<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<STYLE type=text/css>@import url( C:\Users\xy\AppData\Roaming\Foxmail\FoxTemp6.5(40)\\scrollbar.css );
@import url( C:\Users\xy\AppData\Roaming\Foxmail\FoxTemp6.5(40)\\scrollbar.css );
@import url( C:\Users\xy\AppData\Roaming\Foxmail\FoxTemp6.5(40)\\scrollbar.css );
@import url( C:\Users\xy\AppData\Roaming\Foxmail\FoxTemp6.5(40)\\scrollbar.css );
@import url( C:\Users\xy\AppData\Roaming\Foxmail\FoxTemp6.5(40)\\scrollbar.css );
@import url( C:\Users\xy\AppData\Roaming\Foxmail\FoxTemp6.5(40)\\scrollbar.css );
</STYLE>
<META content="text/html; charset=gb2312" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 9.00.8112.16434"><LINK rel=stylesheet
href="BLOCKQUOTE{margin-Top: 0px; margin-Bottom: 0px; margin-Left: 2em}"></HEAD>
<BODY style="MARGIN: 10px; FONT-FAMILY: verdana; FONT-SIZE: 10pt">
<DIV><FONT size=2 face=Verdana>Hello,</FONT></DIV>
<DIV> </DIV>
<DIV>I'm setting up an ikev2/rw-eap-aka-rsa tunnel between gateway and
arm development board with linux kernel.</DIV>
<DIV>daemon log shows "client error 'unable to process packet'", board side
cann't log, it outputs something like 'MAC' error...</DIV>
<DIV> </DIV>
<DIV>the configure files and error log show below,</DIV>
<DIV>BTW, i've tried the exact configuration, and it works normally
between gateway and another linux laptop.</DIV>
<DIV> </DIV>
<DIV>I used cross-compilation to install strongswan onto the arm
board, and didn't enable padlock option, could that be the reason?</DIV>
<DIV>however, it's a pity that it'll show error message "impossible constraint
in 'asm'" during 'Make' phase if padlock option enabled.</DIV>
<DIV> </DIV>
<DIV>Thanks in advanced for any help.</DIV>
<DIV>Best Regards.</DIV>
<DIV>Feng</DIV>
<DIV> </DIV>
<DIV>-----------#gateway#</DIV>
<DIV>
<DIV># /etc/ipsec.conf - strongSwan IPsec configuration file</DIV>
<DIV> </DIV>
<DIV></DIV>
<DIV>config setup</DIV>
<DIV> </DIV>
<DIV>strictcrlpolicy=no</DIV>
<DIV>plutostart=no</DIV>
<DIV> </DIV>
<DIV></DIV>
<DIV>conn %default</DIV>
<DIV> </DIV>
<DIV>ikelifetime=60m</DIV>
<DIV>keylife=20m</DIV>
<DIV>rekeymargin=3m</DIV>
<DIV>keyingtries=1</DIV>
<DIV>keyexchange=ikev2</DIV>
<DIV> </DIV>
<DIV></DIV>
<DIV>conn rw-eap-aka</DIV>
<DIV> </DIV>
<DIV>left=10.21.1.150</DIV>
<DIV>leftsubnet=192.168.1.0/24</DIV>
<DIV>leftid="C=CN, O=ict-gw, CN=peer"</DIV>
<DIV>leftcert=peerCert.der</DIV>
<DIV>leftauth=pubkey</DIV>
<DIV>leftfirewall=yes</DIV>
<DIV>right=%any</DIV>
<DIV>rightid="C=CN, O=ict-gw, CN=peer0"</DIV>
<DIV>rightsendcert=never</DIV>
<DIV>rightauth=eap-aka</DIV>
<DIV>auto=add</DIV></DIV>
<DIV><FONT size=2 face=Verdana></FONT> </DIV>
<DIV>-----------#board#</DIV>
<DIV>
<DIV># /etc/ipsec.conf - strongSwan IPsec configuration file</DIV>
<DIV> </DIV>
<DIV></DIV>
<DIV>config setup</DIV>
<DIV> </DIV>
<DIV>plutostart=no</DIV>
<DIV> </DIV>
<DIV></DIV>
<DIV>conn %default</DIV>
<DIV> </DIV>
<DIV>ikelifetime=60m</DIV>
<DIV>keylife=20m</DIV>
<DIV>rekeymargin=3m</DIV>
<DIV>keyingtries=1</DIV>
<DIV>keyexchange=ikev2</DIV>
<DIV> </DIV>
<DIV></DIV>
<DIV>conn home</DIV>
<DIV> </DIV>
<DIV>left=10.21.1.210</DIV>
<DIV>leftnexthop=%direct</DIV>
<DIV>leftid="C=CN, O=ict-gw, CN=peer0"</DIV>
<DIV>leftauth=eap</DIV>
<DIV>leftfirewall=yes</DIV>
<DIV>right=10.21.1.150</DIV>
<DIV>rightid="C=CN, O=ict-gw, CN=peer"</DIV>
<DIV>rightsubnet=192.168.1.0/24</DIV>
<DIV>rightauth=pubkey</DIV>
<DIV>auto=add</DIV></DIV>
<DIV> </DIV>
<DIV>-----------#gateway#</DIV>
<DIV>
<DIV># /etc/ipsec.secrets - strongSwan IPsec secrets file</DIV>
<DIV> </DIV>
<DIV></DIV>
<DIV>: RSA peerKey.der</DIV>
<DIV></DIV>
<DIV>: EAP "Ar3etTnp01qlpOgb"</DIV></DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>-----------#board#</DIV>
<DIV>
<DIV># /etc/ipsec.secrets - strongSwan IPsec secrets file</DIV>
<DIV> </DIV>
<DIV></DIV>
<DIV> : EAP "Ar3etTnp01qlpOgb"</DIV>
<DIV> </DIV>
<DIV>----------#daemon log#</DIV>
<DIV>
<DIV>Sep 5 21:58:39 ubuntu charon: 00[DMN] Starting IKEv2 charon daemon (strongSwan 4.5.3)</DIV>
<DIV>Sep 5 21:58:39 ubuntu charon: 00[LIB] plugin 'curl' failed to load: /usr/local/lib/ipsec/plugins/libstrongswan-curl.so: cannot open shared object file: No such file or directory</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[CFG] loading ca certificates from '/usr/local/etc/ipsec.d/cacerts'</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[CFG] loaded ca certificate "C=CN, O=ict, CN=strongSwan CA" from '/usr/local/etc/ipsec.d/cacerts/caCert.pem'</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[CFG] loading aa certificates from '/usr/local/etc/ipsec.d/aacerts'</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[CFG] loading ocsp signer certificates from '/usr/local/etc/ipsec.d/ocspcerts'</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[CFG] loading attribute certificates from '/usr/local/etc/ipsec.d/acerts'</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[CFG] loading crls from '/usr/local/etc/ipsec.d/crls'</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[CFG] loading secrets from '/usr/local/etc/ipsec.secrets'</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[CFG] loaded RSA private