<div>Hi</div>
<div> </div>
<div>Also, i think the following entries in the left-peer-gw should also work if iam right?</div>
<div> </div>
<div>In the ipsec.conf of left and/or right GWs</div>
<div>-------------------------------------------------------------</div>
<div> ..........</div>
<div>.........</div>
<div>....</div>
<div>leftcert=testcert.pem</div>
<div>rightca=%same</div>
<div>....</div>
<div>....</div>
<div>-------------------------------------------------</div>
<div> </div>
<div>- no need to mentione leftid and rightid, right?</div>
<div><br>br</div>
<div>rajiv</div>
<div><br> </div>
<div class="gmail_quote">On Sat, Jan 14, 2012 at 10:47 PM, Umarale, Lakshmi S (Lakshmi) <span dir="ltr"><<a href="mailto:lakshmi.umarale@alcatel-lucent.com">lakshmi.umarale@alcatel-lucent.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">Hello Andreas,<br><br>Thanks for the prompt response and also all the explanation. This really helps.<br>Since we will never know exactly which type of RDNs are used by the<br>
SEGW in its certificate, I think we will have to use rightid=%any.<br>I will give it a try with this.<br><br>Best regards,<br>Lakshmi<br>
<div>
<div></div>
<div class="h5"><br>-----Original Message-----<br>From: Andreas Steffen [mailto:<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a>]<br>Sent: Saturday, January 14, 2012 12:11 AM<br>To: Umarale, Lakshmi S (Lakshmi)<br>
Cc: <a href="mailto:users@lists.strongswan.org">users@lists.strongswan.org</a><br>Subject: Re: [strongSwan] rightid (Ipsec with Certificates)<br><br>Hello Lakshmi,<br><br>rightid and leftid are required to prevent an endpoint having<br>
a valid and trusted certificate to take on the identity of another<br>endpoint (e.g. a client acting as the SEGW).<br><br>The leftid must exactly match either the subjectDistinguishedName or<br>a subjectAltName in the leftcert. rightid must match the identity<br>
of the remote endpoint but may contain wildcards, the most general<br>being rightid=%any which returns a full match for any id. rightid<br>is sent by the initiator in the optional IDr payload in order to<br>assist the remote endpoint in the selection of the identity to be<br>
used if the remote endpoint has multiple identities (e.g. multiple<br>certificates). If rightid contains at least one wildcard ('*' character)<br>then IDr is omitted but the the responder must always return its<br>
full IDr not containing any wildcards.<br><br>In your first example where you define<br><br> rightid="C=*, O=*, OU=*, CN=*"<br><br>the IDr payload is not sent by the initiator and the responder<br>returns an IDr of the form<br>
<br> "O=Alcatel, CN=<a href="mailto:654321@alcatel-lucent.com">654321@alcatel-lucent.com</a>"<br><br>which does not match your rightid template because the C= and OU=<br>RDNs are missing and the following local error is produced:<br>
<br>constraint check failed: identity 'C=*, O=*, OU=*, CN=*' required<br>selected peer config '30' inacceptable<br>no alternative config found<br><br>In order for your example to work you must either define<br>
<br> rightid="O=*, CN=*"<br><br>or if you don't know exaclty which type of RDNs are used by the<br>SEGW in its certificate just<br><br> rightid=%any<br><br>Please be aware that the use of wildcards makes your endpoints<br>
vulnerable to kind of man-in-the-middle attacks mentioned in the<br>first paragraph.<br><br>In your second example you didn't specify any rightid. In that case<br>by default the IP address specified by right is used as rightid, i.e.<br>
<br> rightid=172.21.11.181<br><br>Since this IDr is not contained in the SEGW's certificate the<br>remote error<br><br>parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>received AUTHENTICATION_FAILED notify error<br><br>
is received.<br><br>I hope this helps!<br><br>Best regards<br><br>Andreas<br><br>On 14.01.2012 03:59, Umarale, Lakshmi S (Lakshmi) wrote:<br>> This is our configuration -<br>><br>><br>><br>> SEG <IPSEC TUNNEL> ENodeB<br>
><br>><br>><br>> The eNodeB is the initiator.<br>><br>><br>><br>> The eNodeB must know in advance the attributes that it will receive in<br>> the certificate of the SEG in the name of the SEG.<br>
><br>> I have been able to get the authentication working only by specifying<br>> rightid="O=*, CN=*" (attributes in the certificate of the SEG) on the eNodeB<br>><br>><br>><br>> If we set the rightid as "C=*, O=*, OU=*, CN=*"<br>
