<div><br></div>configured rc1 with:<div><br></div><div><div>./configure --sysconfdir=/etc --prefix=/usr --libexecdir=/usr/lib --enable-openssl --enable-nm --enable-agent --enable-gcrypt --enable-eap-gtc --enable-eap-md5 --enable-eap-mschapv2 --enable-eap-aka --enable-eap-aka-3gpp2 --enable-eap-identity </div>
<div><br></div><div>and am getting the following message:</div><div><br></div><div><div>00[LIB] feature PRIVKEY:DSA in 'pem' plugin has unsatisfied dependency: PRIVKEY:DSA</div><div>00[LIB] feature PUBKEY:DSA in 'pem' plugin has unsatisfied dependency: PUBKEY:DSA</div>
<div>00[LIB] feature CERT_DECODE:X509_OCSP_REQUEST in 'pem' plugin has unsatisfied dependency: CERT_DECODE:X509_OCSP_REQUEST</div></div><div><br></div><div>Cant work out which options I am missing?</div><div><br></div>
<div>Cheers</div><div>Craig</div><div><br></div><div><br></div><br><div class="gmail_quote">On Wed, Jun 20, 2012 at 8:23 PM, Craig Day <span dir="ltr"><<a href="mailto:craigday@gmail.com" target="_blank">craigday@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Thanks Andreas. rc1, here I come!!<br>
<br>
Sent from my iPhone<br>
<br>
On 20/06/2012, at 7:54 PM, Andreas Steffen<br>
<div class="HOEnZb"><div class="h5"><<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a>> wrote:<br>
<br>
> Hi Craig,<br>
><br>
> the OSX client sends an IKEv1 message but the strongSwan 4.6.4 charon<br>
> daemon expects an IKEv2 negotiation and therefore ignores all<br>
> IKEv1 messages.<br>
><br>
> Workarounds:<br>
><br>
> - Define keyexchange=ikev1 in ipsec.conf and start the pluto<br>
> IKEv1 daemon by setting plutostart=yes in the config setup<br>
> section of ipsec.conf.<br>
><br>
> or<br>
><br>
> - Download strongswan-5.0.0rc1 which has a combined IKEv1/IKEv2<br>
> charon daemon. You can omit the keyexchange parameter altogether<br>
> so that the charon daemon will be able to handle both IKEv1<br>
> and IKEv2 connections.<br>
><br>
> <a href="http://www.strongswan.org/uml/testresults5rc/ike/rw-cert/moon.statusall" target="_blank">http://www.strongswan.org/uml/testresults5rc/ike/rw-cert/moon.statusall</a><br>
><br>
> Best regards<br>
><br>
> Andreas<br>
><br>
> On 06/20/2012 12:11 PM, Craig Day wrote:<br>
>> Hi Users,<br>
>><br>
>> I am trying to setup a VPN between OSX (client) and Linux (server). I<br>
>> have generated and successfully installed all the required keys and<br>
>> certificates i.e. a CA cert, and a cert for both the client and the<br>
>> server (signed with the CA cert). Wrapped up the client and CA cert into<br>
>> pkcs12 and successfully installed and trusted them on the OSX client<br>
>> side. I am using the built in OSX VPN client, configured to use the<br>
>> client cert for user auth and machine auth. All looks good. On the<br>
>> server side:<br>
>><br>
>> root@lwlserver:~/strongswan-4.6.4# ipsec --version<br>