key from '/usr/local/etc/ipsec.d/private/peerKey.pem'</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[CFG] loaded EAP secret for %any</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[KNL] listening on interfaces:</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[KNL] eth0</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[KNL] 10.21.1.150</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[KNL] 2001:cc0:2026:3:21e:68ff:fe83:faca</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[KNL] fe80::21e:68ff:fe83:faca</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[KNL] wlan0</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[KNL] 192.168.1.102</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[KNL] fe80::21f:3cff:fe92:9ba6</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[DMN] loaded plugins: aes des sha1 sha2 md5 pem pkcs1 gmp random x509 revocation hmac xcbc stroke kernel-netlink socket-default fips-prf eap-aka eap-aka-3gpp2 updown </DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 00[JOB] spawning 16 worker threads</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 05[CFG] received stroke: add connection 'rw-eap-aka'</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 05[CFG] loaded certificate "C=CN, O=ict-gw, CN=peer" from 'peerCert.pem'</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 05[CFG] added configuration 'rw-eap-aka'</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 11[NET] received packet: from 10.21.1.210[500] to 10.21.1.150[500]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 11[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 11[IKE] 10.21.1.210 is initiating an IKE_SA</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 11[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 11[NET] sending packet: from 10.21.1.150[500] to 10.21.1.210[500]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 12[NET] received packet: from 10.21.1.210[4500] to 10.21.1.150[4500]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 12[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 12[IKE] received cert request for "C=CN, O=ict, CN=strongSwan CA"</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 12[CFG] looking for peer configs matching 10.21.1.150[C=CN, O=ict-gw, CN=peer]...10.21.1.210[C=CN, O=ict-gw, CN=peer0]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 12[CFG] selected peer config 'rw-eap-aka'</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 12[IKE] initiating EAP_AKA method (id 0x87)</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 12[IKE] peer supports MOBIKE</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 12[IKE] authentication of 'C=CN, O=ict-gw, CN=peer' (myself) with RSA signature successful</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 12[IKE] sending end entity cert "C=CN, O=ict-gw, CN=peer"</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 12[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/AKA ]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 12[NET] sending packet: from 10.21.1.150[4500] to 10.21.1.210[4500]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 13[NET] received packet: from 10.21.1.210[4500] to 10.21.1.150[4500]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 13[ENC] parsed IKE_AUTH request 2 [ EAP/RES/AKA ]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 13[IKE] '0.1?0???U????CN1?0???U????ict-gw1?0???U????peer0' is not a reauth identity</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 13[IKE] '0.1?0???U????CN1?0???U????ict-gw1?0???U????peer0' is not a pseudonym</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 13[IKE] received identity '0.1?0???U????CN1?0???U????ict-gw1?0???U????peer0'</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 13[ENC] generating IKE_AUTH response 2 [ EAP/REQ/AKA ]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 13[NET] sending packet: from 10.21.1.150[4500] to 10.21.1.210[4500]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 03[NET] received packet: from 10.21.1.210[4500] to 10.21.1.150[4500]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 03[ENC] parsed IKE_AUTH request 3 [ EAP/RES/AKA ]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 03[IKE] received EAP-AKA client error 'unable to process packet'</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 03[IKE] EAP method EAP_AKA failed for peer C=CN, O=ict-gw, CN=peer0</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 03[ENC] generating IKE_AUTH response 3 [ EAP/FAIL ]</DIV>
<DIV>Sep 5 21:58:40 ubuntu charon: 03[NET] sending packet: from 10.21.1.150[4500] to 10.21.1.210[4500]</DIV></DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>------------#./configure options for cross-compilation/</DIV>
<DIV>
<DIV>./configure --enable-eap-aka --enable-dhcp --enable-coupling --enable-load-tester --enable-nat-transport --with-capabilities=LIBCAP --disable-pluto --enable-eap-aka-3gpp2</DIV>
<DIV> </DIV></DIV>
<DIV> </DIV></DIV>
<DIV align=left><FONT size=2 face=Verdana><FONT color=#c0c0c0 size=2
face=Verdana><SPAN> </DIV></SPAN></FONT></FONT></BODY></HTML>