br>
<br>
leftsourceip=%config<br>
<br>
Regards<br>
<br>
Andreas<br>
<div class="im"><br>
On 02/13/2011 08:28 AM, Richard Chan wrote:<br>
> Hello,<br>
><br>
> I am testing out the Remote access (RA) +PSK configuration. It is<br>
> working if the<br>
> two devices are routed. But the if RA is behind NAT, IKE Phase I<br>
> succeeds, Phase II fails.<br>
><br>
> From auth.log below, I can see that IKE Phase I succeeds, but then I<br>
> cannot create the Phase II<br>
> SA. Any suggestions?<br>
><br>
> moon (the VPN hub)<br>
><br>
> ipsec.secrets<br>
><br>
> 192.168.123.12 %any : PSK "secret"<br>
><br>
> ipsec.conf<br>
><br>
> conn hub<br>
> left=192.168.123.12<br>
</div>> leftsubnet=<a href="http://172.25.12.0/24" target="_blank">172.25.12.0/24</a> <<a href="http://172.25.12.0/24" target="_blank">http://172.25.12.0/24</a>><br>
<div class="im">> right=%any<br>
> authby=secret<br>
> auto=add<br>
><br>
> carol (the RA client, behind NAT)<br>
><br>
> ipsec.secrets<br>
><br>
> 10.10.124.14 192.168.123.12 : PSK "secret"<br>
><br>
> ipsec.conf<br>
><br>
> conn rw<br>
> left=%defaultroute<br>
> right=192.168.123.12<br>
</div>> rightsubnet=<a href="http://172.25.12.0/24" target="_blank">172.25.12.0/24</a> <<a href="http://172.25.12.0/24" target="_blank">http://172.25.12.0/24</a>><br>
<div class="im">> authby=secret<br>
> auto=add<br>
><br>
><br>
> auth.log on moon:<br>
><br>
> Feb 13 15:18:33 vm01 pluto[6774]: | *received 268 bytes from<br>
</div>> <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>> on eth0<br>
<div class="im">> Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a><br>
</div>> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>>: received Vendor ID payload [strongSwan]<br>
<div class="im">> Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a><br>
</div>> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>>: received Vendor ID payload [XAUTH]<br>
<div class="im">> Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a><br>
</div>> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>>: received Vendor ID payload [Dead Peer<br>
<div class="im">> Detection]<br>
> Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a><br>
</div>> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>>: received Vendor ID payload [RFC 3947]<br>
<div class="im">> Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a><br>
</div>> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>>: ignoring Vendor ID payload<br>
<div class="im">> [draft-ietf-ipsec-nat-t-ike-03]<br>
> Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a><br>
</div>> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>>: ignoring Vendor ID payload<br>
<div class="im">> [draft-ietf-ipsec-nat-t-ike-02]<br>
> Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a><br>
</div>> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>>: ignoring Vendor ID payload<br>
<div class="im">> [draft-ietf-ipsec-nat-t-ike-02_n]<br>
> Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a><br>
</div>> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>>: ignoring Vendor ID payload<br>
<div class="im">> [draft-ietf-ipsec-nat-t-ike-00]<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | preparse_isakmp_policy: peer<br>
> requests PSK authentication<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | instantiated "hub" for 192.168.123.1<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | creating state object #1 at<br>
> 0x7fe4f2b2db20<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE: 41 51 f8 ff 2a 0a 4a 34<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE: 5f 41 53 47 1b fa 54 d7<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | peer: c0 a8 7b 01<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | inserting event EVENT_SO_DISCARD,<br>
> timeout in 0 seconds for #1<br>
> Feb 13 15:18:33 vm01 pluto[6774]: "hub"[1] <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a><br>
</div>> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>> #1: responding to Main Mode from unknown<br>
> peer <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>><br>
<div class="im">> Feb 13 15:18:33 vm01 pluto[6774]: | inserting event EVENT_RETRANSMIT,<br>
> timeout in 10 seconds for #1<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | next event EVENT_RETRANSMIT in 10<br>
> seconds for #1<br>
> Feb 13 15:18:33 vm01 pluto[6774]: |<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | *received 356 bytes from<br>
</div>> <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>> on eth0<br>
<div class="im">> Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE: 41 51 f8 ff 2a 0a 4a 34<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE: 5f 41 53 47 1b fa 54 d7<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | peer: c0 a8 7b 01<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | state object #1 found, in STATE_MAIN_R1<br>
> Feb 13 15:18:33 vm01 pluto[6774]: "hub"[1] <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a><br>
</div>> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>> #1: NAT-Traversal: Result using RFC 3947:<br>
<div class="im">> peer is NATed<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | inserting event<br>
> EVENT_NAT_T_KEEPALIVE, timeout in 20 seconds<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | inserting event EVENT_RETRANSMIT,<br>