>> Linux strongSwan U4.6.4/K2.6.35-32-server<br>
>><br>
>> ipsec.conf:<br>
>><br>
>> config setup<br>
>> crlcheckinterval=180<br>
>> strictcrlpolicy=no<br>
>><br>
>> ca livewireca<br>
>> cacert=LivewireCACert.pem<br>
>> auto=add<br>
>><br>
>> conn %default<br>
>> ikelifetime=60m<br>
>> keylife=20m<br>
>> rekeymargin=3m<br>
>> keyingtries=1<br>
>><br>
>> conn rw<br>
>> left=203.161.119.62<br>
>> leftcert=VPNServerCert.pem<br>
>> leftid="C=AU, ST=Western Australia, O=Livewire Labs Pty Ltd,<br>
>> CN=Livewire Labs VPNServer"<br>
>> leftsubnet=<a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a> <<a href="http://192.168.20.0/24" target="_blank">http://192.168.20.0/24</a>><br>
>> rightid="C=AU, ST=Western Australia, O=Livewire Labs Pty Ltd,<br>
>> CN=Livewire Labs VPNClient"<br>
>> auto=add<br>
>><br>
>> ipsec.secrets:<br>
>><br>
>> # /etc/ipsec.secrets - strongSwan IPsec secrets file<br>
>><br>
>> : RSA VPNServerKey.pem "its a secret"<br>
>><br>
>> Running ipsec statusall before connect attempt give me:<br>
>><br>
>> root@lwlserver:~/strongswan-4.6.4# ipsec statusall<br>
>> Status of IKEv2 charon daemon (strongSwan 4.6.4):<br>
>> uptime: 7 seconds, since Jun 20 17:35:27 2012<br>
>> malloc: sbrk 405504, mmap 0, used 285632, free 119872<br>
>> worker threads: 8 of 16 idle, 7/1/0/0 working, job queue: 0/0/0/0,<br>
>> scheduled: 0<br>
>> loaded plugins: aes des sha1 sha2 md5 random x509 revocation<br>
>> constraints pubkey pkcs1 pkcs8 pgp pem openssl gcrypt fips-prf gmp agent<br>
>> xcbc cmac hmac attr kernel-netlink resolve socket-default stroke updown<br>
>> eap-identity eap-aka eap-aka-3gpp2 eap-md5 eap-gtc eap-mschapv2<br>
>> Listening IP addresses:<br>
>> 192.168.20.2<br>
>> Connections:<br>
>> rw: 203.161.119.62...%any<br>
>> rw: local: [C=AU, ST=Western Australia, O=Livewire Labs Pty<br>
>> Ltd, CN=Livewire Labs VPNServer] uses public key authentication<br>
>> rw: cert: "C=AU, ST=Western Australia, O=Livewire Labs Pty<br>
>> Ltd, CN=Livewire Labs VPNServer"<br>
>> rw: remote: [C=AU, ST=Western Australia, O=Livewire Labs Pty<br>
>> Ltd, CN=Livewire Labs VPNClient] uses any authentication<br>
>> rw: child: <a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a> <<a href="http://192.168.20.0/24" target="_blank">http://192.168.20.0/24</a>> ===<br>
>> dynamic TUNNEL<br>
>> Security Associations (0 up, 0 connecting):<br>
>> none<br>
>><br>
>> Heres the log of the startup and subsequent failed connection attempt:<br>
>><br>
>> root@lwlserver:/etc/ipsec.d/private# grep -v ASN /var/log/charon.log<br>
>> 00[DMN] Starting IKEv2 charon daemon (strongSwan 4.6.4)<br>
>> 00[LIB] plugin 'aes': loaded successfully<br>
>> 00[LIB] plugin 'des': loaded successfully<br>
>> 00[LIB] plugin 'sha1': loaded successfully<br>
>> 00[LIB] plugin 'sha2': loaded successfully<br>
