Hi,<br>I have been able to successfully establish IPSec IKEv2 tunnel between Nexus S (running 2.3.5_r1) and a ubuntu server. However, the latest 4.6.1 release supports starter and stroke executables at Android and I am trying to establish the same connection using ipsec.conf and ipsec.secrets.<br>
<br>My server side configuration is:<br>======================<br><br>server IP: <i>192.168.1.154</i><br><br>ipsec.conf:<br><br><div style="margin-left: 80px;">config setup<br> crlcheckinterval=180<br> strictcrlpolicy=no<br>
plutostart=no<br> charondebug="knl 3, cfg 2, ike 2, chd 2, mgr 2, dmn 2"<br><br>conn %default<br> ikelifetime=60m<br> keylife=20m<br> rekeymargin=3m<br> keyingtries=1<br>
keyexchange=ikev2<br> # leftcert=moonCert.pem<br><br># Add connections here.<br><br>conn android<br> left=192.168.1.154<br> leftid=192.168.1.154<br> leftcert=moonCert.pem<br> leftauth=pubkey<br>
right=%any<br> rightsourceip=<a href="http://10.0.5.0/24">10.0.5.0/24</a><br> rightauth=eap-mschapv2<br> rightsendcert=never<br> eap_identity=deepika<br> auto=add<br></div><br>ipsec.secrets:<br><br><div style="margin-left: 80px;">
: RSA moonKey.pem<br><br>deepika : EAP "deepika"<br></div><br>Configuration at Nexus S (Android 2.3.5_r1):<br>================================<br><br>I manually created "ipsec.d" directory in /system/etc/ and put my ca certificate in cacerts there, and then created ipsec.conf and ipsec.secrets in /system/etc/<br>
<br>/system/etc/ipsec.conf<br><br><div style="margin-left: 80px;">config setup<br> plutostart=no<br> charondebug="knl 3, cfg 2, ike 2, chd 2, mgr 2, dmn 2"<br><br>conn %default<br> ikelifetime=60m<br> keylife=20m<br>
rekeymargin=3m<br> keyingtries=1<br> keyexchange=ikev2<br><br># Add connections here.<br><br># Sample VPN connections<br><br>conn android<br> left=192.168.1.2<br> leftauth=eap<br> eap_identity=deepika <br>
right=192.168.1.154<br> rightid=192.168.1.154<br> rightauth=pubkey<br> auto=add<br></div><br>/system/etc/ipsec.secrets<br><br><div style="margin-left: 80px;">deepika : EAP "deepika"<br><br><br></div>
<br>But when I start the connection I am getting the following error:<br><br><div style="margin-left: 40px;"># ipsec stroke up android<br>uname: not found<br>uname: not found<br>[: not found<br>initiating IKE_SA android[2] to 192.168.1.154<br>
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>sending packet: from 192.168.1.2[500] to 192.168.1.154[500]<br>received packet: from 192.168.1.154[500] to 192.168.1.2[500]<br>parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]<br>
sending cert request for "C=UK, CN=nits"<br>establishing CHILD_SA android<br>generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr CP(DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]<br>
sending packet: from 192.168.1.2[4500] to 192.168.1.154[4500]<br>received packet: from 192.168.1.154[4500] to 192.168.1.2[4500]<br>parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/MSCHAPV2 ]<br>received end entity cert "C=UK, CN=nits"<br>
using certificate "C=UK, CN=nits"<br> using trusted ca certificate "C=UK, CN=nits"<br> reached self-signed root ca with a path length of 0<br>authentication of '192.168.1.154' with RSA signature successful<br>
server requested EAP_MSCHAPV2 authentication (id 0x75)<br>no EAP key found for hosts '192.168.1.154' - '192.168.1.2'<br>EAP_MSCHAPV2 method failed<br></div><br><br>Output of logcat:<br><br><div style="margin-left: 40px;">
I/charon ( 469): 00[CFG] loading ca certificates from '/system/etc/ipsec.d/cacerts'<br>I/charon ( 469): 00[CFG] loaded ca certificate "C=UK, CN=nits" from '/system/etc/ipsec.d/cacerts/strongswanCert.pem'<br>
I/charon ( 469): 00[CFG] loading aa certificates from '/system/etc/ipsec.d/aacerts'<br>I/charon ( 469): 00[LIB] opening directory '/system/etc/ipsec.d/aacerts' failed: No such file or directory<br>I/charon ( 469): 00[CFG] reading directory failed<br>
I/charon ( 469): 00[CFG] loading ocsp signer certificates from '/system/etc/ipsec.d/ocspcerts'<br>I/charon ( 469): 00[LIB] opening directory '/system/etc/ipsec.d/ocspcerts' failed: No such file or directory<br>
I/charon ( 469): 00[CFG] reading directory failed<br>I/charon ( 469): 00[CFG] loading attribute certificates from '/system/etc/ipsec.d/acerts'<br>I/charon ( 469): 00[LIB] opening directory '/system/etc/ipsec.d/acerts' failed: No such file or directory<br>
I/charon ( 469): 00[CFG] reading directory failed<br>I/charon ( 469): 00[CFG] loading crls from '/system/etc/ipsec.d/crls'<br>I/charon ( 469): 00[LIB] opening directory '/system/etc/ipsec.d/crls' failed: No such file or directory<br>
