<div>Hi Andreas and Team,</div>
<div> </div>
<div>You had previously helped me out with setting up of SAs between two physical nodes. I am now trying to send IPsec traffic from a linux virtual container to another virtual container, through a physical device that acts as a router. I installed strongswan on the two virtual containers (both are on the same host). The machine acting as router does not have strongswan installed on it. Now, the two virtual containers can ping each other (traffic goes via the router...this can be seen using the command ping -R), but for some reason, when I start strongswan, the two virtual containers cannot exchange messages. </div>
<div> </div>
<div>I believe they should have been able to exchange messages, since they can ping each other. I see no other error in the log files. Could you please let me know if I am using strongswan correctly here? Is it enough if strongswan is installed and configured on the two virtual containers only? </div>
<div> </div>
<div>Please find the setup, logs and configuration below:</div>
<div> </div>
<div><strong><u>Setup:</u></strong></div>
<div><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-fareast-font-family: SimSun; mso-bidi-font-family: 'Times New Roman'; mso-ansi-language: EN-US; mso-fareast-language: ZH-CN; mso-bidi-language: HI"> Attached to this mail.</span></div>
<div><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: 'Times New Roman'; mso-fareast-font-family: SimSun; mso-ansi-language: EN-US; mso-fareast-language: ZH-CN; mso-bidi-language: HI"> </span></div>
<div> </div>
<div><strong><u><span style="FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-fareast-font-family: SimSun; mso-bidi-font-family: 'Times New Roman'; mso-ansi-language: EN-US; mso-fareast-language: ZH-CN; mso-bidi-language: HI"> </span>ipsec.conf on VC1:</u></strong></div>
<div># ipsec.conf - strongSwan IPsec configuration file</div>
<div># basic configuration</div>
<div>config setup<br> # plutodebug=all<br> # crlcheckinterval=600<br> strictcrlpolicy=no<br> # cachecrls=yes<br> # nat_traversal=yes<br> charonstart=yes<br> charondebug=all<br>
plutostart=no</div>
<div># Add connections here.</div>
<div># Sample VPN connections</div>
<div>#conn sample-self-signed<br># left=%defaultroute<br># leftsubnet=<a href="http://10.1.0.0/16">10.1.0.0/16</a><br># leftcert=selfCert.der<br># leftsendcert=never<br># right=192.168.0.2<br># rightsubnet=<a href="http://10.2.0.0/16">10.2.0.0/16</a><br>
# rightcert=peerCert.der<br># auto=start</div>
<div>ca strongswan<br> cacert=caCert.der<br> auto=add</div>
<div>conn sample-with-ca-cert<br> left=10.58.113.37<br> leftsubnet=<a href="http://10.58.113.0/24">10.58.113.0/24</a><br> leftcert=VC1Cert.der<br> right=10.58.113.118<br> rightsubnet=<a href="http://10.58.113.0/24">10.58.113.0/24</a><br>
rightid="C=CH, O=Linux strongSwan CN=10.58.113.118"<br> keyexchange=ikev2<br> auto=add<br></div>
<div> </div>
<div><strong><u>ipsec.conf on VC2:</u></strong></div>