>> 00[LIB] plugin 'md5': loaded successfully<br>
>> 00[LIB] plugin 'random': loaded successfully<br>
>> 00[LIB] plugin 'x509': loaded successfully<br>
>> 00[LIB] plugin 'revocation': loaded successfully<br>
>> 00[LIB] plugin 'constraints': loaded successfully<br>
>> 00[LIB] plugin 'pubkey': loaded successfully<br>
>> 00[LIB] plugin 'pkcs1': loaded successfully<br>
>> 00[LIB] plugin 'pkcs8': loaded successfully<br>
>> 00[LIB] plugin 'pgp': loaded successfully<br>
>> 00[LIB] plugin 'pem': loaded successfully<br>
>> 00[LIB] plugin 'openssl': loaded successfully<br>
>> 00[LIB] plugin 'gcrypt': loaded successfully<br>
>> 00[LIB] plugin 'fips-prf': loaded successfully<br>
>> 00[LIB] plugin 'gmp': loaded successfully<br>
>> 00[LIB] plugin 'agent': loaded successfully<br>
>> 00[LIB] plugin 'xcbc': loaded successfully<br>
>> 00[LIB] plugin 'cmac': loaded successfully<br>
>> 00[LIB] plugin 'hmac': loaded successfully<br>
>> 00[LIB] plugin 'attr': loaded successfully<br>
>> 00[LIB] plugin 'kernel-netlink': loaded successfully<br>
>> 00[KNL] listening on interfaces:<br>
>> 00[KNL] eth0<br>
>> 00[KNL] 192.168.20.2<br>
>> 00[KNL] fe80::21e:58ff:fe49:5037<br>
>> 00[LIB] plugin 'resolve': loaded successfully<br>
>> 00[LIB] plugin 'socket-default': loaded successfully<br>
>> 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'<br>
>> 00[CFG] loaded ca certificate "C=AU, ST=Western Australia, L=Perth,<br>
>> O=Livewire Labs Pty Ltd, CN=Livewire Labs CA" from<br>
>> '/etc/ipsec.d/cacerts/LivewireCACert.pem'<br>
>> 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'<br>
>> 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'<br>
>> 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'<br>
>> 00[CFG] loading crls from '/etc/ipsec.d/crls'<br>
>> 00[CFG] loading secrets from '/etc/ipsec.secrets'<br>
>> 00[CFG] loaded RSA private key from<br>
>> '/etc/ipsec.d/private/VPNServerKey.pem'<br>
>> 00[LIB] plugin 'stroke': loaded successfully<br>
>> 00[LIB] plugin 'updown': loaded successfully<br>
>> 00[LIB] plugin 'eap-identity': loaded successfully<br>
>> 00[LIB] plugin 'eap-aka': loaded successfully<br>
>> 00[LIB] plugin 'eap-aka-3gpp2': loaded successfully<br>
>> 00[LIB] plugin 'eap-md5': loaded successfully<br>
>> 00[LIB] plugin 'eap-gtc': loaded successfully<br>
>> 00[LIB] plugin 'eap-mschapv2': loaded successfully<br>
>> 00[CFG] DBUS binding failed<br>
>> 00[LIB] plugin 'nm': failed to load - nm_plugin_create returned NULL<br>
>> 00[DMN] loaded plugins: aes des sha1 sha2 md5 random x509 revocation<br>
>> constraints pubkey pkcs1 pkcs8 pgp pem openssl gcrypt fips-prf gmp agent<br>
>> xcbc cmac hmac attr kernel-netlink resolve socket-default stroke updown<br>
>> eap-identity eap-aka eap-aka-3gpp2 eap-md5 eap-gtc eap-mschapv2<br>
>> 00[JOB] spawning 16 worker threads<br>
>> 01[LIB] created thread 01 [11370]<br>