I/charon ( 469): 00[CFG] reading directory failed<br>I/charon ( 469): 00[CFG] loading secrets from '/system/etc/ipsec.secrets'<br>I/charon ( 469): 00[CFG] loaded EAP secret for deepika<br>I/charon ( 469): 00[DMN] loaded plugins: openssl fips-prf random pubkey pkcs1 pem xcbc hmac kernel-netlink socket-default android stroke eap-identity eap-mschapv2 eap-md5 <br>
I/charon ( 469): 00[JOB] spawning 16 worker threads<br>I/charon ( 469): 11[CFG] received stroke: add connection 'android'<br>I/charon ( 469): 11[CFG] added configuration 'android'<br><br>I/charon ( 469): 12[CFG] received stroke: initiate 'android'<br>
I/charon ( 469): 14[IKE] initiating IKE_SA android[1] to 192.168.1.154<br>I/charon ( 469): 14[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>I/charon ( 469): 14[NET] sending packet: from 192.168.1.2[500] to 192.168.1.154[500]<br>
D/GpsLocationProvider( 107): NTP server returned: 1321866231250 (Mon Nov 21 09:03:51 GMT+00:00 2011) reference: 318100 certainty: 337 system time offset: -20070741<br>I/charon ( 469): 15[IKE] retransmit 1 of request with message ID 0<br>
I/charon ( 469): 15[NET] sending packet: from 192.168.1.2[500] to 192.168.1.154[500]<br>I/charon ( 469): 03[IKE] retransmit 2 of request with message ID 0<br>I/charon ( 469): 03[NET] sending packet: from 192.168.1.2[500] to 192.168.1.154[500]<br>
I/charon ( 469): 16[IKE] retransmit 3 of request with message ID 0<br>I/charon ( 469): 16[NET] sending packet: from 192.168.1.2[500] to 192.168.1.154[500]<br>I/charon ( 469): 02[NET] received packet: from 192.168.1.154[500] to 192.168.1.2[500]<br>
I/charon ( 469): 02[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]<br>I/charon ( 469): 02[IKE] sending cert request for "C=UK, CN=nits"<br>I/charon ( 469): 02[IKE] establishing CHILD_SA android<br>
I/charon ( 469): 02[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr CP(DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]<br>I/charon ( 469): 02[NET] sending packet: from 192.168.1.2[4500] to 192.168.1.154[4500]<br>
I/charon ( 469): 01[NET] received packet: from 192.168.1.154[4500] to 192.168.1.2[4500]<br>I/charon ( 469): 01[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/MSCHAPV2 ]<br>I/charon ( 469): 01[IKE] received end entity cert "C=UK, CN=nits"<br>
I/charon ( 469): 01[CFG] using certificate "C=UK, CN=nits"<br>I/charon ( 469): 01[CFG] using trusted ca certificate "C=UK, CN=nits"<br>I/charon ( 469): 01[CFG] reached self-signed root ca with a path length of 0<br>
I/charon ( 469): 01[IKE] authentication of '192.168.1.154' with RSA signature successful<br>I/charon ( 469): 01[IKE] server requested EAP_MSCHAPV2 authentication (id 0xFD)<br>I/charon ( 469): 01[IKE] no EAP key found for hosts '192.168.1.154' - '192.168.1.2'<br>
I/charon ( 469): 01[IKE] EAP_MSCHAPV2 method failed<br>I/dalvikvm( 164): Total arena pages for JIT: 11<br>I/charon ( 469): 11[CFG] received stroke: initiate 'android'<br>I/charon ( 469): 14[IKE] initiating IKE_SA android[2] to 192.168.1.154<br>
I/charon ( 469): 14[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>I/charon ( 469): 14[NET] sending packet: from 192.168.1.2[500] to 192.168.1.154[500]<br>I/charon ( 469): 15[NET] received packet: from 192.168.1.154[500] to 192.168.1.2[500]<br>
I/charon ( 469): 15[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]<br>I/charon ( 469): 15[IKE] sending cert request for "C=UK, CN=nits"<br>I/charon ( 469): 15[IKE] establishing CHILD_SA android<br>
I/charon ( 469): 15[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr CP(DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]<br>I/charon ( 469): 15[NET] sending packet: from 192.168.1.2[4500] to 192.168.1.154[4500]<br>
I/charon ( 469): 03[NET] received packet: from 192.168.1.154[4500] to 192.168.1.2[4500]<br>I/charon ( 469): 03[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/MSCHAPV2 ]<br>I/charon ( 469): 03[IKE] received end entity cert "C=UK, CN=nits"<br>
I/charon ( 469): 03[CFG] using certificate "C=UK, CN=nits"<br>I/charon ( 469): 03[CFG] using trusted ca certificate "C=UK, CN=nits"<br>I/charon ( 469): 03[CFG] reached self-signed root ca with a path length of 0<br>
I/charon ( 469): 03[IKE] authentication of '192.168.1.154' with RSA signature successful<br>I/charon ( 469): 03[IKE] server requested EAP_MSCHAPV2 authentication (id 0x75)<br>I/charon ( 469): 03[IKE] no EAP key found for hosts '192.168.1.154' - '192.168.1.2'<br>
I/charon ( 469): 03[IKE] EAP_MSCHAPV2 method failed<br></div><br>Am I missing something or there are some issues with the release?<br><br>Thanks in advance.<br>Regards,<br>Nitin<br><br>