<div>Hi</div>
<div><br>>>The problem is not the secret, but that no config matches on your<br>>>responder. "leftid" defaults to "left" (172.17.10.10), but actually is<br>>><a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>. Try leftid=<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>, or even leftid=%any.<br>
</div>
<div>I did just that, i used leftid=%any on the rw-server. But when i start the ipsec (ipsec start --nofork) on the load-tester-plugin enabled m/c, i still get auth failed messages.</div>
<div> </div>
<div>Meanwhile on the server i get the following messages:</div>
<div>-----------------------------------------------------------------------------</div>
<div>28[NET] received packet: from 172.17.10.253[500] to 172.17.10.10[500]<br>28[ENC] parsed IKE_AUTH request 1 [ IDi IDr AUTH CP(ADDR DNS) SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]<br>28[CFG] looking for peer configs matching 172.17.10.10[<a href="http://srv.strongswan.org">srv.strongswan.org</a>]...172.17.10.253[<a href="http://c6-r1.strongswan.org">c6-r1.strongswan.org</a>]<br>
28[CFG] selected peer config 'rw-server'<br>28[IKE] tried 1 shared key for '<a href="http://srv.strongswan.org">srv.strongswan.org</a>' - '<a href="http://c6-r1.strongswan.org">c6-r1.strongswan.org</a>', but MAC mismatched<br>
28[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>28[NET] sending packet: from 172.17.10.10[500] to 172.17.10.253[500]<br>28[NET] received packet: from 172.17.10.253[500] to 172.17.10.10[500]<br>28[ENC] parsed IKE_AUTH request 1 [ IDi IDr AUTH CP(ADDR DNS) SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]<br>
28[CFG] looking for peer configs matching 172.17.10.10[<a href="http://srv.strongswan.org">srv.strongswan.org</a>]...172.17.10.253[<a href="http://c6-r1.strongswan.org">c6-r1.strongswan.org</a>]<br>28[CFG] selected peer config 'rw-server'<br>
28[IKE] tried 1 shared key for '<a href="http://srv.strongswan.org">srv.strongswan.org</a>' - '<a href="http://c6-r1.strongswan.org">c6-r1.strongswan.org</a>', but MAC mismatched<br>28[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>
28[NET] sending packet: from 172.17.10.10[500] to 172.17.10.253[500]</div>
<div> </div>
<div>------------------------------------------------------------------------------------------</div>
<div> </div>
<div>- On the rw-server, iam using the following setting in the "ipsec.secrets" file</div>
<div>: PSK "default-psk"</div>
<div> </div>
<div>- and the ipsec.conf on the rw-server m/c is as below:</div>
<div>-------------------------------------------------------------------------</div>
<div>[root@dvtpc1 etc]# cat ipsec.conf<br># /etc/ipsec.conf - strongSwan IPsec configuration file</div>
<div>config setup<br> strictcrlpolicy=no<br> crlcheckinterval=180<br> plutostart=yes<br> charonstart=yes</div>
<div>conn %default<br> ikelifetime=60m<br> keylife=30m<br> rekeymargin=3m<br> keyingtries=1<br> keyexchange=ikev2<br> mobike=no</div>
<div>conn rw-server<br> left=172.17.10.10<br> leftsubnet=<a href="http://192.168.20.0/24">192.168.20.0/24</a><br> leftid=%any<br> right=%any<br> rightsourceip=<a href="http://10.3.0.0/16">10.3.0.0/16</a><br>
authby=psk<br> keyexchange=ikev2<br> type=tunnel<br> auto=add<br>#</div>
<div>--------------------------------------------</div>
<div> </div>
<div>- both the rw-server (with ipaddr <a href="http://172.17.10.10/24">172.17.10.10/24</a>, DGw-IP: 172.17.10.253) and the rw-client (with load-tester-plugin enabled and with ipaddr <a href="http://172.17.10.253/24">172.17.10.253/24</a>, Dgw-ip: 172.17.10.10) are connected back-to-back and both are running strongswan4.5.2 on Linux-Fedora13.</div>
<div> </div>
<div> </div>
<div>so where am i going wrong<br></div>
<div>thanks & regards</div>
<div>rajiv</div>
<div> </div>
<div class="gmail_quote">On Tue, Aug 2, 2011 at 1:09 PM, Martin Willi <span dir="ltr"><<a href="mailto:martin@strongswan.org">martin@strongswan.org</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">
<div class="im"><br><br>> 15[CFG] looking for peer configs matching 172.17.10.10[<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>]...172.17.10.253[<a href="http://c5-1.strongswan.org/" target="_blank">c5-1.strongswan.org</a>]<br>
> 15[CFG] no matching peer config found<br>> 15[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br><br><br></div>
<div class="im">> conn rw-server<br>> left=172.17.10.10<br>> leftsubnet=<a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a><br>> right=%any<br><br></div>The problem is not the secret, but that no config matches on your<br>
responder. "leftid" defaults to "left" (172.17.10.10), but actually is<br><a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>. Try leftid=<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>, or even leftid=%any.<br>
<br>Regards<br><font color="#888888">Martin<br><br><br></font></blockquote></div><br>