<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12">
<TITLE>RE: [strongSwan] IKEv1 not working</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">Hi Andreas,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">Thanks a lot for the</FONT> <FONT COLOR="#548DD4" FACE="Consolas">logging</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas"> info</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4">.</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">I have increased the log level as mentioned</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas"> to</FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#548DD4" FACE="Consolas">‘</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">control</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">’</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas"> and have been observing the auth</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">.log</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4">.</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">It seems like there is some authentication problem.</FONT></SPAN><SPAN LANG="en-us"> </SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">Could you please</FONT> <FONT COLOR="#548DD4" FACE="Consolas">let us know</FONT> <FONT COLOR="#548DD4" FACE="Consolas">if there is any particular way in which the certificates have to be handled for IKEv1?</FONT></SPAN></P>
<BR>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">T</FONT><FONT COLOR="#548DD4" FACE="Consolas">he</FONT> <FONT COLOR="#548DD4" FACE="Consolas">certificates</FONT> <FONT COLOR="#548DD4" FACE="Consolas">seems to work fine with</FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#548DD4" FACE="Consolas">IKE</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">v2.</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">Please find below certificate listing for</FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#548DD4" FACE="Consolas">IKE</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">v2</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">:</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><B><FONT COLOR="#000000" FACE="Consolas"># ipsec listcerts</FONT></B></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas">List of X.509 End Entity Certificates:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas"> subject: "C=CH, O=strongSwan, CN=169.254.1.70"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas"> issuer: "C=CH, O=strongSwan, CN=strongSwan CA"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="it"> <FONT COLOR="#000000" FACE="Consolas">serial: 00:ed:ae:f9:52:c4:3b:a8:70</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="it"><FONT COLOR="#000000" FACE="Consolas"> </FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#000000" FACE="Consolas">validity: not before Aug 24 11:52:27 2011, ok</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas"> not after Aug 23 11:52:27 2014, ok </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas"> pubkey: RSA 2048 bits</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas"> keyid: cc:42:17:bb:4d:ce:86:1d:6c</FONT><FONT COLOR="#000000" FACE="Consolas">:62:5c:03:65:aa:e8:5a:97:df:41:44</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="pt"> <FONT COLOR="#000000" FACE="Consolas">subjkey: 9a:f9:a4:1e:0f:71:54:78:8a:af:c6:2f:ae:24:20:71:c0:71:8d:43</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="pt"><FONT COLOR="#000000" FACE="Consolas"> authkey: 1e:fc:6e:71:5e:90:8f:7a:7d:3e:44:6b:32:10:03:a6:13:8d:9f:fa</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="pt"><FONT COLOR="#000000" FACE="Consolas"> subject: "C=CH, O=strongSwan, CN=169.254.0.70"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="pt"><FONT COLOR="#000000" FACE="Consolas"> </FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#000000" FACE="Consolas">issuer: "C=CH, O=strongSwan, CN=strongSwan CA"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="pt"> <FONT COLOR="#000000" FACE="Consolas">serial: 00:9f:bd:99:62:c2:a9:4e:b7</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="pt"><FONT COLOR="#000000" FACE="Consolas"> </FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#000000" FACE="Consolas">validity: not before Aug 24 11:51:14 2011, ok</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas"> not after Aug 23 11:51:14 2014, ok </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas"> pubkey: </FONT></SPAN><SPAN LANG="en-us"><B> <FONT COLOR="#000000" FACE="Consolas">RSA 2048 bits, has private key</FONT></B></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="pt"> <FONT COLOR="#000000" FACE="Consolas">keyid: 3b:2a:c5:</FONT><FONT COLOR="#000000" FACE="Consolas">a1:c5:67:a9:39:5e:5b:2a:18:d4:05:73:b9:83:43:7d:ee</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="pt"><FONT COLOR="#000000" FACE="Consolas"> subjkey: 26:9d:23:b0:57:d7:47:31:91:5f:aa:e6:cc:89:20:65:e4:c4:8a:0f</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="pt"><FONT COLOR="#000000" FACE="Consolas"> </FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#000000" FACE="Consolas">authkey: 1e:fc:6e:71:5e:90:8f:7a:7d:3e:44:6b:32:10:03:a6:13:8d:9f:fa</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">When the ipsec.conf file</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas"> is changed to IKEv1 configuration</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">(with the same setup for ce</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">r</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">t</FONT><FONT COLOR="#548DD4" FACE="Consolas">s)</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">,</FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#548DD4" FACE="Consolas">the</FONT><FONT COLOR="#548DD4" FACE="Consolas">y</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas"> are some</FONT><FONT COLOR="#548DD4" FACE="Consolas">how not getting e</FONT><FONT COLOR="#548DD4" FACE="Consolas">xchanged</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">..:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">Please find below certificate listing for</FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#548DD4" FACE="Consolas">IKE</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">v</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">1</FONT><FONT COLOR="#548DD4" FACE="Consolas">:</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="fr"><FONT COLOR="#000000" FACE="Consolas"># </FONT></SPAN><SPAN LANG="en-us"><B></B></SPAN><B><SPAN