Hi Andreas,<br> Thanks for your prompt reply. I have one more clarification from your side.<br><br>Is there any command or tool in Strongswan to see encryption statistics for Netkey stack?<br>I meant, statistics like<br>No of packets encrypted using ESP<br>
No of packets dropped by tunnel and so on.<br><br>Regards,<br>Saravanan N<br><br><div class="gmail_quote">On Mon, May 28, 2012 at 8:24 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello,<br>
<br>
AH withouth ESP is not supported by strongSwan IKEv1 (which goes all<br>
the way back to FreeS/WAN).<br>
<br>
With auth=esp which is the default you opt for ESP encryption and ESP's<br>
optional authentication mode.<br>
<br>
With auth=ah you get ESP encryption withouth ESP's optional<br>
authentication mode but you get AH on top of ESP instead.<br>
<br>
If you don't want to encrypt your packets please use either<br>
ESP NULL encryption<br>
<br>
<a href="http://www.strongswan.org/uml/testresults/ikev1/esp-alg-null" target="_blank">http://www.strongswan.org/uml/testresults/ikev1/esp-alg-null</a><br>
<br>
or AES-GMAC<br>
<br>
<a href="http://www.strongswan.org/uml/testresults/ikev1/esp-alg-aes-gmac" target="_blank">http://www.strongswan.org/uml/testresults/ikev1/esp-alg-aes-gmac</a><br>
<br>
Regards<br>
<br>
Andreas<br>
<div class="im"><br>
On 28.05.2012 15:40, SaRaVanAn wrote:<br>
> Hi Team,<br>
> I hope , ah mode in strongswan is supported for Ikev1. But I tried<br>
> to form a tunnel<br>
> using AH mode with ikev1, but strongswan was expecting ESP proposal even<br>
> i configured<br>
> auth=ah. If ah mode is supported for Ikev1 , please correct me if there<br>
> any syntax error in<br>
> the below configuration file which makes thing not working.<br>
><br>
</div>> *ipsec.conf*<br>
<div><div class="h5">> ____________<br>
> # basic configuration<br>
> ca vpnca<br>
> cacert=ca1Cert.pem<br>
> #crluri=crl.pem<br>
> auto=add<br>
><br>
> config setup<br>
> plutostart=yes<br>
> plutodebug=all<br>
> charonstart=yes<br>
> charondebug=all<br>
> nat_traversal=yes<br>
> crlcheckinterval=10m<br>
> strictcrlpolicy=no<br>
><br>
> conn %default<br>
> ikelifetime=1h<br>
> keylife=2h<br>
> keyingtries=1<br>
><br>
> conn fqdn_vr<br>
> auth=ah<br>
> type=transport<br>
> keyexchange=ikev1<br>
> left=172.31.114.227<br>
> right=%any<br>
> rightid=172.31.114.211<br>
> pfs=no<br>
> rekey=no<br>
> auto=add<br>
><br>
</div></div>> *logs*<br>
<div class="im">> _____<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | ******parse ISAKMP IPsec DOI<br>
> attribute:<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | af+type: ENCAPSULATION_MODE<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | length/value: 1<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | [1 is ENCAPSULATION_MODE_TUNNEL]<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | ******parse ISAKMP IPsec DOI<br>
> attribute:<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | af+type: AUTH_ALGORITHM<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | length/value: 2<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | [2 is HMAC_SHA1]<br>
</div>> *May 28 18:48:07 uxcasxxx pluto[32284]: | policy for "fqdn_vr" requires<br>
<div class="im">> encryption but ESP not in Proposal from 172.31.114.211<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: "fqdn_vr"[1] 172.31.114.211 #2:<br>
> no acceptable Proposal in IPsec SA<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: "fqdn_vr"[1] 172.31.114.211 #2:<br>
</div>> sending encrypted notification *NO_PROPOSAL_CHOSEN to <a href="http://172.31.114.211:500" target="_blank">172.31.114.211:500</a><br>
> <<a href="http://172.31.114.211:500" target="_blank">http://172.31.114.211:500</a>><br>
<div><div class="h5">> May 28 18:48:07 uxcasxxx pluto[32284]: | **emit ISAKMP Message:<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | initiator cookie:<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | 39 e8 20 f0 36 bb c5 63<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | responder cookie:<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | 1b 60 45 9a ac b4 b9 d9<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | next payload type:<br>
> ISAKMP_NEXT_HASH<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | ISAKMP version: ISAKMP<br>
> Version 1.0<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | exchange type: ISAKMP_XCHG_INFO<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | flags: ISAKMP_FLAG_ENCRYPTION<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | message ID: 4a 6d 47 56<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | ***emit ISAKMP Hash Payload:<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | next payload type: ISAKMP_NEXT_N<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | emitting 20 zero bytes of HASH<br>
> into ISAKMP Hash Payload<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | emitting length of ISAKMP Hash<br>
> Payload: 24<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | ***emit ISAKMP Notification<br>
> Payload:<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | next payload type:<br>
> ISAKMP_NEXT_NONE<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | DOI: ISAKMP_DOI_IPSEC<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | protocol ID: 1<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | SPI size: 0<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | Notify Message Type:<br>
> NO_PROPOSAL_CHOSEN<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | emitting 0 raw bytes of spi<br>
> into ISAKMP Notification Payload<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | spi<br>
> May 28 18:48:07 uxcasxxx pluto[32284]: | emitting length of ISAKMP<br>
> Notification Payload: 12<br>
><br>
><br>
> Regards,<br>
> Saravanan N<br>
</div></div>================================================================<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
strongSwan - the Linux VPN Solution! <a href="http://www.strongswan.org" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
===========================================================[ITA-HSR]==<br>
<br>
</blockquote></div><br>