>> 01[JOB] started worker thread 01<br>
>> 02[LIB] created thread 02 [11371]<br>
>> 02[JOB] started worker thread 02<br>
>> 04[LIB] created thread 04 [11373]<br>
>> 03[LIB] created thread 03 [11372]<br>
>> 03[JOB] started worker thread 03<br>
>> 06[LIB] created thread 06 [11375]<br>
>> 06[JOB] started worker thread 06<br>
>> 08[LIB] created thread 08 [11377]<br>
>> 08[JOB] started worker thread 08<br>
>> 05[LIB] created thread 05 [11374]<br>
>> 13[LIB] created thread 13 [11382]<br>
>> 10[LIB] created thread 10 [11379]<br>
>> 15[LIB] created thread 15 [11384]<br>
>> 15[JOB] started worker thread 15<br>
>> 01[JOB] no events, waiting<br>
>> 11[LIB] created thread 11 [11380]<br>
>> 11[JOB] started worker thread 11<br>
>> 12[LIB] created thread 12 [11381]<br>
>> 12[JOB] started worker thread 12<br>
>> 11[NET] waiting for data on sockets<br>
>> 09[LIB] created thread 09 [11378]<br>
>> 09[JOB] started worker thread 09<br>
>> 14[LIB] created thread 14 [11383]<br>
>> 14[JOB] started worker thread 14<br>
>> 10[JOB] started worker thread 10<br>
>> 07[LIB] created thread 07 [11376]<br>
>> 07[JOB] started worker thread 07<br>
>> 13[JOB] started worker thread 13<br>
>> 04[JOB] started worker thread 04<br>
>> 05[JOB] started worker thread 05<br>
>> 16[LIB] created thread 16 [11385]<br>
>> 16[JOB] started worker thread 16<br>
>> 12[CFG] stroke message => 614 bytes @ 0x7f8eb7892a80<br>
>> ... (removed for brevity)<br>
>> 12[CFG] received stroke: add ca 'livewireca'<br>
>> 12[CFG] ca livewireca<br>
>> 12[CFG] cacert=LivewireCACert.pem<br>
>> 12[CFG] crluri=(null)<br>
>> 12[CFG] crluri2=(null)<br>
>> 12[CFG] ocspuri=(null)<br>
>> 12[CFG] ocspuri2=(null)<br>
>> 12[CFG] certuribase=(null)<br>
>> 12[CFG] added ca 'livewireca'<br>
>> 10[CFG] stroke message => 863 bytes @ 0x7f8eb8894990<br>
>> ... (removed for brevity)<br>
>> 10[CFG] received stroke: add connection 'rw'<br>
>> 10[CFG] conn rw<br>
>> 10[CFG] left=203.161.119.62<br>
>> 10[CFG] leftsubnet=<a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a> <<a href="http://192.168.20.0/24" target="_blank">http://192.168.20.0/24</a>><br>
>> 10[CFG] leftsourceip=(null)<br>
>> 10[CFG] leftauth=(null)<br>
>> 10[CFG] leftauth2=(null)<br>
>> 10[CFG] leftid=C=AU, ST=Western Australia, O=Livewire Labs Pty Ltd,<br>
>> CN=Livewire Labs VPNServer<br>
>> 10[CFG] leftid2=(null)<br>
>> 10[CFG] leftrsakey=(null)<br>
>> 10[CFG] leftcert=VPNServerCert.pem<br>
>> 10[CFG] leftcert2=(null)<br>
>> 10[CFG] leftca=(null)<br>
>> 10[CFG] leftca2=(null)<br>
>> 10[CFG] leftgroups=(null)<br>
>> 10[CFG] leftupdown=(null)<br>
>> 10[CFG] right=%any<br>
>> 10[CFG] rightsubnet=(null)<br>
>> 10[CFG] rightsourceip=(null)<br>
>> 10[CFG] rightauth=(null)<br>
>> 10[CFG] rightauth2=(null)<br>
>> 10[CFG] rightid=C=AU, ST=Western Australia, O=Livewire Labs Pty Ltd,<br>
>> CN=Livewire Labs VPNClient<br>