><br>><br>><br>> initiating IKE_SA 30[3] to 172.21.11.181<br>><br>> generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>><br>> sending packet: from 172.21.11.21[500] to 172.21.11.181[500]<br>
><br>> received packet: from 172.21.11.181[500] to 172.21.11.21[500]<br>><br>> parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP)<br>> CERTREQ N(MULT_AUTH) ]<br>><br>> received cert request for "O=Alcatel, CN=CMS"<br>
><br>> sending cert request for "O=Alcatel, CN=CMS"<br>><br>> authentication of 'O=Alcatel, CN=123456.CMS1' (myself) with RSA<br>> signature successful<br>><br>> sending end entity cert "O=Alcatel, CN=123456.CMS1"<br>
><br>> sending issuer cert "O=Alcatel, CN=CMS1"<br>><br>> establishing CHILD_SA 30<br>><br>> generating IKE_AUTH request 1 [ IDi CERT CERT N(INIT_CONTACT) CERTREQ<br>> AUTH SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]<br>
><br>> sending packet: from 172.21.11.21[500] to 172.21.11.181[500]<br>><br>> received packet: from 172.21.11.181[500] to 172.21.11.21[500]<br>><br>> parsed IKE_AUTH response 1 [ IDr CERT AUTH SA TSi TSr ]<br>
><br>> received end entity cert "O=Alcatel, CN=<a href="mailto:654321@alcatel-lucent.com">654321@alcatel-lucent.com</a><br>> <mailto:<a href="mailto:CN">CN</a>=<a href="mailto:654321@alcatel-lucent.com">654321@alcatel-lucent.com</a>>"<br>
><br>> using certificate "O=Alcatel, CN=<a href="mailto:654321@alcatel-lucent.com">654321@alcatel-lucent.com</a><br>> <mailto:<a href="mailto:CN">CN</a>=<a href="mailto:654321@alcatel-lucent.com">654321@alcatel-lucent.com</a>>"<br>
><br>> using trusted ca certificate "O=Alcatel, CN=CMS"<br>><br>> checking certificate status of "O=Alcatel, CN=<a href="mailto:654321@alcatel-lucent.com">654321@alcatel-lucent.com</a><br>> <mailto:<a href="mailto:CN">CN</a>=<a href="mailto:654321@alcatel-lucent.com">654321@alcatel-lucent.com</a>>"<br>
><br>> certificate status is not available<br>><br>> reached self-signed root ca with a path length of 0<br>><br>> authentication of 'O=Alcatel, CN=<a href="mailto:654321@alcatel-lucent.com">654321@alcatel-lucent.com</a><br>
> <mailto:<a href="mailto:CN">CN</a>=<a href="mailto:654321@alcatel-lucent.com">654321@alcatel-lucent.com</a>>' with RSA signature successful<br>><br>> constraint check failed: identity 'C=*, O=*, OU=*, CN=*' required<br>
><br>> selected peer config '30' inacceptable<br>><br>> no alternative config found<br>><br>><br>><br>><br>><br>> Without specifying the righid, I get authentication failure<br>><br>
><br>><br>> initiating IKE_SA 30[8] to 172.21.11.181<br>><br>> generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>><br>> sending packet: from 172.21.11.21[500] to 172.21.11.181[500]<br>
><br>> received packet: from 172.21.11.181[500] to 172.21.11.21[500]<br>><br>> parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP)<br>> CERTREQ N(MULT_AUTH) ]<br>><br>> received cert request for "O=Alcatel, CN=CMS"<br>
><br>> sending cert request for "O=Alcatel, CN=CMS"<br>><br>> authentication of 'O=Alcatel, CN=123456.CMS1' (myself) with RSA<br>> signature successful<br>><br>> sending end entity cert "O=Alcatel, CN=123456.CMS1"<br>
><br>> sending issuer cert "O=Alcatel, CN=CMS1"<br>><br>> establishing CHILD_SA 30<br>><br>> generating IKE_AUTH request 1 [ IDi CERT CERT N(INIT_CONTACT) CERTREQ<br>> IDr AUTH SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]<br>
><br>> sending packet: from 172.21.11.21[500] to 172.21.11.181[500]<br>><br>> received packet: from 172.21.11.181[500] to 172.21.11.21[500]<br>><br>> parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>><br>
> received AUTHENTICATION_FAILED notify error<br>><br>><br>><br>> I would like to understand the purpose of leftid and rightid. Why do we<br>> need to specify them?<br>><br>><br>><br>> Regards,<br>
><br>> Lakshmi<br><br>======================================================================<br>Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
strongSwan - the Linux VPN Solution! <a href="http://www.strongswan.org/" target="_blank">www.strongswan.org</a><br>Institute for Internet Technologies and Applications<br>University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>===========================================================[ITA-HSR]==<br><br><br></div></div>_______________________________________________<br>Users mailing list<br><a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br></blockquote></div><br>