LANG="fr"> <FONT COLOR="#000000" FACE="Consolas">ipsec listcerts</FONT></SPAN></B><SPAN LANG="en-us"></SPAN><SPAN LANG="fr"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas">000 </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas">000 List of X.509</FONT><FONT COLOR="#000000" FACE="Consolas"> End Entity Certificates:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas">000 </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas">000 subject: "C=CH, O=strongSwan, CN=169.254.0.70"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas">000 issuer: "C=CH, O=strongSwan, CN=strongSwan CA"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="pt"><FONT COLOR="#000000" FACE="Consolas">000 serial: 00:9f:bd:99:62:c2:a9:4e:b7</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas">000 validity: not before Aug 24 11:51:14 2011 ok</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas">000 no</FONT><FONT COLOR="#000000" FACE="Consolas">t after Aug 23 11:51:14 2014 ok</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="pt"><FONT COLOR="#000000" FACE="Consolas">000 pubkey: RSA 2048 bits</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="pt"><FONT COLOR="#000000" FACE="Consolas">000 keyid: 3b:2a:c5:a1:c5:67:a9:39:5e:5b:2a:18:d4:05:73:b9:83:43:7d:ee</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="pt"><FONT COLOR="#000000" FACE="Consolas">000 subjkey: 26:9d:23:b0:57:d7:47:31:91:5f:aa:e6:cc:89:20:65:e4:c4:8a:0f</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Consolas">000 authkey: 1e:fc:6e:71:5e:90:8f:</FONT><FONT COLOR="#000000" FACE="Consolas">7a:7d:3e:44:6b:32:10:03:a6:13:8d:9f:fa</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">The following lines were also seen in the auth.log:</FONT></SPAN></P>
<BR>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="pt"><FONT COLOR="#000000" FACE="Consolas">Aug 24 15:03:40 vc2_TPC1 pluto[8747]: "kay2" #1: we have a cert and are sending it upon request</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="pt"><FONT COLOR="#000000" FACE="Consolas">Aug 24 15:03:40 vc2_TPC1 pluto[8747]: "kay2" #1: unable to locate my private key for signature</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="pt"><FONT COLOR="#000000" FACE="Consolas">Aug 24 15:03:40 vc2_TPC1 pluto[8747]: "kay2" #1: sending encrypted notification AUTHENTICATION_FAILED to 169.254.0.70:500</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="pt"><FONT COLOR="#000000" FACE="Consolas">Aug 24 15:03:40 vc2_TPC1 pluto[8747]: | state transition function for STATE_MAIN_I2 failed: AUTHENTICATION_FAILED</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="pt"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">Can you please let us know where we are going wrong?</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">Also</FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#548DD4" FACE="Consolas">please</FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#548DD4" FACE="Consolas">find</FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#548DD4" FACE="Consolas">the</FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#548DD4" FACE="Consolas">attached</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas"></FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#548DD4" FACE="Consolas">logs</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas"> which might help in better understanding.</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">:</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Arial" SIZE=2 COLOR="#000000"> <<authlog_src.txt>> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Arial" SIZE=2 COLOR="#000000"> <<ipsec_dst.conf>> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Arial" SIZE=2 COLOR="#000000"> <<ipsec_src.conf>> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Arial" SIZE=2 COLOR="#000000"> <<tcpdump_dst.txt>> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Arial" SIZE=2 COLOR="#000000"> <<tcpdump_src.txt>> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Arial" SIZE=2 COLOR="#000000"> <<authlog_dst.txt>> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">Thanks & Regards, </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#548DD4" FACE="Consolas">Kavitha </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">-----Original Message-----<BR>
</FONT><FONT FACE="Consolas">From:</FONT><FONT FACE="Consolas"> ext Andreas Steffen [<A HREF="mailto:andreas.steffen@strongswan.org">mailto:andreas.steffen@strongswan.org</A>]<BR>
</FONT><FONT FACE="Consolas">Sent:</FONT><FONT FACE="Consolas"> Friday, August 19, 2011 4:23 PM<BR>
</FONT><FONT FACE="Consolas">To:</FONT><FONT FACE="Consolas"> Lm, Kavitha (NSN - IN/Bangalore)<BR>
</FONT><FONT FACE="Consolas">Cc:</FONT><FONT FACE="Consolas"> Users@lists.strongswan.org; Sudhakar, Meera (NSN - IN/Bangalore)<BR>
</FONT><FONT FACE="Consolas">Subj</FONT><FONT FACE="Consolas">ect:</FONT><FONT FACE="Consolas"> Re: [strongSwan] IKEv1 not working</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">Hello Kavit</FONT><FONT FACE="Consolas">ha,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">the IKEv1 pluto daemon is logging to the authpriv syslog facility</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">and not to the daemon facility. Just grep for pluto in /var/log/</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">in order to find the correct log file.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">The status information shows that the first IKEv1 Main Mode</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">exchange has been su</FONT><FONT FACE="Consolas">ccessful but that the other endpoint</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">does not send an answer. In order to generate a helpful log</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">please increase the loglevel in ipsec.conf to</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> plutodebug="control"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">and post the generated log output.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">Best regards</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">Andreas</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">On 19.08.2011 09:22, Lm, Kavi</FONT><FONT FACE="Consolas">tha (NSN - IN/Bangalore) wrote:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> Hi,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> This is regardingan issue that we are facing with IKEv1.