>> 10[CFG] rightid2=(null)<br>
>> 10[CFG] rightrsakey=(null)<br>
>> 10[CFG] rightcert=(null)<br>
>> 10[CFG] rightcert2=(null)<br>
>> 10[CFG] rightca=(null)<br>
>> 10[CFG] rightca2=(null)<br>
>> 10[CFG] rightgroups=(null)<br>
>> 10[CFG] rightupdown=(null)<br>
>> 10[CFG] eap_identity=(null)<br>
>> 10[CFG] aaa_identity=(null)<br>
>> 10[CFG] ike=aes128-sha1-modp2048,3des-sha1-modp1536<br>
>> 10[CFG] esp=aes128-sha1,3des-sha1<br>
>> 10[CFG] dpddelay=30<br>
>> 10[CFG] dpdaction=0<br>
>> 10[CFG] closeaction=0<br>
>> 10[CFG] mediation=no<br>
>> 10[CFG] mediated_by=(null)<br>
>> 10[CFG] me_peerid=(null)<br>
>> 10[KNL] getting interface name for %any<br>
>> 10[KNL] %any is not a local address<br>
>> 10[KNL] getting interface name for 203.161.119.62<br>
>> 10[KNL] 203.161.119.62 is not a local address<br>
>> 10[CFG] left nor right host is our side, assuming left=local<br>
>> 10[CFG] loaded certificate "C=AU, ST=Western Australia, O=Livewire<br>
>> Labs Pty Ltd, CN=Livewire Labs VPNServer" from 'VPNServerCert.pem'<br>
>> 10[CFG] added configuration 'rw'<br>
>> 07[CFG] stroke message => 584 bytes @ 0x7f8eba097aa0<br>
>> ... (removed for brevity)<br>
>> 07[CFG] proposing traffic selectors for us:<br>
>> 07[CFG] <a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a> <<a href="http://192.168.20.0/24" target="_blank">http://192.168.20.0/24</a>> (derived from<br>
>> <a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a> <<a href="http://192.168.20.0/24" target="_blank">http://192.168.20.0/24</a>>)<br>
>> 07[CFG] proposing traffic selectors for other:<br>
>> 07[CFG] dynamic (derived from dynamic)<br>
>> 11[NET] received packet => 476 bytes @ 0x7f8eb8091370<br>
>> 11[NET] 0: 22 6E D8 2A 38 A2 4A C2 00 00 00 00 00 00 00 00<br>
>> "n.*8.J.........<br>
>> 11[NET] 16: 01 10 02 00 00 00 00 00 00 00 01 DC 0D 00 00 E4<br>
>> ................<br>
>> 11[NET] 32: 00 00 00 01 00 00 00 01 00 00 00 D8 01 01 00 06<br>
>> ................<br>
>> 11[NET] 48: 03 00 00 24 01 01 00 00 80 0B 00 01 80 0C 0E 10<br>
>> ...$............<br>
>> 11[NET] 64: 80 01 00 07 80 0E 01 00 80 03 00 03 80 02 00 02<br>
>> ................<br>
>> 11[NET] 80: 80 04 00 02 03 00 00 24 02 01 00 00 80 0B 00 01<br>
>> .......$........<br>
>> 11[NET] 96: 80 0C 0E 10 80 01 00 07 80 0E 01 00 80 03 00 03<br>
>> ................<br>
>> 11[NET] 112: 80 02 00 01 80 04 00 02 03 00 00 24 03 01 00 00<br>
>> ...........$....<br>
>> 11[NET] 128: 80 0B 00 01 80 0C 0E 10 80 01 00 07 80 0E 00 80<br>
>> ................<br>
>> 11[NET] 144: 80 03 00 03 80 02 00 02 80 04 00 02 03 00 00 24<br>
>> ...............$<br>
>> 11[NET] 160: 04 01 00 00 80 0B 00 01 80 0C 0E 10 80 01 00 07<br>
>> ................<br>
>> 11[NET] 176: 80 0E 00 80 80 03 00 03 80 02 00 01 80 04 00 02<br>
>> ................<br>
>> 11[NET] 192: 03 00 00 20 05 01 00 00 80 0B 00 01 80 0C 0E 10 ...<br>