<div># ipsec.conf - strongSwan IPsec configuration file</div>
<div># basic configuration</div>
<div>config setup<br> # plutodebug=all<br> # crlcheckinterval=600<br> strictcrlpolicy=no<br> # cachecrls=yes<br> # nat_traversal=yes<br> charonstart=yes<br> plutostart=no<br>
charondebug=all</div>
<div># Add connections here.</div>
<div># Sample VPN connections</div>
<div>#conn sample-self-signed<br># left=%defaultroute<br># leftsubnet=<a href="http://10.1.0.0/16">10.1.0.0/16</a><br># leftcert=selfCert.der<br># leftsendcert=never<br># right=192.168.0.2<br># rightsubnet=<a href="http://10.2.0.0/16">10.2.0.0/16</a><br>
# rightcert=peerCert.der<br># auto=start</div>
<div>ca strongswan<br> cacert=caCert.der<br> auto=add</div>
<div>conn sample-with-ca-cert<br> left=10.58.113.118<br> leftsubnet=<a href="http://10.58.113.0/24">10.58.113.0/24</a><br> leftcert=VC2Cert.der<br> right=10.58.113.37<br> rightsubnet=<a href="http://10.58.113.0/24">10.58.113.0/24</a><br>
rightid="C=CH, O=Linux strongSwan CN=10.58.113.37"<br> keyexchange=ikev2<br> auto=start<br></div>
<div> </div>
<div><strong><u>log file on VC1:</u></strong></div>
<div>Apr 25 23:17:16 vc1 charon: 00[DMN] Starting IKEv2 charon daemon (strongSwan 4.4.0)<br>Apr 25 23:17:16 vc1 charon: 00[LIB] Padlock not found, CPU is GenuineIntel<br>Apr 25 23:17:16 vc1 charon: 00[LIB] plugin 'padlock': failed to load - padlock_plugin_create returned NULL<br>
Apr 25 23:17:16 vc1 charon: 00[CFG] attr-sql plugin: database URI not set<br>Apr 25 23:17:16 vc1 charon: 00[LIB] plugin 'attr-sql': failed to load - attr_sql_plugin_create returned NULL<br>Apr 25 23:17:16 vc1 charon: 00[KNL] listening on interfaces:<br>
Apr 25 23:17:16 vc1 charon: 00[KNL] eth2<br>Apr 25 23:17:16 vc1 charon: 00[KNL] 10.58.113.37<br>Apr 25 23:17:16 vc1 charon: 00[KNL] fe80::21f:29ff:fe69:70ae<br>Apr 25 23:17:16 vc1 charon: 00[KNL] ethvc1<br>Apr 25 23:17:16 vc1 charon: 00[KNL] 10.58.113.60<br>
Apr 25 23:17:16 vc1 charon: 00[KNL] fe80::4caa:9cff:fe10:c28<br>Apr 25 23:17:16 vc1 charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'<br>Apr 25 23:17:16 vc1 charon: 00[CFG] loaded ca certificate "C=CH, O=strongSwan, CN=strongSwan CA" from '/etc/ipsec.d/cacerts/caCert.der'<br>
Apr 25 23:17:16 vc1 charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'<br>Apr 25 23:17:16 vc1 charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'<br>Apr 25 23:17:16 vc1 charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'<br>
Apr 25 23:17:16 vc1 charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'<br>Apr 25 23:17:16 vc1 charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'<br>Apr 25 23:17:16 vc1 charon: 00[CFG] loaded RSA private key from '/etc/ipsec.d/private/VC1Key.der'<br>
Apr 25 23:17:16 vc1 charon: 00[CFG] expanding file expression '/var/lib/strongswan/ipsec.secrets.inc' failed<br>Apr 25 23:17:16 vc1 charon: 00[CFG] sql plugin: database URI not set<br>Apr 25 23:17:16 vc1 charon: 00[LIB] plugin 'sql': failed to load - sql_plugin_create returned NULL<br>
