<div>Hello Martin, all</div>
<div> </div>
<div>Firstly, Thanks for all your help in using the load-tester plugin.</div>
<div> </div>
<div>I finally set it up to work using pubkey/rsasig with the Certs provided in the file:</div>
<div> </div>
<div><a href="http://wiki.strongswan.org/projects/strongswan/repository/entry/src/libcharon/plugins/load_tester/load_tester_creds.c">http://wiki.strongswan.org/projects/strongswan/repository/entry/src/libcharon/plugins/load_tester/load_tester_creds.c</a></div>
<div> </div>
<div>Used the self-signed cert as cacert.pem, initiator_cert.pem, responder_cert.pem and the rsa private key as initiator_key.pem and responder_key.pem and copied it to the folder locations in ./ipsec.d/.. respectively on both initiator and responder machines</div>
<div> </div>
<div>On the RW-Server machine, i used the following configs:</div>
<div> </div>
<div>ipsec.conf</div>
<div>--------------</div>
<div><br># /etc/ipsec.conf - strongSwan IPsec configuration file</div>
<div>config setup<br> strictcrlpolicy=no<br> crlcheckinterval=180<br> plutostart=no<br> charonstart=yes</div>
<div>conn %default<br> ikelifetime=60m<br> keylife=30m<br> rekeymargin=3m<br> keyingtries=1<br> keyexchange=ikev2<br> mobike=no</div>
<div>conn rw-server<br> left=172.17.10.10<br> leftsubnet=<a href="http://192.168.20.0/24">192.168.20.0/24</a><br> right=%any<br> rightsourceip=<a href="http://10.3.0.0/16">10.3.0.0/16</a><br> leftid="CN=srv, OU=load-test, O=strongSwan"<br>
leftcert=respcert.pem<br> authby=pubkey<br> keyexchange=ikev2<br> type=tunnel<br> auto=add<br>#</div>
<div> </div>
<div>ipsec.secrets</div>
<div>------------------</div>
<div>: RSA responder_key.pem</div>
<div> </div>
<div> </div>
<div>On the RW-Client-Simulator machine with Load-Tester Plugin enabled, i used the following configs:</div>
<div> </div>
<div>strongswan.conf</div>
<div>----------------------</div>
<div>charon {<br> reuse_ikesa = no<br> threads = 32</div>
<div> plugins {<br> load-tester {<br> # enable the plugin<br> enable = yes<br> # example: 10 connections, 5 in parallel<br> initiators = 5<br> iterations = 2<br>
# use a delay of 100ms, overall time is: iterations * delay = 100s<br> delay = 100<br> # address of the gateway<br> remote = 172.17.10.10<br> # IKE-proposal to use<br>
proposal = aes128-sha1-modp1024<br> # use faster PSK authentication instead of 1024bit RSA<br> initiator_auth = pubkey<br> responder_auth = pubkey<br> # request a virtual IP using configuration payloads<br>
request_virtual_ip = yes<br> # disable IKE_SA rekeying (default)<br> ike_rekey = 0<br> # enable CHILD_SA every 60s<br> child_rekey = 60<br> # do not delete the IKE_SA after it has been established (default)<br>
delete_after_established = no<br> # do not shut down the daemon if all IKE_SAs established<br> shutdown_when_complete = no<br> }<br> }<br>}<br></div>
<div>-------------------------------------</div>
<div> </div>
<div>ipsec.secrets</div>
<div>---------------------</div>
<div>: RSA initiator_key.pem</div>
<div> </div>
<div> </div>
<div>- so now i have the required 10 IKEv2 tunnels between the 2 peers (and i tried without any issues with even 1000 tunnels too). so i guess it works with certs, but somehow i could not make it work with PSK (fqdn)</div>
<div> </div>
<div>- Although this load-test works, i would definitely want to know if i could make it to work for forming multiple child-SAs (ipsec esp SAs). What i now observe is as shown in the console traces attached. I have observed the following messages on the RW-Server which responds to the load-tester-plugin initiator:</div>
<div> </div>
<div>----------------------------------------------------------</div>
<div>22[IKE] received end entity cert "CN=c4-r1, OU=load-test, O=strongSwan"<br>22[CFG] looking for peer configs matching 172.17.10.10[CN=srv, OU=load-test, O=strongSwan]...172.17.10.20[CN=c4-r1, OU=load-test, O=strongSwan]<br>
22[CFG] selected peer config 'rw-server'<br>22[CFG] using certificate "CN=c4-r1, OU=load-test, O=strongSwan"<br>22[CFG] using trusted ca certificate "CN=srv, OU=load-test, O=strongSwan"<br>
