<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hi Martin,<BR> <BR>I was focusing on IKEv1 xauthrsasig due to constraints in making basic stuff work, but will definitely try to retest IKEv2 at some point next month.<BR> <BR>Thanks,<BR>Neeraj<br> <BR><div><div id="SkyDrivePlaceholder"></div>> Subject: Re: [strongSwan] Cisco ASA 5510 (8.4) Interop with StrongSwan 4.5.2 (IKEv2)<br>> From: martin@strongswan.org<br>> To: kaju09@aol.com<br>> CC: users@lists.strongswan.org<br>> Date: Wed, 5 Sep 2012 14:07:44 +0200<br>> <br>> Hi Neeraj,<br>> <br>> > The Cisco ASA is giving some strange errors and what appears to be<br>> > some sort of proprietary IKEv2 (doubtful since people have interop<br>> > with IOS and StrongSwan IKEv2).<br>> <br>> Cisco seems to use proprietary IKE fragmentation, we don't support it in<br>> strongSwan.<br>> <br>> > I did attempt to compare the cisco vpn client logs with strongswan client<br>> > logs and it appears that the cisco vpn client is detected via some custom<br>> > fields and a different path is choosen (looks like some hidden<br>> > authentication method) instead of the usual rsa (authby=rsasig) route.<br>> <br>> I'm not used to those ASA logs, ad the final log message<br>> <br>> > IKEv2-PLAT-1: Failed to set P1 auth to build policy<br>> > IKEv2-PLAT-1: unable to build ikev2 policy<br>> > IKEv2-PROTO-1: (125): Failed to locate an item in the database<br>> <br>> is not very helpful, either. I'd say it does not have a<br>> policy/configuration for the received request.<br>> <br>> When comparing the log files, there are two fundamental differences:<br>> <br>> * Anyconnect requests a virtual IP using a configuration payload<br>> exchange, your ipsec.conf does not. You may try to add<br>> "leftsourceip=%config" to request such an IP.<br>> * Anyconnect seems to use EAP to authenticate itself against the<br>> ASA, your ipsec.conf, however, uses a certificate. Try to<br>> replace "authby=rsasig" with "leftauth=eap" and<br>> "rightauth=pubkey". This of course requires an appropriate EAP<br>> module, but the strongSwan log should show you what the ASA is<br>> requesting.<br>> <br>> Having these differences may well explain why the ASA does not have a<br>> policy for the strongSwan request. <br>> <br>> Regards<br>> Martin<br>> <br></div> </div></body>
</html>