>> ............<br>
>> 11[NET] 208: 80 01 00 05 80 03 00 03 80 02 00 02 80 04 00 02<br>
>> ................<br>
>> 11[NET] 224: 00 00 00 20 06 01 00 00 80 0B 00 01 80 0C 0E 10 ...<br>
>> ............<br>
>> 11[NET] 240: 80 01 00 05 80 03 00 03 80 02 00 01 80 04 00 02<br>
>> ................<br>
>> 11[NET] 256: 0D 00 00 14 4A 13 1C 81 07 03 58 45 5C 57 28 F2<br>
>> ....J.....XE\W(.<br>
>> 11[NET] 272: 0E 95 45 2F 0D 00 00 14 4D F3 79 28 E9 FC 4F D1<br>
>> ..E/....M.y(..O.<br>
>> 11[NET] 288: B3 26 21 70 D5 15 C6 62 0D 00 00 14 8F 8D 83 82<br>
>> .&!p...b........<br>
>> 11[NET] 304: 6D 24 6B 6F C7 A8 A6 A4 28 C1 1D E8 0D 00 00 14<br>
>> m$ko....(.......<br>
>> 11[NET] 320: 43 9B 59 F8 BA 67 6C 4C 77 37 AE 22 EA B8 F5 82<br>
>> C.Y..glLw7."....<br>
>> 11[NET] 336: 0D 00 00 14 4D 1E 0E 13 6D EA FA 34 C4 F3 EA 9F<br>
>> ....M...m..4....<br>
>> 11[NET] 352: 02 EC 72 85 0D 00 00 14 80 D0 BB 3D EF 54 56 5E<br>
>> ..r........=.TV^<br>
>> 11[NET] 368: E8 46 45 D4 C8 5C E3 EE 0D 00 00 14 99 09 B6 4E<br>
>> .FE..\.........N<br>
>> 11[NET] 384: ED 93 7C 65 73 DE 52 AC E9 52 FA 6B 0D 00 00 14<br>
>> ..|es.R..R.k....<br>
>> 11[NET] 400: 7D 94 19 A6 53 10 CA 6F 2C 17 9D 92 15 52 9D 56<br>
>> }...S..o,....R.V<br>
>> 11[NET] 416: 0D 00 00 14 CD 60 46 43 35 DF 21 F8 7C FD B2 FC<br>
>> .....`FC5.!.|...<br>
>> 11[NET] 432: 68 B6 A4 48 0D 00 00 14 90 CB 80 91 3E BB 69 6E<br>
>> h..H........>.in<br>
>> 11[NET] 448: 08 63 81 B5 EC 42 7B 1F 00 00 00 14 AF CA D7 13<br>
>> .c...B{.........<br>
>> 11[NET] 464: 68 A1 F1 C9 6B 86 96 FC 77 57 01 00 h...k...wW..<br>
>> 11[NET] received packet: from 192.168.20.3[500] to 192.168.20.2[500]<br>
>> 11[ENC] parsing header of message<br>
>> 11[ENC] parsing HEADER payload, 476 bytes left<br>
>> 11[ENC] parsing payload from => 476 bytes @ 0x7f8eb0000d20<br>
>> 11[ENC] 0: 22 6E D8 2A 38 A2 4A C2 00 00 00 00 00 00 00 00<br>
>> "n.*8.J.........<br>
>> 11[ENC] 16: 01 10 02 00 00 00 00 00 00 00 01 DC 0D 00 00 E4<br>
>> ................<br>
>> 11[ENC] 32: 00 00 00 01 00 00 00 01 00 00 00 D8 01 01 00 06<br>
>> ................<br>
>> 11[ENC] 48: 03 00 00 24 01 01 00 00 80 0B 00 01 80 0C 0E 10<br>
>> ...$............<br>
>> 11[ENC] 64: 80 01 00 07 80 0E 01 00 80 03 00 03 80 02 00 02<br>
>> ................<br>
>> 11[ENC] 80: 80 04 00 02 03 00 00 24 02 01 00 00 80 0B 00 01<br>
>> .......$........<br>
>> 11[ENC] 96: 80 0C 0E 10 80 01 00 07 80 0E 01 00 80 03 00 03<br>
>> ................<br>
>> 11[ENC] 112: 80 02 00 01 80 04 00 02 03 00 00 24 03 01 00 00<br>
>> ...........$....<br>
>> 11[ENC] 128: 80 0B 00 01 80 0C 0E 10 80 01 00 07 80 0E 00 80<br>
>> ................<br>
>> 11[ENC] 144: 80 03 00 03 80 02 00 02 80 04 00 02 03 00 00 24<br>
>> ...............$<br>
>> 11[ENC] 160: 04 01 00 00 80 0B 00 01 80 0C 0E 10 80 01 00 07<br>
>> ................<br>
