Thank you for your detailed answer.<br><br>FYI:<br>The aes256-aesxcbc-ecp521 algorithms are only used against two other Debian Squeeze/Strongswan configurations and is supported and working according to ipsec statusall.<br>
<br><br clear="all"><font size="2"><span style="font-family:arial,helvetica,sans-serif">Regards,</span></font><br><br><b>Hans-Kristian Bakke</b><br><font size="1"><span style="color:rgb(51, 51, 51)"></span></font><br><br>
<div class="gmail_quote">On Mon, May 2, 2011 at 12:07, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hello Hans-Kristian,<br>
<br>
the problem is that strongSwan as a responder must select a<br>
matching proposal upon the reception of the IKE_INIT_SA request<br>
so that the following IKE_AUTH messages can be encrypted.<br>
Since all connection definitions contain right=%any and<br>
rightid will be transmitted within the IKE_AUTH payload,<br>
strongSwan selects the first matching proposal.<br>
<br>
Thus the only solution is to define a joint list of accepted<br>
crypto algorithms e.g. in the %default connection section<br>
<br>
ike=aes256-aesxcbc-ecp521,aes256-sha1-modp1024!<br>
esp=aes256gcm16-ecp521,aes256-sha1!<br>
<br>
Kind regards<br>
<br>
Andreas<br>
<br>
BTW: To my knowledge the Windows 7 Agile VPN client does not<br>
support Suite B Elliptic Curve Cryptography. Only Microsoft's<br>
old IKEv1-based IPsec stack does.<br>
<div class="im"><br>
On 02.05.2011 11:46, Hans-Kristian Bakke wrote:<br>
> Hi<br>
><br>
> I have a problem using multiple strict flags in my ipsec.conf<br>
> configuration on Debian Squeeze (strongswan package v4.4.1-5.1):<br>
><br>
><br>
> ----<br>
> # ipsec.conf - strongSwan IPsec configuration file<br>
><br>
> # basic configuration<br>
> config setup<br>
> charonstart=yes<br>
> plutostart=no<br>
><br>
> # Add connections here.<br>
> conn %default<br>
> keyexchange=ikev2<br>
> auth=esp<br>
> leftauth=pubkey<br>
> left=%defaultroute<br>
> leftcert=vpn-serverCert.pem<br>
> leftfirewall=no<br>
</div>> leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<div class="im">> reauth=no<br>
><br>
> conn rw-uranus<br>
> right=%any<br>
> rightsourceip=10.0.1.2<br>
</div>> rightid="C=NO, ST=Oppland, O=<a href="http://nixuser.net" target="_blank">nixuser.net</a> <<a href="http://nixuser.net" target="_blank">http://nixuser.net</a>>,<br>
> OU=Backup server, CN=<a href="http://uranus.nixuser.net" target="_blank">uranus.nixuser.net</a> <<a href="http://uranus.nixuser.net" target="_blank">http://uranus.nixuser.net</a>>"<br>
<div class="im">> auto=add<br>
> ike=aes256-aesxcbc-ecp521!<br>
> esp=aes256gcm16-ecp521!<br>
> dpdaction=clear<br>
><br>
> conn windows-7<br>
> right=%any<br>
> rightsourceip=10.0.1.3<br>
</div>> rightid="C=NO, ST=Oppland, O=<a href="http://nixuser.net" target="_blank">nixuser.net</a> <<a href="http://nixuser.net" target="_blank">http://nixuser.net</a>>,<br>
> OU=Windows 7 klient, CN=<a href="http://klient.nixuser.net" target="_blank">klient.nixuser.net</a> <<a href="http://klient.nixuser.net" target="_blank">http://klient.nixuser.net</a>>"<br>
<div class="im">> auto=add<br>
> ike=aes256-sha1-modp1024!<br>
> esp=aes256-sha1!<br>
> dpdaction=clear<br>
> rekey=no<br>
><br>
> conn rw-europa<br>
> right=%any<br>
> rightsourceip=10.0.1.4<br>
</div>> rightid="C=NO, ST=Oppland, O=<a href="http://nixuser.net" target="_blank">nixuser.net</a> <<a href="http://nixuser.net" target="_blank">http://nixuser.net</a>>,<br>
> OU=Filserver, CN=<a href="http://europa.nixuser.net" target="_blank">europa.nixuser.net</a> <<a href="http://europa.nixuser.net" target="_blank">http://europa.nixuser.net</a>>"<br>
<div class="im">> auto=add<br>
> ike=aes256-aesxcbc-ecp521!<br>
> esp=aes256gcm16-ecp521!<br>
> dpdaction=clear<br>
><br>
> include /var/lib/strongswan/ipsec.conf.inc<br>
> ----<br>
><br>
><br>
> When I try to connect with the windows-7 client I get the following in<br>
> syslog:<br>
> configured proposals: IKE:AES_CBC_256/AES_XCBC_96/PRF_AES128_XCBC/ECP_521<br>
> which indicates to me that the first strict flag is probably globally<br>
> overriding everything also in the connections other algorithms are defined.<br>
> The Windows 7 client can't connect as a result of this.<br>
> If I remove the strict flags everything works as intented.<br>
><br>
> Is it only possible to have one global (even if defined inside a<br>
> connection) single ike/esp definition using strict flag in ipsec.conf?<br>
><br>
> ---<br>
> Regards,<br>
</div>> *Hans-Kristian Bakke*<br>
<br>
======================================================================<br>
<font color="#888888">Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
strongSwan - the Linux VPN Solution! <a href="http://www.strongswan.org" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
===========================================================[ITA-HSR]==<br>
</font></blockquote></div><br>