Apr 25 23:17:16 vc1 charon: 00[CFG] no RADUIS secret defined<br>Apr 25 23:17:16 vc1 charon: 00[CFG] RADIUS plugin initialization failed<br>Apr 25 23:17:16 vc1 charon: 00[LIB] plugin 'eap-radius': failed to load - eap_radius_plugin_create returned NULL<br>
Apr 25 23:17:16 vc1 charon: 00[CFG] mediation database URI not defined, skipped<br>Apr 25 23:17:16 vc1 charon: 00[LIB] plugin 'medsrv': failed to load - medsrv_plugin_create returned NULL<br>Apr 25 23:17:16 vc1 charon: 00[CFG] mediation client database URI not defined, skipped<br>
Apr 25 23:17:16 vc1 charon: 00[LIB] plugin 'medcli': failed to load - medcli_plugin_create returned NULL<br>Apr 25 23:17:16 vc1 charon: 00[LIB] plugin 'nm': failed to load '/usr/lib/ipsec/plugins/libstrongswan-nm.so' - /usr/lib/ipsec/plugins/libstrongswan-nm.so: cannot open shared object file: No such file or directory<br>
Apr 25 23:17:16 vc1 charon: 00[CFG] HA config misses local/remote address<br>Apr 25 23:17:16 vc1 charon: 00[LIB] plugin 'ha': failed to load - ha_plugin_create returned NULL<br>Apr 25 23:17:16 vc1 charon: 00[DMN] loaded plugins: curl ldap aes des sha1 sha2 md5 random x509 pubkey pkcs1 pgp dnskey pem openssl fips-prf xcbc hmac agent gmp attr kernel-netlink socket-default socket-raw socket-dynamic farp stroke updown eap-identity eap-aka eap-md5 eap-gtc eap-mschapv2 dhcp resolve<br>
Apr 25 23:17:16 vc1 charon: 00[JOB] spawning 16 worker threads<br>Apr 25 23:17:16 vc1 charon: 06[CFG] received stroke: add ca 'strongswan'<br>Apr 25 23:17:16 vc1 charon: 06[CFG] added ca 'strongswan'<br>Apr 25 23:17:16 vc1 charon: 06[CFG] received stroke: add connection 'sample-with-ca-cert'<br>
Apr 25 23:17:16 vc1 charon: 06[CFG] loaded certificate "C=CH, O=strongSwan, CN=10.58.113.37" from 'VC1Cert.der'<br>Apr 25 23:17:16 vc1 charon: 06[CFG] id '10.58.113.37' not confirmed by certificate, defaulting to 'C=CH, O=strongSwan, CN=10.58.113.37'<br>
Apr 25 23:17:16 vc1 charon: 06[CFG] added configuration 'sample-with-ca-cert'<br>Apr 25 23:20:01 vc1 CRON[9313]: (smmsp) CMD (test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp)<br></div>
<div> </div>
<div><strong><u>log file on VC2:</u></strong></div>
<div>Apr 25 23:17:20 vc2 charon: 00[DMN] Starting IKEv2 charon daemon (strongSwan 4.4.0)<br>Apr 25 23:17:20 vc2 charon: 00[LIB] Padlock not found, CPU is GenuineIntel<br>Apr 25 23:17:20 vc2 charon: 00[LIB] plugin 'padlock': failed to load - padlock_plugin_create returned NULL<br>
Apr 25 23:17:20 vc2 charon: 00[CFG] attr-sql plugin: database URI not set<br>Apr 25 23:17:20 vc2 charon: 00[LIB] plugin 'attr-sql': failed to load - attr_sql_plugin_create returned NULL<br>Apr 25 23:17:20 vc2 charon: 00[KNL] listening on interfaces:<br>
Apr 25 23:17:20 vc2 charon: 00[KNL] eth3<br>Apr 25 23:17:20 vc2 charon: 00[KNL] 10.58.113.118<br>Apr 25 23:17:20 vc2 charon: 00[KNL] fe80::21f:29ff:fe69:28<br>Apr 25 23:17:20 vc2 charon: 00[KNL] ethvc2<br>Apr 25 23:17:20 vc2 charon: 00[KNL] 10.58.113.101<br>