>> 11[ENC] 176: 80 0E 00 80 80 03 00 03 80 02 00 01 80 04 00 02<br>
>> ................<br>
>> 11[ENC] 192: 03 00 00 20 05 01 00 00 80 0B 00 01 80 0C 0E 10 ...<br>
>> ............<br>
>> 11[ENC] 208: 80 01 00 05 80 03 00 03 80 02 00 02 80 04 00 02<br>
>> ................<br>
>> 11[ENC] 224: 00 00 00 20 06 01 00 00 80 0B 00 01 80 0C 0E 10 ...<br>
>> ............<br>
>> 11[ENC] 240: 80 01 00 05 80 03 00 03 80 02 00 01 80 04 00 02<br>
>> ................<br>
>> 11[ENC] 256: 0D 00 00 14 4A 13 1C 81 07 03 58 45 5C 57 28 F2<br>
>> ....J.....XE\W(.<br>
>> 11[ENC] 272: 0E 95 45 2F 0D 00 00 14 4D F3 79 28 E9 FC 4F D1<br>
>> ..E/....M.y(..O.<br>
>> 11[ENC] 288: B3 26 21 70 D5 15 C6 62 0D 00 00 14 8F 8D 83 82<br>
>> .&!p...b........<br>
>> 11[ENC] 304: 6D 24 6B 6F C7 A8 A6 A4 28 C1 1D E8 0D 00 00 14<br>
>> m$ko....(.......<br>
>> 11[ENC] 320: 43 9B 59 F8 BA 67 6C 4C 77 37 AE 22 EA B8 F5 82<br>
>> C.Y..glLw7."....<br>
>> 11[ENC] 336: 0D 00 00 14 4D 1E 0E 13 6D EA FA 34 C4 F3 EA 9F<br>
>> ....M...m..4....<br>
>> 11[ENC] 352: 02 EC 72 85 0D 00 00 14 80 D0 BB 3D EF 54 56 5E<br>
>> ..r........=.TV^<br>
>> 11[ENC] 368: E8 46 45 D4 C8 5C E3 EE 0D 00 00 14 99 09 B6 4E<br>
>> .FE..\.........N<br>
>> 11[ENC] 384: ED 93 7C 65 73 DE 52 AC E9 52 FA 6B 0D 00 00 14<br>
>> ..|es.R..R.k....<br>
>> 11[ENC] 400: 7D 94 19 A6 53 10 CA 6F 2C 17 9D 92 15 52 9D 56<br>
>> }...S..o,....R.V<br>
>> 11[ENC] 416: 0D 00 00 14 CD 60 46 43 35 DF 21 F8 7C FD B2 FC<br>
>> .....`FC5.!.|...<br>
>> 11[ENC] 432: 68 B6 A4 48 0D 00 00 14 90 CB 80 91 3E BB 69 6E<br>
>> h..H........>.in<br>
>> 11[ENC] 448: 08 63 81 B5 EC 42 7B 1F 00 00 00 14 AF CA D7 13<br>
>> .c...B{.........<br>
>> 11[ENC] 464: 68 A1 F1 C9 6B 86 96 FC 77 57 01 00 h...k...wW..<br>
>> 11[ENC] parsing rule 0 IKE_SPI<br>
>> 11[ENC] => => 8 bytes @ 0x7f8eb0001280<br>
>> 11[ENC] 0: 22 6E D8 2A 38 A2 4A C2 "n.*8.J.<br>
>> 11[ENC] parsing rule 1 IKE_SPI<br>
>> 11[ENC] => => 8 bytes @ 0x7f8eb0001288<br>
>> 11[ENC] 0: 00 00 00 00 00 00 00 00 ........<br>
>> 11[ENC] parsing rule 2 U_INT_8<br>
>> 11[ENC] => 1<br>
>> 11[ENC] parsing rule 3 U_INT_4<br>
>> 11[ENC] => 1<br>
>> 11[ENC] parsing rule 4 U_INT_4<br>
>> 11[ENC] => 0<br>
>> 11[ENC] parsing rule 5 U_INT_8<br>
>> 11[ENC] => 2<br>
>> 11[ENC] parsing rule 6 RESERVED_BIT<br>
>> 11[ENC] => 0<br>
>> 11[ENC] parsing rule 7 RESERVED_BIT<br>
>> 11[ENC] => 0<br>
>> 11[ENC] parsing rule 8 FLAG<br>
>> 11[ENC] => 0<br>
>> 11[ENC] parsing rule 9 FLAG<br>
>> 11[ENC] => 0<br>
>> 11[ENC] parsing rule 10 FLAG<br>
>> 11[ENC] => 0<br>
>> 11[ENC] parsing rule 11 RESERVED_BIT<br>
>> 11[ENC] => 0<br>
>> 11[ENC] parsing rule 12 RESERVED_BIT<br>
>> 11[ENC] => 0<br>
>> 11[ENC] parsing rule 13 RESERVED_BIT<br>
>> 11[ENC] => 0<br>
>> 11[ENC] parsing rule 14 U_INT_32<br>
>> 11[ENC] => 0<br>
>> 11[ENC] parsing rule 15 HEADER_LENGTH<br>
>> 11[ENC] => 476<br>
