<div>Hi</div>
<div> </div>
<div>One more followup info. On the m/c enabled with load-tester plugin and simulating multiple rw-clients, i have the following strongswan.conf config file:</div>
<div>-----------------------------------------------------------------------------------</div>
<div># strongswan.conf - strongSwan configuration file</div>
<div>charon {<br> reuse_ikesa = no<br> # number of worker threads in charon<br> threads = 32</div>
<div> # send strongswan vendor ID?<br> # send_vendor_id = yes</div>
<div> plugins {</div>
<div> sql {<br> # loglevel to log into sql database<br> loglevel = -1</div>
<div> # URI to the database<br> # database = sqlite:///path/to/file.db<br> # database = mysql://user:password@localhost/database<br> }</div>
<div> load-tester {</div>
<div> # enable the plugin<br> enable = yes<br> # 10000 connections, ten in parallel<br> initiators = 5<br> iterations = 2<br> # use a delay of 100ms, overall time is: iterations * delay = 100s<br>
delay = 100<br> # address of the gateway<br> remote = 172.17.10.10<br> # IKE-proposal to use<br> proposal = aes128-sha1-modp1024<br> # use faster PSK authentication instead of 1024bit RSA<br>
initiator_auth = psk<br> responder_auth = psk<br> # request a virtual IP using configuration payloads<br> request_virtual_ip = yes<br> # disable IKE_SA rekeying (default)<br>
ike_rekey = 0<br> # enable CHILD_SA every 60s<br> child_rekey = 60<br> # do not delete the IKE_SA after it has been established (default)<br> delete_after_established = no<br>
# do not shut down the daemon if all IKE_SAs established<br> shutdown_when_complete = no<br> }</div>
<div> </div>
<div> }</div>
<div> # ...<br>}</div>
<div>pluto {</div>
<div>}</div>
<div>libstrongswan {</div>
<div> # set to no, the DH exponent size is optimized<br> # dh_exponent_ansi_x9_42 = no<br>}<br>[root@dvtpc3 etc]#<br>[root@dvtpc3 etc]#<br>[root@dvtpc3 etc]# ipsec start<br>Starting strongSwan 4.5.2 IPsec [starter]...<br>
[root@dvtpc3 etc]#</div>
<div> </div>
<div>----------------------------------------------------------------------------------</div>
<div> </div>
<div>and on running th command</div>
<div> </div>
<div>[root@dvtpc3 etc]# ipsec start</div>
<div>[root@dvtpc3 etc]# ipsec statusall<br>000 Status of IKEv1 pluto daemon (strongSwan 4.5.2):<br>000 interface lo/lo ::1:500<br>000 interface lo/lo <a href="http://127.0.0.1:500">127.0.0.1:500</a><br>000 interface eth0/eth0 <a href="http://172.17.10.253:500">172.17.10.253:500</a><br>
000 interface eth2/eth2 <a href="http://192.168.21.1:500">192.168.21.1:500</a><br>000 %myid = '%any'<br>000 loaded plugins: aes des sha1 sha2 md5 random x509 pkcs1 pgp dnskey pem openssl gmp hmac xauth attr kernel-netlink resolve<br>
000 debug options: none<br>000<br>Status of IKEv2 charon daemon (strongSwan 4.5.2):<br> uptime: 4 seconds, since Aug 02 18:49:59 2011<br> malloc: sbrk 262144, mmap 0, used 92800, free 169344<br> worker threads: 25 idle of 32, job queue load: 0, scheduled events: 20<br>
loaded plugins: aes des sha1 sha2 md5 random x509 revocation constraints pubkey pkcs1 pgp pem openssl fips-prf gmp xcbc hmac attr load-tester kernel-netlink resolve socket-raw stroke updown<br>Listening IP addresses:<br>
172.17.10.253<br> 192.168.21.1<br>Connections:<br> load-test: 0.0.0.0...172.17.10.10<br> load-test: local: [<a href="http://srv.strongswan.org">srv.strongswan.org</a>] uses pre-shared key authentication<br> load-test: remote: [*.<a href="http://strongswan.org">strongswan.org</a>] uses pre-shared key authentication<br>
load-test: child: dynamic === dynamic<br>Security Associations:<br> none<br>[root@dvtpc3 etc]#</div>
<div><br>so here it shows the local system with id as <a href="http://srv.strongswan.org">srv.strongswan.org</a>, whereas it is actually supposed to be a rw-client </div>
<div> </div>
<div>thanks & regards</div>
<div>rajiv</div>
<div><br> </div>
<div class="gmail_quote">On Tue, Aug 2, 2011 at 6:25 PM, Rajiv Kulkarni <span dir="ltr"><<a href="mailto:rajivkulkarni69@gmail.com">rajivkulkarni69@gmail.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">
<div>Hi</div>
<div class="im">
<div><br>>>The problem is not the secret, but that no config matches on your<br>>>responder. "leftid" defaults to "left" (172.17.10.10), but actually is<br>>><a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>. Try leftid=<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>, or even leftid=%any.<br>
</div></div>
<div>I did just that, i used leftid=%any on the rw-server. But when i start the ipsec (ipsec start --nofork) on the load-tester-plugin enabled m/c, i still get auth failed messages.</div>
<div> </div>
