<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt"><br><div><span>Hi all,</span></div><div><br><span></span></div><div><span>I am running StrongSwan 4.6.1 in Debian 6.0.3.</span><br></div><div>There is one IKEv1 conn and one IKEv2 conn. The IKEv1 cipher suites:</div><div> ike=aes128-md5!</div><div> esp=aes128-md5!</div><div> pfs=yes<br></div><div><br></div><div>The IKEv2 cipher suites are almost identical except IKE has dh-group:</div><div> ike=aes128-md5-modp1536!</div><div> esp=aes128-md5!<br></div><div><br></div><div>The IKEv1 conn works but the IKEv2 conn gets "received NO_PROPOSAL_CHOSEN notify error".</div><div><br></div><div>syslog:</div><div>charon: 05[CFG] selecting proposal:<br>charon: 05[CFG] no acceptable DIFFIE_HELLMAN_GROUP found<br>charon: 05[CFG] received proposals: IKE:AES_CBC_128/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1536<br>charon:
05[CFG] configured proposals: IKE:AES_CBC_128/HMAC_MD5_96/PRF_HMAC_MD5<br>charon: 05[LIB] size of DH secret exponent: 1535 bits <br>charon: 05[IKE] received proposals inacceptable<br>charon: 05[ENC] generating IKE_SA_INIT response 0 [ N(NO_PROP) ]<br></div><div><br></div><div>At one point I changed the hash in IKEv1 suite to sha1 to isolate where that "configured proposal" come from: <br></div><div> ike=aes128-sha1-modp1536!</div><div> esp=aes128-sha1!</div><div><br></div><div>The IKEv2 conn is still using aes128-md5-modp1536! Still won't connect. The syslog changed to:</div><div>charon: 05[CFG] received proposals: IKE:AES_CBC_128/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1536<br>charon: 05[CFG] configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536<br>charon: 05[IKE] remote host is behind NAT<br>charon: 05[IKE] received proposals inacceptable<br>charon: 05[ENC] generating IKE_SA_INIT response 0 [ N(NO_PROP)
]<br></div><div><br></div><div>>>>>>>>>>>>>>>>>>>>>>>><br></div><div>Is it possible that charon is searching for matches from pluto's connections? Why should charon have knowledge of</div><div>pluto's connections?<br></div><div><br></div><div>>>>>>>>>>>>>>>>>>>>>>>>>><br></div><div>In another attempt to debug the problem, we arranged the order of the tunnels in ipsec.conf so that IKEv2 conn is ahead of the IKEv1 conn. Then connection is established. And the IKEv1 which is now second in /etc/ipsec.conf still works.</div><div><br></div><div>Appreciate if the experts can shed some light on this issue and give some ideas how to get the connections to</div><div>come up reliably. <br></div><div>We reproduced this problem on 2 difference similarly configured systems, one with StrongSwan 4.6.1, and another with
4.4.1. The full ipsec.conf file follows.</div><div><br></div><div>Thanks</div><div>Simon</div><div><br></div><div> config setup<br> charonstart=yes<br> plutodebug=all<br> charondebug="mgr 2, ike 2, chd 2, knl 2, net 2, lib 2, cfg 2"<br> interfaces="%none"<br> nat_traversal=yes<br><br>conn ikev1<br> left=192.168.3.195<br> right=192.168.3.193<br> rekey=no<br> leftsubnet=192.168.9.0/24<br> rightsubnet=10.20.1.0/24<br> leftfirewall=yes<br>
ike=aes128-md5!<br> ikelifetime=7200s<br> keyexchange=ikev1<br> mobike=no<br> keyingtries=%forever<br> esp=aes128-md5!<br> keylife=3600s<br> rekeymargin=540s<br> type=tunnel<br> pfs=yes<br> compress=no<br> authby=secret<br> auto=add<br><br>conn ikev2<br> left=192.168.3.195<br> right=192.168.3.193<br>
rightid=@differentfromright<br> rekey=no<br> leftsubnet=192.168.9.0/24<br> rightsubnet=10.20.3.0/24<br> leftfirewall=yes<br> ike=aes128-md5-modp1536!<br> ikelifetime=7200s<br> keyexchange=ikev2<br> mobike=yes<br> keyingtries=%forever<br> esp=aes128-md5!<br> keylife=3600s<br> rekeymargin=540s<br> type=tunnel<br> pfs=yes<br>
compress=no<br> authby=secret<br> auto=add<br><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><span><br></span></div><div><br></div> <div style="font-family: arial,helvetica,sans-serif; font-size: 12pt;"> <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"><b><span style="font-weight: bold;"></span></b></font><br> </div></div> </div> </div></body></html>