Apr 25 23:17:20 vc2 charon: 00[KNL] fe80::384d:1aff:fe17:36e2<br>Apr 25 23:17:20 vc2 charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'<br>Apr 25 23:17:20 vc2 charon: 00[CFG] loaded ca certificate "C=CH, O=strongSwan, CN=strongSwan CA" from '/etc/ipsec.d/cacerts/caCert.der'<br>
Apr 25 23:17:20 vc2 charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'<br>Apr 25 23:17:20 vc2 charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'<br>Apr 25 23:17:20 vc2 charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'<br>
Apr 25 23:17:20 vc2 charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'<br>Apr 25 23:17:20 vc2 charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'<br>Apr 25 23:17:21 vc2 charon: 00[CFG] loaded RSA private key from '/etc/ipsec.d/private/VC2Key.der'<br>
Apr 25 23:17:21 vc2 charon: 00[CFG] expanding file expression '/var/lib/strongswan/ipsec.secrets.inc' failed<br>Apr 25 23:17:21 vc2 charon: 00[CFG] sql plugin: database URI not set<br>Apr 25 23:17:21 vc2 charon: 00[LIB] plugin 'sql': failed to load - sql_plugin_create returned NULL<br>
Apr 25 23:17:21 vc2 charon: 00[CFG] no RADUIS secret defined<br>Apr 25 23:17:21 vc2 charon: 00[CFG] RADIUS plugin initialization failed<br>Apr 25 23:17:21 vc2 charon: 00[LIB] plugin 'eap-radius': failed to load - eap_radius_plugin_create returned NULL<br>
Apr 25 23:17:21 vc2 charon: 00[CFG] mediation database URI not defined, skipped<br>Apr 25 23:17:21 vc2 charon: 00[LIB] plugin 'medsrv': failed to load - medsrv_plugin_create returned NULL<br>Apr 25 23:17:21 vc2 charon: 00[CFG] mediation client database URI not defined, skipped<br>
Apr 25 23:17:21 vc2 charon: 00[LIB] plugin 'medcli': failed to load - medcli_plugin_create returned NULL<br>Apr 25 23:17:21 vc2 charon: 00[LIB] plugin 'nm': failed to load '/usr/lib/ipsec/plugins/libstrongswan-nm.so' - /usr/lib/ipsec/plugins/libstrongswan-nm.so: cannot open shared object file: No such file or directory<br>
Apr 25 23:17:21 vc2 charon: 00[CFG] HA config misses local/remote address<br>Apr 25 23:17:21 vc2 charon: 00[LIB] plugin 'ha': failed to load - ha_plugin_create returned NULL<br>Apr 25 23:17:21 vc2 charon: 00[DMN] loaded plugins: curl ldap aes des sha1 sha2 md5 random x509 pubkey pkcs1 pgp dnskey pem openssl fips-prf xcbc hmac agent gmp attr kernel-netlink socket-default socket-raw socket-dynamic farp stroke updown eap-identity eap-aka eap-md5 eap-gtc eap-mschapv2 dhcp resolve<br>
Apr 25 23:17:21 vc2 charon: 00[JOB] spawning 16 worker threads<br>Apr 25 23:17:21 vc2 charon: 06[CFG] received stroke: add ca 'strongswan'<br>Apr 25 23:17:21 vc2 charon: 06[CFG] added ca 'strongswan'<br>Apr 25 23:17:21 vc2 charon: 06[CFG] received stroke: add connection 'sample-with-ca-cert'<br>
Apr 25 23:17:21 vc2 charon: 06[CFG] loaded certificate "C=CH, O=strongSwan, CN=10.58.113.118" from 'VC2Cert.der'<br>Apr 25 23:17:21 vc2 charon: 06[CFG] id '10.58.113.118' not confirmed by certificate, defaulting to 'C=CH, O=strongSwan, CN=10.58.113.118'<br>
