<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">Hello,</p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; min-height: 16.0px"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">I'm a newb to strongSwan so please be gentle if I miss something obvious!</p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; min-height: 16.0px"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">I followed the instruction on the Wiki :</p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; color: #0100ee"><span style="text-decoration: underline"><a href="http://wiki.strongswan.org/projects/strongswan/wiki/IOS_(Apple)">http://wiki.strongswan.org/projects/strongswan/wiki/IOS_(Apple)</a></span></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; min-height: 16.0px"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">Except with version 5 not 4 (don't know if that will be relevant)</p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; min-height: 16.0px"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">I couldn't get it working with an iOS device so went back to having a Linux box at either end so I can get some decent log file entries. So, please bear in mind that although it says "iPhone" in the key names etc, it is actually strongSwan at both ends now. So hopefully anything weird and iOS specific is not relevant /yet/.</p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">(All public IP addresses here have been obfuscated, so don't bother trying to connect to me!)</p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; min-height: 16.0px"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">First, server config :</p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">conn ios</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> keyexchange=ikev1</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> authby=xauthrsasig</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> xauth=server</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> left=%defaultroute</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> leftsubnet=10.66.0.0/16</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> leftfirewall=yes</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> leftcert=serverCert.pem</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> leftid="C=GB, O=Company, CN=176.34.100.100"</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> right=%any</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> rightsubnet=10.0.0.0/24</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> rightsourceip=10.100.255.0/28</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> rightcert=clientCert.pem</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> auto=add</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; min-height: 16.0px"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">Then client config :</p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">conn us-east-1-vpc</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> left=%any</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> leftsourceip=%config</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> leftid=iphone</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> leftcert=clientCert.pem</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> leftfirewall=yes</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> rightid="C=GB, O=Company, CN=176.34.100.100"</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> right=176.34.100.100</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> rightsubnet=10.66.0.0/16</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> authby=xauthrsasig</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> xauth=client</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> xauth_identity=iphone</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> keyexchange=ikev1</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> auto=start</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; min-height: 16.0px"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; min-height: 16.0px"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">The relevant passwords/keys are in the secrets files and the client and CA certs are installed at both ends. Server cert on the server etc...</p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; min-height: 16.0px"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; min-height: 16.0px"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">The tunnel establishes but not completely, I can't pass any traffic. The IPSec part seems to not be working. The same results come from using an iPhone to connect or using another strongSwan.</p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">Log file on the client (after the initial cert exchange and Xauth) :</p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 07[IKE] XAuth authentication of 'iphone' (myself) successful</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 07[IKE] IKE_SA us-east-1-vpc[1] established between 192.168.1.101[C=GB, O=Company, CN=Maxs iPhone]...176.34.100.100[C=GB, O=Company, CN=176.34.100.100]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 07[IKE] scheduling reauthentication in 10120s</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 07[IKE] maximum IKE_SA lifetime 10660s</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 07[ENC] generating TRANSACTION response 2626266634 [ HASH CP ]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 07[NET] sending packet: from 192.168.1.101[4500] to 176.34.100.100[4500]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 07[ENC] generating TRANSACTION request 3715724063 [ HASH CP ]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 07[NET] sending packet: from 192.168.1.101[4500] to 176.34.100.100[4500]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 05[NET] received packet: from 176.34.100.100[4500] to 192.168.1.101[4500]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 05[ENC] parsed TRANSACTION response 3715724063 [ HASH CP ]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 05[IKE] installing new virtual IP 10.100.255.1</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 05[ENC] generating QUICK_MODE request 2376593287 [ HASH SA No KE ID ID ]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 05[NET] sending packet: from 192.168.1.101[4500] to 176.34.100.100[4500]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 04[NET] received packet: from 176.34.100.100[4500] to 192.168.1.101[4500]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 04[ENC] parsed INFORMATIONAL_V1 request 918202651 [ HASH N(INVAL_ID) ]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:35:59 centos1 charon: 04[IKE] received INVALID_ID_INFORMATION error notify</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:36:23 centos1 charon: 07[IKE] sending keep alive</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 10:36:23 centos1 charon: 07[NET] sending packet: from 192.168.1.101[4500] to 176.34.100.100[4500]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; min-height: 16.0px"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; min-height: 16.0px"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; min-height: 16.0px"><br></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">Logfile from the server :</p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 14[IKE] XAuth authentication of 'iphone' successful</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 14[ENC] generating TRANSACTION request 2626266634 [ HASH CP ]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 14[NET] sending packet: from 10.66.254.21[4500] to 87.194.200.200[4500]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 04[NET] received packet: from 87.194.200.200[4500] to 10.66.254.21[4500]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 04[ENC] parsed TRANSACTION response 2626266634 [ HASH CP ]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 04[IKE] IKE_SA ios[5] established between 10.66.254.21[C=GB, O=Company, CN=176.34.100.100]...87.194.200.200[C=GB, O=Company, CN=Maxs iPhone]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 04[IKE] scheduling reauthentication in 10252s</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 04[IKE] maximum IKE_SA lifetime 10792s</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 03[NET] received packet: from 87.194.200.200[4500] to 10.66.254.21[4500]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 03[ENC] parsed TRANSACTION request 3715724063 [ HASH CP ]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 03[IKE] peer requested virtual IP %any</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 03[CFG] reassigning offline lease to 'iphone'</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 03[IKE] assigning virtual IP 10.100.255.1 to peer 'iphone'</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 03[ENC] generating TRANSACTION response 3715724063 [ HASH CP ]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 03[NET] sending packet: from 10.66.254.21[4500] to 87.194.200.200[4500]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 01[NET] received packet: from 87.194.200.200[4500] to 10.66.254.21[4500]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 01[ENC] parsed QUICK_MODE request 2376593287 [ HASH SA No KE ID ID ]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 01[IKE] no matching CHILD_SA config found</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:36:07 ip-10-66-254-21 charon: 01[ENC] generating INFORMATIONAL_V1 request 918202651 [ HASH N(INVAL_ID) ]</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma; min-height: 16.0px"><font class="Apple-style-span" face="'Courier New'"><br></font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">root@ip-10-66-254-21:/usr/local/etc# ipsec status</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Security Associations (1 up, 0 connecting):</font></p>
<p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"> ios[5]: ESTABLISHED 2 minutes ago, 10.66.254.21[C=GB, O=Company, CN=176.34.100.100]...87.194.200.200[C=GB, O=Company, CN=Maxs iPhone]</font></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"><br></font></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"><br></font></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">Connecting from the iPhone gives the similar response but a different quick_mode:</p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:51:52 ip-10-66-254-21 charon: 16[NET] received packet: from 87.194.205.228[1473] to 10.66.254.21[4500]</font></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:51:52 ip-10-66-254-21 charon: 16[ENC] parsed QUICK_MODE request 2502504197 [ HASH SA No ID ID ]</font></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'">Jul 25 09:51:52 ip-10-66-254-21 charon: 16[IKE] no matching CHILD_SA config found</font></p></font></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><font class="Apple-style-span" face="'Courier New'"><br></font></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">Can anyone offer any advice?</p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><br></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma"><br></p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">Thanks,</p><p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Tahoma">Max</p> </div></body>
</html>