22[CFG] checking certificate status of "CN=c4-r1, OU=load-test, O=strongSwan"<br>22[CFG] certificate status is not available<br>22[CFG] reached self-signed root ca with a path length of 0<br>22[IKE] authentication of 'CN=c4-r1, OU=load-test, O=strongSwan' with RSA signature successful<br>
21[CFG] checking certificate status of "CN=c6-r1, OU=load-test, O=strongSwan"<br>21[CFG] certificate status is not available<br>21[CFG] reached self-signed root ca with a path length of 0<br>21[IKE] authentication of 'CN=c6-r1, OU=load-test, O=strongSwan' with RSA signature successful<br>
21[IKE] authentication of 'CN=srv, OU=load-test, O=strongSwan' (myself) with RSA signature successful<br>21[IKE] IKE_SA rw-server[1] established between 172.17.10.10[CN=srv, OU=load-test, O=strongSwan]...172.17.10.20[CN=c6-r1, OU=load-test, O=strongSwan]<br>
21[IKE] scheduling reauthentication in 3329s<br>21[IKE] maximum IKE_SA lifetime 3509s<br>21[IKE] peer requested virtual IP %any<br>21[CFG] assigning new lease to 'CN=c6-r1, OU=load-test, O=strongSwan'<br>21[IKE] assigning virtual IP 10.3.0.1 to peer 'CN=c6-r1, OU=load-test, O=strongSwan'<br>
21[IKE] traffic selectors <a href="http://172.17.10.10/32">172.17.10.10/32</a> === <a href="http://0.0.0.0/0">0.0.0.0/0</a> inacceptable<br>21[ENC] generating IKE_AUTH response 1 [ IDr AUTH CP(ADDR) N(AUTH_LFT) N(TS_UNACCEPT) ]<br>
21[NET] sending packet: from 172.17.10.10[500] to 172.17.10.20[500]<br>22[IKE] authentication of 'CN=srv, OU=load-test, O=strongSwan' (myself) with RSA signature successful<br>22[IKE] IKE_SA rw-server[3] established between 172.17.10.10[CN=srv, OU=load-test, O=strongSwan]...172.17.10.20[CN=c4-r1, OU=load-test, O=strongSwan]<br>
22[IKE] scheduling reauthentication in 3385s<br>22[IKE] maximum IKE_SA lifetime 3565s<br>22[IKE] peer requested virtual IP %any<br>22[CFG] assigning new lease to 'CN=c4-r1, OU=load-test, O=strongSwan'<br>22[IKE] assigning virtual IP 10.3.0.2 to peer 'CN=c4-r1, OU=load-test, O=strongSwan'<br>
22[IKE] traffic selectors <a href="http://172.17.10.10/32">172.17.10.10/32</a> === <a href="http://0.0.0.0/0">0.0.0.0/0</a> inacceptable<br>22[ENC] generating IKE_AUTH response 1 [ IDr AUTH CP(ADDR) N(AUTH_LFT) N(TS_UNACCEPT) ]<br>
22[NET] sending packet: from 172.17.10.10[500] to 172.17.10.20[500]<br>----------------------------------------------------------------------------------------------------------</div>
<div> </div>
<div>- will try to work more with the load-tester plugin and update if any new observations/issues</div>
<div> </div>
<div>thanks & regards</div>
<div>rajiv</div>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
<div><br> </div>
<div class="gmail_quote">On Tue, Aug 2, 2011 at 6:54 PM, Rajiv Kulkarni <span dir="ltr"><<a href="mailto:rajivkulkarni69@gmail.com">rajivkulkarni69@gmail.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">
<div>Hi</div>
<div> </div>
<div>One more followup info. On the m/c enabled with load-tester plugin and simulating multiple rw-clients, i have the following strongswan.conf config file:</div>
<div>-----------------------------------------------------------------------------------</div>
<div class="im">
<div># strongswan.conf - strongSwan configuration file</div>
<div>charon {<br> reuse_ikesa = no<br> # number of worker threads in charon<br> threads = 32</div>
<div> # send strongswan vendor ID?<br> # send_vendor_id = yes</div>
<div> plugins {</div>
<div> sql {<br> # loglevel to log into sql database<br> loglevel = -1</div>
<div> # URI to the database<br> # database = sqlite:///path/to/file.db<br> # database = mysql://user:password@localhost/database<br> }</div>
<div> load-tester {</div></div>
<div>
<div class="im"> # enable the plugin<br> enable = yes<br></div> # 10000 connections, ten in parallel<br> initiators = 5<br> iterations = 2
<div class="im"><br> # use a delay of 100ms, overall time is: iterations * delay = 100s<br> delay = 100<br> # address of the gateway<br></div>
<div class="im"> remote = 172.17.10.10<br> # IKE-proposal to use<br> proposal = aes128-sha1-modp1024<br> # use faster PSK authentication instead of 1024bit RSA<br>