Apr 25 23:17:21 vc2 charon: 06[CFG] added configuration 'sample-with-ca-cert'<br><strong>Apr 25 23:17:21 vc2 charon: 06[CFG] received stroke: initiate 'sample-with-ca-cert'<br>Apr 25 23:17:21 vc2 charon: 06[IKE] initiating IKE_SA sample-with-ca-cert[1] to 10.58.113.37<br>
Apr 25 23:17:21 vc2 charon: 06[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>Apr 25 23:17:21 vc2 charon: 06[NET] sending packet: from 10.58.113.118[500] to 10.58.113.37[500]<br>Apr 25 23:17:25 vc2 charon: 16[IKE] retransmit 1 of request with message ID 0<br>
Apr 25 23:17:25 vc2 charon: 16[NET] sending packet: from 10.58.113.118[500] to 10.58.113.37[500]<br></strong>Apr 25 23:17:32 vc2 charon: 01[IKE] retransmit 2 of request with message ID 0<br>Apr 25 23:17:32 vc2 charon: 01[NET] sending packet: from 10.58.113.118[500] to 10.58.113.37[500]<br>
Apr 25 23:17:45 vc2 charon: 11[IKE] retransmit 3 of request with message ID 0<br>Apr 25 23:17:45 vc2 charon: 11[NET] sending packet: from 10.58.113.118[500] to 10.58.113.37[500]<br>Apr 25 23:18:08 vc2 charon: 13[IKE] retransmit 4 of request with message ID 0<br>
Apr 25 23:18:08 vc2 charon: 13[NET] sending packet: from 10.58.113.118[500] to 10.58.113.37[500]<br>Apr 25 23:18:50 vc2 charon: 10[IKE] retransmit 5 of request with message ID 0<br>Apr 25 23:18:50 vc2 charon: 10[NET] sending packet: from 10.58.113.118[500] to 10.58.113.37[500]<br>
Apr 25 23:20:01 vc2 CRON[10869]: (smmsp) CMD (test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp)<br>Apr 25 23:20:06 vc2 charon: 15[IKE] giving up after 5 retransmits<br>Apr 25 23:20:06 vc2 charon: 15[IKE] peer not responding, trying again (2/3)<br>
Apr 25 23:20:06 vc2 charon: 15[IKE] initiating IKE_SA sample-with-ca-cert[1] to 10.58.113.37<br>Apr 25 23:20:06 vc2 charon: 15[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>Apr 25 23:20:06 vc2 charon: 15[NET] sending packet: from 10.58.113.118[500] to 10.58.113.37[500]<br>
Apr 25 23:20:10 vc2 charon: 12[IKE] retransmit 1 of request with message ID 0<br>Apr 25 23:20:10 vc2 charon: 12[NET] sending packet: from 10.58.113.118[500] to 10.58.113.37[500]</div>
<div> </div>
<div> </div>
<div><strong><u>Ping happening between VC1 and VC2(through the router):</u></strong></div>
<div>root@vc2:~# <strong>ping -R 10.58.113.37<br></strong>PING 10.58.113.37 (10.58.113.37) 56(124) bytes of data.<br>64 bytes from <a href="http://10.58.113.37">10.58.113.37</a>: icmp_req=1 ttl=63 time=0.464 ms<br>RR: 10.58.113.118<br>
10.58.113.89<br> 10.58.113.37<br> 10.58.113.37<br> 10.58.113.254<br> 10.58.113.118</div>
<div>64 bytes from <a href="http://10.58.113.37">10.58.113.37</a>: icmp_req=2 ttl=63 time=0.431 ms (same route)<br>64 bytes from <a href="http://10.58.113.37">10.58.113.37</a>: icmp_req=3 ttl=63 time=0.438 ms (same route)<br>
64 bytes from <a href="http://10.58.113.37">10.58.113.37</a>: icmp_req=4 ttl=63 time=0.427 ms (same route)<br>^C<br>--- 10.58.113.37 ping statistics ---<br>4 packets transmitted, 4 received, 0% packet loss, time 2998ms<br>
rtt min/avg/max/mdev = 0.427/0.440/0.464/0.014 ms<br><br></div>
<div> </div>
<div>Thanks and regards,</div>
<div>Meera </div>