> timeout in 10 seconds for #1<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | next event EVENT_RETRANSMIT in 10<br>
> seconds for #1<br>
> Feb 13 15:18:33 vm01 pluto[6774]: |<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | *received 76 bytes from<br>
</div>> <a href="http://192.168.123.1:4500" target="_blank">192.168.123.1:4500</a> <<a href="http://192.168.123.1:4500" target="_blank">http://192.168.123.1:4500</a>> on eth0<br>
<div class="im">> Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE: 41 51 f8 ff 2a 0a 4a 34<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE: 5f 41 53 47 1b fa 54 d7<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | peer: c0 a8 7b 01<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | state object #1 found, in STATE_MAIN_R2<br>
> Feb 13 15:18:33 vm01 pluto[6774]: "hub"[1] <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a><br>
</div>> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>> #1: Peer ID is ID_IPV4_ADDR: '10.10.124.14'<br>
<div class="im">> Feb 13 15:18:33 vm01 pluto[6774]: | peer CA: %none<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | offered CA: %none<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | switched from "hub" to "hub"<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | instantiated "hub" for 192.168.123.1<br>
> Feb 13 15:18:33 vm01 pluto[6774]: "hub"[2] <a href="http://192.168.123.1:1031" target="_blank">192.168.123.1:1031</a><br>
</div>> <<a href="http://192.168.123.1:1031" target="_blank">http://192.168.123.1:1031</a>> #1: deleting connection "hub" instance with<br>
<div class="im">> peer 192.168.123.1 {isakmp=#0/ipsec=#0}<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | NAT-T: new mapping<br>
</div>> <a href="http://192.168.123.1:1031/4500" target="_blank">192.168.123.1:1031/4500</a> <<a href="http://192.168.123.1:1031/4500" target="_blank">http://192.168.123.1:1031/4500</a>>)<br>
<div class="im">> Feb 13 15:18:33 vm01 pluto[6774]: | inserting event EVENT_SA_REPLACE,<br>
> timeout in 10530 seconds for #1<br>
> Feb 13 15:18:33 vm01 pluto[6774]: "hub"[2] <a href="http://192.168.123.1:4500" target="_blank">192.168.123.1:4500</a><br>
</div>> <<a href="http://192.168.123.1:4500" target="_blank">http://192.168.123.1:4500</a>> #1: sent MR3, ISAKMP SA established<br>
<div class="im">> Feb 13 15:18:33 vm01 pluto[6774]: | next event EVENT_NAT_T_KEEPALIVE in<br>
> 20 seconds<br>
> Feb 13 15:18:33 vm01 pluto[6774]: |<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | *received 444 bytes from<br>
</div>> <a href="http://192.168.123.1:4500" target="_blank">192.168.123.1:4500</a> <<a href="http://192.168.123.1:4500" target="_blank">http://192.168.123.1:4500</a>> on eth0<br>
<div class="im">> Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE: 41 51 f8 ff 2a 0a 4a 34<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE: 5f 41 53 47 1b fa 54 d7<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | peer: c0 a8 7b 01<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | state object not found<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE: 41 51 f8 ff 2a 0a 4a 34<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE: 5f 41 53 47 1b fa 54 d7<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | peer: c0 a8 7b 01<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | state object #1 found, in STATE_MAIN_R3<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | peer client is 10.10.124.14<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | peer client protocol/port is 0/0<br>
> Feb 13 15:18:33 vm01 pluto[6774]: | our client is subnet <a href="http://172.25.12.0/24" target="_blank">172.25.12.0/24</a><br>
</div>> <<a href="http://172.25.12.0/24" target="_blank">http://172.25.12.0/24</a>><br>
<div class="im">> Feb 13 15:18:33 vm01 pluto[6774]: | our client protocol/port is 0/0<br>
> Feb 13 15:18:33 vm01 pluto[6774]: "hub"[2] <a href="http://192.168.123.1:4500" target="_blank">192.168.123.1:4500</a><br>
</div>> <<a href="http://192.168.123.1:4500" target="_blank">http://192.168.123.1:4500</a>> #1: cannot respond to IPsec SA request<br>
<div class="im">> because no connection is known for<br>
> <a href="http://172.25.12.0/24===192.168.123.12:4500[192.168.123.12]...192.168.123.1:4500[10.10.124.14]===10.10.124.14/32" target="_blank">172.25.12.0/24===192.168.123.12:4500[192.168.123.12]...192.168.123.1:4500[10.10.124.14]===10.10.124.14/32</a><br>
</div>> <<a href="http://172.25.12.0/24===192.168.123.12:4500[192.168.123.12]...192.168.123.1:4500[10.10.124.14]===10.10.124.14/32" target="_blank">http://172.25.12.0/24===192.168.123.12:4500[192.168.123.12]...192.168.123.1:4500[10.10.124.14]===10.10.124.14/32</a>><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
> <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
<font color="#888888"><br>
<br>
--<br>
======================================================================<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
strongSwan - the Linux VPN Solution! <a href="http://www.strongswan.org" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
===========================================================[ITA-HSR]==<br>
</font></blockquote></div><br>