initiator_auth = psk<br> responder_auth = psk<br> # request a virtual IP using configuration payloads<br> request_virtual_ip = yes<br> # disable IKE_SA rekeying (default)<br>
ike_rekey = 0<br> # enable CHILD_SA every 60s<br> child_rekey = 60<br></div>
<div class="im"> # do not delete the IKE_SA after it has been established (default)<br> delete_after_established = no<br> # do not shut down the daemon if all IKE_SAs established<br>
shutdown_when_complete = no<br> }</div></div>
<div> </div>
<div> }</div>
<div> # ...<br>}</div>
<div>pluto {</div>
<div>}</div>
<div>libstrongswan {</div>
<div>
<div class="im"> # set to no, the DH exponent size is optimized<br> # dh_exponent_ansi_x9_42 = no<br>}<br>[root@dvtpc3 etc]#<br></div>[root@dvtpc3 etc]#<br>[root@dvtpc3 etc]# ipsec start<br>Starting strongSwan 4.5.2 IPsec [starter]...<br>
[root@dvtpc3 etc]#</div>
<div> </div>
<div>----------------------------------------------------------------------------------</div>
<div> </div>
<div>and on running th command</div>
<div> </div>
<div>[root@dvtpc3 etc]# ipsec start</div>
<div>[root@dvtpc3 etc]# ipsec statusall<br>000 Status of IKEv1 pluto daemon (strongSwan 4.5.2):<br>000 interface lo/lo ::1:500<br>000 interface lo/lo <a href="http://127.0.0.1:500/" target="_blank">127.0.0.1:500</a><br>000 interface eth0/eth0 <a href="http://172.17.10.253:500/" target="_blank">172.17.10.253:500</a><br>
000 interface eth2/eth2 <a href="http://192.168.21.1:500/" target="_blank">192.168.21.1:500</a><br>000 %myid = '%any'<br>000 loaded plugins: aes des sha1 sha2 md5 random x509 pkcs1 pgp dnskey pem openssl gmp hmac xauth attr kernel-netlink resolve<br>
000 debug options: none<br>000<br>Status of IKEv2 charon daemon (strongSwan 4.5.2):<br> uptime: 4 seconds, since Aug 02 18:49:59 2011<br> malloc: sbrk 262144, mmap 0, used 92800, free 169344<br> worker threads: 25 idle of 32, job queue load: 0, scheduled events: 20<br>
loaded plugins: aes des sha1 sha2 md5 random x509 revocation constraints pubkey pkcs1 pgp pem openssl fips-prf gmp xcbc hmac attr load-tester kernel-netlink resolve socket-raw stroke updown<br>Listening IP addresses:<br>
172.17.10.253<br> 192.168.21.1<br>Connections:<br> load-test: 0.0.0.0...172.17.10.10<br> load-test: local: [<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>] uses pre-shared key authentication<br>
load-test: remote: [*.<a href="http://strongswan.org/" target="_blank">strongswan.org</a>] uses pre-shared key authentication<br> load-test: child: dynamic === dynamic<br>Security Associations:<br> none<br>[root@dvtpc3 etc]#</div>
<div><br>so here it shows the local system with id as <a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>, whereas it is actually supposed to be a rw-client </div>
<div> </div>
<div>thanks & regards</div>
<div>rajiv</div>
<div>
<div></div>
<div class="h5">
<div><br> </div>
<div class="gmail_quote">On Tue, Aug 2, 2011 at 6:25 PM, Rajiv Kulkarni <span dir="ltr"><<a href="mailto:rajivkulkarni69@gmail.com" target="_blank">rajivkulkarni69@gmail.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">
<div>Hi</div>
<div>
<div><br>>>The problem is not the secret, but that no config matches on your<br>>>responder. "leftid" defaults to "left" (172.17.10.10), but actually is<br>>><a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>. Try leftid=<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>, or even leftid=%any.<br>
</div></div>
<div>I did just that, i used leftid=%any on the rw-server. But when i start the ipsec (ipsec start --nofork) on the load-tester-plugin enabled m/c, i still get auth failed messages.</div>
<div> </div>
<div>Meanwhile on the server i get the following messages:</div>
<div>-----------------------------------------------------------------------------</div>
<div>28[NET] received packet: from 172.17.10.253[500] to 172.17.10.10[500]<br>28[ENC] parsed IKE_AUTH request 1 [ IDi IDr AUTH CP(ADDR DNS) SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]<br>28[CFG] looking for peer configs matching 172.17.10.10[<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>]...172.17.10.253[<a href="http://c6-r1.strongswan.org/" target="_blank">c6-r1.strongswan.org</a>]<br>
