Hi,<br><br>I am trying to establish ikev2 connection between peers 10.0.0.2(initiator)<===========>10.0.0.1(responder).<br><br>Generated and distributed (FQDN as identity) based certificates on both sides.
Identity comes as subjAltNmae in Certificates . <br><br>I made rightid as %any on responder side to handle any identity of initiator. <br> <br>Then I tried ping from initiator and on responder side i get below error. <br>
<br>Could you please let me know what should be the leftid/rightid and left/right values on both the ends for succesful connection. <br><br><br><b>Error Logs on responder:<br>=====================</b><br>Apr 1 16:00:00.384479 info CLA-0 charon: 03[IKE] received end entity cert "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=ATCA_ib, E=<a href="mailto:gianluigi.ongaro@nsn.com">gianluigi.ongaro@nsn.com</a>"<br>
Apr 1 16:00:00.384892 info CLA-0 charon: 03[CFG] looking for peer configs matching 10.0.0.1[10.0.0.1]...10.0.0.2[C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=ATCA_ib, E=<a href="mailto:gianluigi.ongaro@nsn.com">gianluigi.ongaro@nsn.com</a>]<br>
Apr 1 16:00:00.385188 info CLA-0 charon: 03[CFG] no matching peer config found<br><br><b><br><br> Following are the certificates and ipsec.conf file on 10.0.0.2(Initiator):<br>
=======================================================</b><br clear="all"># cat /etc/ipsec.conf <br>
# ipsec.conf<br>
# FlexiPlatform: IPsec configuration file<br>
<br>
config setup<br>
charonstart=yes<br>
plutostart=no<br>
charondebug="knl 0,enc 0,net 0"<br>
conn %default<br>
auto=route<br>
keyexchange=ikev2<br>
ca r1~v1<br>
cacert="/etc/ipsec/certs/ipsec.d//cacerts/cacert.pem"<br>
conn r1~v1<br>
rekeymargin=200<br>
rekeyfuzz=100%<br>
left=10.0.0.2<br>
right=10.0.0.1<br>
leftsubnet=<a href="http://10.0.0.0/24">10.0.0.0/24</a><br>
rightsubnet=<a href="http://10.0.0.0/24">10.0.0.0/24</a><br>
leftprotoport=1<br>
rightprotoport=1<br>
authby=rsasig<br>
leftcert="/etc/ipsec/certs/ipsec.d//certs/ib-cert.pem"<br>
leftid=10.0.0.2<br>
rightid=10.0.0.1<br>
ike=3des-md5-modp1536!<br>
esp=3des-md5<br>
type=tunnel<br>
ikelifetime=3000s<br>
keylife=2000s<br>
mobike=no<br>
auto=route<br>
encapdscp=yes<br><b><br>Certificates:<br># /usr/local/6bin/ipsec stroke listall </b><br><br>List of X.509 End Entity Certificates:<br><br> altNames: <a href="http://ib.atca.nsn.com">ib.atca.nsn.com</a><br> subject: "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=ATCA_ib, E=<a href="mailto:gianluigi.ongaro@nsn.com">gianluigi.ongaro@nsn.com</a>"<br>
issuer: "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=<a href="http://www.nokiasiemensnetworks.com">www.nokiasiemensnetworks.com</a>, E=<a href="mailto:gianluigi.ongaro@nsn.com">gianluigi.ongaro@nsn.com</a>"<br>
serial: 03<br> validity: not before Mar 31 09:14:01 2012, ok<br> not after Apr 30 09:14:01 2012, ok (expires in 28 days) <br> pubkey: RSA 1024 bits, has private key<br> keyid: 64:a5:3b:a4:42:18:b6:16:e9:47:84:7e:72:e2:0d:ff:52:0b:81:e5<br>
subjkey: 6f:50:38:73:27:e7:36:93:d8:62:d5:d0:e0:83:df:f8:aa:f1:b9:ed<br><br>List of X.509 CA Certificates:<br><br> subject: "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=<a href="http://www.nokiasiemensnetworks.com">www.nokiasiemensnetworks.com</a>, E=<a href="mailto:gianluigi.ongaro@nsn.com">gianluigi.ongaro@nsn.com</a>"<br>