<div>Meanwhile on the server i get the following messages:</div>
<div>-----------------------------------------------------------------------------</div>
<div>28[NET] received packet: from 172.17.10.253[500] to 172.17.10.10[500]<br>28[ENC] parsed IKE_AUTH request 1 [ IDi IDr AUTH CP(ADDR DNS) SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]<br>28[CFG] looking for peer configs matching 172.17.10.10[<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>]...172.17.10.253[<a href="http://c6-r1.strongswan.org/" target="_blank">c6-r1.strongswan.org</a>]<br>
28[CFG] selected peer config 'rw-server'<br>28[IKE] tried 1 shared key for '<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>' - '<a href="http://c6-r1.strongswan.org/" target="_blank">c6-r1.strongswan.org</a>', but MAC mismatched<br>
28[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>28[NET] sending packet: from 172.17.10.10[500] to 172.17.10.253[500]<br>28[NET] received packet: from 172.17.10.253[500] to 172.17.10.10[500]<br>28[ENC] parsed IKE_AUTH request 1 [ IDi IDr AUTH CP(ADDR DNS) SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]<br>
28[CFG] looking for peer configs matching 172.17.10.10[<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>]...172.17.10.253[<a href="http://c6-r1.strongswan.org/" target="_blank">c6-r1.strongswan.org</a>]<br>
28[CFG] selected peer config 'rw-server'<br>28[IKE] tried 1 shared key for '<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>' - '<a href="http://c6-r1.strongswan.org/" target="_blank">c6-r1.strongswan.org</a>', but MAC mismatched<br>
28[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>28[NET] sending packet: from 172.17.10.10[500] to 172.17.10.253[500]</div>
<div> </div>
<div>------------------------------------------------------------------------------------------</div>
<div> </div>
<div>- On the rw-server, iam using the following setting in the "ipsec.secrets" file</div>
<div>: PSK "default-psk"</div>
<div> </div>
<div>- and the ipsec.conf on the rw-server m/c is as below:</div>
<div>-------------------------------------------------------------------------</div>
<div class="im">
<div>[root@dvtpc1 etc]# cat ipsec.conf<br># /etc/ipsec.conf - strongSwan IPsec configuration file</div>
<div>config setup<br> strictcrlpolicy=no<br> crlcheckinterval=180<br> plutostart=yes<br> charonstart=yes</div></div>
<div>
<div class="im">conn %default<br> ikelifetime=60m<br> keylife=30m<br> rekeymargin=3m<br> keyingtries=1<br></div> keyexchange=ikev2<br> mobike=no</div>
<div>
<div class="im">conn rw-server<br> left=172.17.10.10<br> leftsubnet=<a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a><br></div> leftid=%any
<div class="im"><br> right=%any<br> rightsourceip=<a href="http://10.3.0.0/16" target="_blank">10.3.0.0/16</a><br></div> authby=psk
<div class="im"><br> keyexchange=ikev2<br> type=tunnel<br> auto=add<br>#</div></div>
<div>--------------------------------------------</div>
<div> </div>
<div>- both the rw-server (with ipaddr <a href="http://172.17.10.10/24" target="_blank">172.17.10.10/24</a>, DGw-IP: 172.17.10.253) and the rw-client (with load-tester-plugin enabled and with ipaddr <a href="http://172.17.10.253/24" target="_blank">172.17.10.253/24</a>, Dgw-ip: 172.17.10.10) are connected back-to-back and both are running strongswan4.5.2 on Linux-Fedora13.</div>
<div> </div>
<div> </div>
<div>so where am i going wrong<br></div>
<div>thanks & regards</div>
<div>rajiv</div>
<div>
<div></div>
<div class="h5">
<div> </div>
<div class="gmail_quote">On Tue, Aug 2, 2011 at 1:09 PM, Martin Willi <span dir="ltr"><<a href="mailto:martin@strongswan.org" target="_blank">martin@strongswan.org</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">
<div><br><br>> 15[CFG] looking for peer configs matching 172.17.10.10[<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>]...172.17.10.253[<a href="http://c5-1.strongswan.org/" target="_blank">c5-1.strongswan.org</a>]<br>
> 15[CFG] no matching peer config found<br>> 15[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br><br><br></div>
<div>> conn rw-server<br>> left=172.17.10.10<br>> leftsubnet=<a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a><br>> right=%any<br><br></div>The problem is not the secret, but that no config matches on your<br>
responder. "leftid" defaults to "left" (172.17.10.10), but actually is<br><a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>. Try leftid=<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>, or even leftid=%any.<br>
<br>Regards<br><font color="#888888">Martin<br><br><br></font></blockquote></div><br></div></div></blockquote></div><br>