28[CFG] selected peer config 'rw-server'<br>28[IKE] tried 1 shared key for '<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>' - '<a href="http://c6-r1.strongswan.org/" target="_blank">c6-r1.strongswan.org</a>', but MAC mismatched<br>
28[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>28[NET] sending packet: from 172.17.10.10[500] to 172.17.10.253[500]<br>28[NET] received packet: from 172.17.10.253[500] to 172.17.10.10[500]<br>28[ENC] parsed IKE_AUTH request 1 [ IDi IDr AUTH CP(ADDR DNS) SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]<br>
28[CFG] looking for peer configs matching 172.17.10.10[<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>]...172.17.10.253[<a href="http://c6-r1.strongswan.org/" target="_blank">c6-r1.strongswan.org</a>]<br>
28[CFG] selected peer config 'rw-server'<br>28[IKE] tried 1 shared key for '<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>' - '<a href="http://c6-r1.strongswan.org/" target="_blank">c6-r1.strongswan.org</a>', but MAC mismatched<br>
28[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>28[NET] sending packet: from 172.17.10.10[500] to 172.17.10.253[500]</div>
<div> </div>
<div>------------------------------------------------------------------------------------------</div>
<div> </div>
<div>- On the rw-server, iam using the following setting in the "ipsec.secrets" file</div>
<div>: PSK "default-psk"</div>
<div> </div>
<div>- and the ipsec.conf on the rw-server m/c is as below:</div>
<div>-------------------------------------------------------------------------</div>
<div>
<div>[root@dvtpc1 etc]# cat ipsec.conf<br># /etc/ipsec.conf - strongSwan IPsec configuration file</div>
<div>config setup<br> strictcrlpolicy=no<br> crlcheckinterval=180<br> plutostart=yes<br> charonstart=yes</div></div>
<div>
<div>conn %default<br> ikelifetime=60m<br> keylife=30m<br> rekeymargin=3m<br> keyingtries=1<br></div> keyexchange=ikev2<br> mobike=no</div>
<div>
<div>conn rw-server<br> left=172.17.10.10<br> leftsubnet=<a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a><br></div> leftid=%any
<div><br> right=%any<br> rightsourceip=<a href="http://10.3.0.0/16" target="_blank">10.3.0.0/16</a><br></div> authby=psk
<div><br> keyexchange=ikev2<br> type=tunnel<br> auto=add<br>#</div></div>
<div>--------------------------------------------</div>
<div> </div>
<div>- both the rw-server (with ipaddr <a href="http://172.17.10.10/24" target="_blank">172.17.10.10/24</a>, DGw-IP: 172.17.10.253) and the rw-client (with load-tester-plugin enabled and with ipaddr <a href="http://172.17.10.253/24" target="_blank">172.17.10.253/24</a>, Dgw-ip: 172.17.10.10) are connected back-to-back and both are running strongswan4.5.2 on Linux-Fedora13.</div>
<div> </div>
<div> </div>
<div>so where am i going wrong<br></div>
<div>thanks & regards</div>
<div>rajiv</div>
<div>
<div></div>
<div>
<div> </div>
<div class="gmail_quote">On Tue, Aug 2, 2011 at 1:09 PM, Martin Willi <span dir="ltr"><<a href="mailto:martin@strongswan.org" target="_blank">martin@strongswan.org</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">
<div><br><br>> 15[CFG] looking for peer configs matching 172.17.10.10[<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>]...172.17.10.253[<a href="http://c5-1.strongswan.org/" target="_blank">c5-1.strongswan.org</a>]<br>
> 15[CFG] no matching peer config found<br>> 15[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br><br><br></div>
<div>> conn rw-server<br>> left=172.17.10.10<br>> leftsubnet=<a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a><br>> right=%any<br><br></div>The problem is not the secret, but that no config matches on your<br>
responder. "leftid" defaults to "left" (172.17.10.10), but actually is<br><a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>. Try leftid=<a href="http://srv.strongswan.org/" target="_blank">srv.strongswan.org</a>, or even leftid=%any.<br>
<br>Regards<br><font color="#888888">Martin<br><br><br></font></blockquote></div><br></div></div></blockquote></div><br></div></div></blockquote></div><br>