issuer: "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=<a href="http://www.nokiasiemensnetworks.com">www.nokiasiemensnetworks.com</a>, E=<a href="mailto:gianluigi.ongaro@nsn.com">gianluigi.ongaro@nsn.com</a>"<br>
serial: 00:a9:d9:3d:5e:b8:7b:a3:4d<br> validity: not before Mar 31 09:14:01 2012, ok<br> not after Apr 30 09:14:01 2012, ok (expires in 28 days) <br> pubkey: RSA 1024 bits<br> keyid: b0:de:5e:b4:0d:d3:1c:4d:25:e7:cf:4c:bc:f3:31:d1:47:03:1e:d5<br>
subjkey: 29:95:a1:57:17:5e:2b:7a:e0:9d:6d:56:f6:bf:5d:c8:41:1f:44:6f<br> authkey: 29:95:a1:57:17:5e:2b:7a:e0:9d:6d:56:f6:bf:5d:c8:41:1f:44:6f<br><br><b>Following are the certificates & ipsec.conf files on 10.0.0.1(Initiator):<br>
====================================================</b><br># cat /etc/ipsec.conf <br># ipsec.conf<br># FlexiPlatform: IPsec configuration file<br><br>config setup<br> charonstart=yes<br> plutostart=no<br> charondebug="knl 0,enc 0,net 0"<br>
conn %default<br> auto=route<br> keyexchange=ikev2<br>ca r1~v1<br> cacert="/etc/ipsec/certs/ipsec.d//cacerts/cacert.pem"<br>conn r1~v1<br> rekeymargin=200<br> rekeyfuzz=100%<br> left=10.0.0.1<br>
right=10.0.0.2<br> leftsubnet=<a href="http://10.0.0.0/24">10.0.0.0/24</a><br> rightsubnet=<a href="http://10.0.0.0/24">10.0.0.0/24</a><br> leftprotoport=1<br> rightprotoport=1<br> authby=rsasig<br> leftcert="/etc/ipsec/certs/ipsec.d//certs/cla-cert.pem"<br>
leftid=10.0.0.1<br> rightid=%any<br> ike=3des-md5-modp1536!<br> esp=3des-md5<br> type=tunnel<br> ikelifetime=3000s<br> keylife=2000s<br> mobike=no<br> auto=route<br> encapdscp=yes<br><br><b>Certificates </b>:<br>
<b># /usr/local/6bin/ipsec stroke listall</b><br>List of X.509 End Entity Certificates:<br><br> altNames: <a href="http://cla.atca.nsn.com">cla.atca.nsn.com</a><br> subject: "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=ATCA_cla, E=<a href="mailto:gianluigi.ongaro@nsn.com">gianluigi.ongaro@nsn.com</a>"<br>
issuer: "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=<a href="http://www.nokiasiemensnetworks.com">www.nokiasiemensnetworks.com</a>, E=<a href="mailto:gianluigi.ongaro@nsn.com">gianluigi.ongaro@nsn.com</a>"<br>
serial: 03<br> validity: not before Mar 31 09:14:01 2012, ok<br> not after Apr 30 09:14:01 2012, ok (expires in 28 days) <br> pubkey: RSA 1024 bits, has private key<br> keyid: 82:8e:cf:f7:a0:81:9e:00:77:0b:d7:ee:6f:f7:43:8a:d2:73:e4:af<br>
subjkey: 5f:ed:01:a0:a6:18:fd:12:dd:18:e1:fe:d4:76:a2:ea:4c:8f:e2:74<br><br>List of X.509 CA Certificates:<br><br> subject: "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=<a href="http://www.nokiasiemensnetworks.com">www.nokiasiemensnetworks.com</a>, E=<a href="mailto:gianluigi.ongaro@nsn.com">gianluigi.ongaro@nsn.com</a>"<br>
issuer: "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=<a href="http://www.nokiasiemensnetworks.com">www.nokiasiemensnetworks.com</a>, E=<a href="mailto:gianluigi.ongaro@nsn.com">gianluigi.ongaro@nsn.com</a>"<br>
serial: 00:a9:d9:3d:5e:b8:7b:a3:4d<br> validity: not before Mar 31 09:14:01 2012, ok<br> not after Apr 30 09:14:01 2012, ok (expires in 28 days) <br> pubkey: RSA 1024 bits<br> keyid: b0:de:5e:b4:0d:d3:1c:4d:25:e7:cf:4c:bc:f3:31:d1:47:03:1e:d5<br>
subjkey: 29:95:a1:57:17:5e:2b:7a:e0:9d:6d:56:f6:bf:5d:c8:41:1f:44:6f<br> authkey: 29:95:a1:57:17:5e:2b:7a:e0:9d:6d:56:f6:bf:5d:c8:41:1f:44:6f<br><br><br>-- <br><div> </div>
<div>Regards,</div>
<div>Reshma</div><br>