>> 11[ENC] parsing HEADER payload finished<br>
>> 11[ENC] header verification failed<br>
>> 11[NET] received invalid IKE header from 192.168.20.3 - ignored<br>
>> 11[NET] waiting for data on sockets<br>
>> 11[NET] received packet => 476 bytes @ 0x7f8eb8091370<br>
>> 11[NET] 0: 22 6E D8 2A 38 A2 4A C2 00 00 00 00 00 00 00 00<br>
>> "n.*8.J.........<br>
>><br>
>> This last chunk of entries is repeated 3 times as the OSX client retries.<br>
>><br>
>> The OSX log matches the behaviour:<br>
>><br>
>> 20/06/12 5:49:33.357 PM configd: SCNC: start, triggered by System<br>
>> Preferen, type L2TP, status 0<br>
>> 20/06/12 5:49:33.399 PM pppd: pppd 2.4.2 (Apple version 560.13) started<br>
>> by craig, uid 501<br>
>> 20/06/12 5:49:33.413 PM pppd: L2TP connecting to server '192.168.20.2'<br>
>> (192.168.20.2)...<br>
>> 20/06/12 5:49:33.415 PM pppd: IPSec connection started<br>
>> 20/06/12 5:49:33.493 PM racoon: Connecting.<br>
>> 20/06/12 5:49:33.493 PM racoon: IPSec Phase1 started (Initiated by me).<br>
>> 20/06/12 5:49:33.494 PM racoon: IKE Packet: transmit success.<br>
>> (Initiator, Main-Mode message 1).<br>
>> 20/06/12 5:49:36.497 PM racoon: IKE Packet: transmit success. (Phase1<br>
>> Retransmit).<br>
>> 20/06/12 5:49:39.500 PM racoon: IKE Packet: transmit success. (Phase1<br>
>> Retransmit).<br>
>> 20/06/12 5:49:42.503 PM racoon: IKE Packet: transmit success. (Phase1<br>
>> Retransmit).<br>
>> 20/06/12 5:49:43.494 PM pppd: IPSec connection failed<br>
>><br>
>> Can anyone help with my problem? FWIW I would be happy to write up the<br>
>> process I went through for the wiki if I can just get over this final<br>
>> hump. I can't believe I am the only one out there trying to get OSX<br>
>> talking to Strongswan (maybe I am the only one failing though :) )<br>
>><br>
>> Cheers<br>
>> Craig<br>
>><br>
>> p.s. I tried the built in Vpn client on a Windows 7 box and it appeared<br>
>> to get a lot further, though I didn't bother setting up the auth/certs<br>
>> correctly. It definitely managed to send headers and subsequent messages<br>
>> that Strongswan was able to parse.<br>
>><br>
>><br>
>><br>
>><br>
>> _______________________________________________<br>
>> Users mailing list<br>
>> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
>> <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
><br>
><br>
> --<br>
> ======================================================================<br>
> Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
> strongSwan - the Linux VPN Solution! <a href="http://www.strongswan.org" target="_blank">www.strongswan.org</a><br>
> Institute for Internet Technologies and Applications<br>
> University of Applied Sciences Rapperswil<br>
> CH-8640 Rapperswil (Switzerland)<br>
> ===========================================================[ITA-HSR]==<br>
</div></div></blockquote></div><br></div>