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> We are able to setup an IPSEC tunnel with IKEv2 but the same is failing</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> with IKEv1.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> *Ipsec.conf file**for IKEv2**:***</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> config setup</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> # plutodebug=all</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> strictcrlpolicy=no</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> charonstart=yes</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> plutostart=no</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> charondebug=all</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> ca strongswan</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> cacert=caCert.der</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> auto=add</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> conn sample-with-ca-cert</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> left=169.254.1.70</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> leftsubnet=169.254.1.0/24</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> leftcert=VC2Cert.der</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> right=169.254.0.70</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> rightsubnet=169.254.0.0/24</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> rightid="C=CH, O=strongSwan, CN=169.254.0.70"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> keyexchange=ikev2</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT> <FONT FACE="Consolas"> auto=start</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> This configuration works fine for IKEv2 tunnels:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> *# ipsec status*</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> Security Associations:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> sample-with-ca-cert[1]: ESTABLISHED 18 seconds ago, 169.254.0.70[C=CH,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> O=strongSwan, CN=169.254.0.70]...169.254.1.70[C=CH, O=stron</FONT><FONT FACE="Consolas">gSwan,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> CN=169.254.1.70]</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> sample-with-ca-cert{1}: INSTALLED, TUNNEL, ESP SPIs: cb854b6d_i cd9ac880_o</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> sample-with-ca-cert{1}: 169.254.0.0/24 === 169.254.1.0/24</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> The instant we try this for IKEv1(keyexchange=ikev1, charonstart=no, </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> plutostart=yes), it fails and the tunnel is not getting established.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> *# ipsec status*</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> 000 "sample-with-ca-cert": 169.254.1.0/24===169.254.1.70[C=CH,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> O=strongSwan, CN=169.254.1.70]...169.254.0.70[C=CH, O=strongSwan,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> CN=169.254.0.70]===169.25</FONT><FONT FACE="Consolas">4.0.0/24; unrouted; eroute owner: #0</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> 000 "sample-with-ca-cert": newest ISAKMP SA: #0; newest IPsec SA: #0;</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> 000</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> 000 #1: "sample-with-ca-cert" STATE_MAIN_I2 (sent MI2, expecting MR2);</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> EVENT_RETRANSMIT in 8s</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> 000 #1: pending Phase 2 for</FONT><FONT FACE="Consolas"> "sample-with-ca-cert" replacing #0</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> 000</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> No loggingwas observedat all for IKEv1. Could you please let us knowhow</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> to solve this issue??</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> Please find some of the detailsof our environmentbelow:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> *Server:* Ubuntu</FONT><FONT FACE="Consolas">–</FONT><FONT FACE="Consolas">linux-2.6.35</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> *Strongsw</FONT><FONT FACE="Consolas">an**IKEv1**version:*</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> # apt-cache policy strongswan-ikev1</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> strongswan-ikev1:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> Installed: 4.5.2-1.1</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> Candidate: 4.5.2-1.1</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> Version table:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> *** 4.5.2-1.1 0</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> 100 /var/lib/dpkg/status</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> We assume that IKEv1 is already installed from the above status.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> Can you let us know of any other way to checkifIKEv1is supported?</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> /////Thanks & Regards,/</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> /////Kavitha/</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> _______________________________________________</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> Users mailin</FONT><FONT FACE="Consolas">g list</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> Users@lists.strongswan.org</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">> <A HREF="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</A></FONT></SPAN></P>
<BR>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">-- </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">======================================================================</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">Andreas Steffen andreas.steffen@strongswan.org</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">strongSwan - the Linux VPN Solution! www.strongswan.org</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">Institute for Internet Technologies and Applications</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">University of Applied Sciences Rapperswil</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">CH-8640 Rapperswil (Switzerland)</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">=========================================================</FONT><FONT FACE="Consolas">==[ITA-HSR]==</FONT></SPAN></P>
</BODY>
</HTML>