<div>Hi All...</div><div><br></div><div> I've been banging my head against the wall for about a week now and I cant get my Motorola Droid Pro phone to connect to the StrongSwan 5.0.1.</div><div><br></div><div> This is the deal... It worked with StrongSwan v4.5.2 but as soon as I upgraded to 5.0.1 it broke. I</div>
<div><br></div><div><br></div><div>** **</div><div><br></div><div> I think it maybe failing to connect because of the following 3 lines:</div><div> -- <span style="font-family:'Courier New'">Oct 24 16:49:36 16[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding</span></div>
<div><font face="Courier New"> -- </font><span style="font-family:'Courier New'">Oct 24 16:49:36 16[CFG] received proposals: ESP:AES_GCM_16_256/NO_EXT_SEQ</span></div><span style="font-family:'Courier New'"> --Oct 24 16:49:36 16[CFG] configured proposals: ... <see below></span><div>
<font face="Courier New"><br></font></div><div><font face="Courier New"> I also tried several different settings for the "esp=" and the "ike=" options. We also changed the </font></div><div><font face="Courier New"> templates file that Authentec uses to setup new VPN connections. I have even created a template that</font></div>
<div><font face="Courier New"> matches the settings that are suggested in the charon.log file("</font><span style="font-family:'Courier New'">configured proposals:" line.) and it still fails t</span><span style="font-family:'Courier New'">o connect. </span></div>
<div><span style="font-family:'Courier New'"><br></span></div><div><span style="font-family:'Courier New'"> Is the new StrongSwan incompatible with Android Froyo phones ( Motorola Droid Pro)???</span></div>
<div><span style="font-family:'Courier New'"><br></span></div><div><font face="Courier New">** ** </font></div><div><font face="Courier New"><br></font></div><div><font face="Courier New"><br></font></div><div><font face="Courier New"><br>
</font></div><div><font face="Courier New">-------------------- ipsec.conf -------------------</font></div><div><p class="MsoPlainText"><span style="font-family:"Courier New"">config
setup<br>
# plutodebug=all<br>
# crlcheckinterval=600<br>
# strictcrlpolicy=yes<br>
# strictcrlpolicy=no<br>
# cachecrls=yes<br>
# nat_traversal=yes<br>
#
charonstart=yes<br>
#
plutostart=no<br>
<br>
</span></p><p class="MsoPlainText"><span style="font-family:"Courier New"">conn
MOTOROLA<br>
left=1.1.1.51 #outside source
ip<br>
leftsubnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a><br>
leftcert=MOTOROLA.pem <br>
right=%any<br>
rightsourceip=<a href="http://192.168.151.128/25">192.168.151.128/25</a> <br> keyexchange=ikev2<br>
auto=add<br> forceencaps=yes <br>
#
esp=aes256gcm16,aes128gcm16!<br>
# AES_GCM_16_256<br>
#
ike=aes128-sha384-modp2048,aes256-sha384-modp2048!<br> leftfirewall=no<br>
</span></p></div><div><font face="Courier New"><br></font></div><div><font face="Courier New"><br></font></div><div><font face="Courier New"><br></font></div><div><font face="Courier New"> -------------------------------------- charon.log -------------------------------------------<br>
</font><div><div><p class="MsoPlainText"><span style="font-family:"Courier New"">Oct 24 16:49:36
03[NET] received packet: from 1.1.1.58[60500] to 1.1.1.51[500]<br>
Oct 24 16:49:36 03[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP)
N(NATD_D_IP) V ]<br>
Oct 24 16:49:36 03[ENC] received unknown vendor ID:
ff:44:ff:26:68:75:0f:03:b0:8d:f6:eb:e1:d0:04:03<br>
Oct 24 16:49:36 03[IKE] 1.1.1.58 is initiating an IKE_SA<br>
Oct 24 16:49:36 03[IKE] faking NAT situation to enforce UDP encapsulation<br>
Oct 24 16:49:36 03[IKE] sending cert request for "C=US, ST=Florida,
L=TimBuck2, O=ABC123, OU=ABC, CN=crap-cacert-2048-GD"<br>
Oct 24 16:49:36 03[ENC] generating IKE_SA_INIT response 0 [ SA KE No
N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]<br>
Oct 24 16:49:36 03[NET] sending packet: from 1.1.1.51[500] to
1.1.1.58[60500]<br>
Oct 24 16:49:36 16[NET] received packet: from 1.1.1.58[64500] to
1.1.1.51[4500]<br>
Oct 24 16:49:36 16[ENC] parsed IKE_AUTH request 1 [ IDi CERT CERTREQ AUTH
CP(MASK ADDR DNS) SA TSi TSr N(HTTP_CERT_LOOK) N(INIT_CONTACT) N(SET_WINSIZE)
N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) ]<br>
Oct 24 16:49:36 16[IKE] received cert request for "C=US, ST=Florida,
L=TimBuck2, O=ABC123, OU=ABC, CN=crap-cacert-2048-GD"<br>
Oct 24 16:49:36 16[IKE] received end entity cert "C=US, ST=Florida,
L=TimBuck2, O=ABC123, OU=ABC, CN=0128-1024-MOTOROLA"<br>
Oct 24 16:49:36 16[CFG] looking for peer configs matching
1.1.1.51[%any]...1.1.1.58[C=US, ST=Florida, L=TimBuck2, O=ABC123, OU=ABC,
CN=0128-1024-MOTOROLA]<br>
Oct 24 16:49:36 16[CFG] selected peer config 'MOTOROLA'<br>
Oct 24 16:49:36 16[CFG] using
certificate "C=US, ST=Florida, L=TimBuck2, O=ABC123, OU=ABC,
CN=0128-1024-MOTOROLA"<br>
Oct 24 16:49:36 16[CFG] using trusted
ca certificate "C=US, ST=Florida, L=TimBuck2, O=ABC123, OU=ABC,
CN=crap-cacert-2048-GD"<br>
Oct 24 16:49:36 16[CFG] checking certificate status of "C=US, ST=Florida,
L=TimBuck2, O=ABC123, OU=ABC, CN=0128-1024-MOTOROLA"<br>
Oct 24 16:49:36 16[CFG] certificate status is not available<br>
Oct 24 16:49:36 16[CFG] reached
self-signed root ca with a path length of 0<br>
Oct 24 16:49:36 16[IKE] authentication of 'C=US, ST=Florida, L=TimBuck2,
O=ABC123, OU=ABC, CN=0128-1024-MOTOROLA' with RSA signature successful<br>
Oct 24 16:49:36 16[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3
TFC padding<br>
Oct 24 16:49:36 16[IKE] destroying duplicate IKE_SA for peer 'C=US, ST=Florida,
L=TimBuck2, O=ABC123, OU=ABC, CN=0128-1024-MOTOROLA', received
INITIAL_CONTACT<br>
Oct 24 16:49:36 16[CFG] lease 192.168.151.129 by 'C=US, ST=Florida, L=TimBuck2,
O=ABC123, OU=ABC, CN=0128-1024-MOTOROLA' went offline<br>
Oct 24 16:49:36 16[IKE] authentication of 'C=US, ST=Florida, L=TimBuck2, O=ABC123,
OU=ABC, CN=crap-cacert-2048-GD' (myself) with RSA signature successful<br>
Oct 24 16:49:36 16[IKE] IKE_SA MOTOROLA[15] established between 1.1.1.51[C=US,
ST=Florida, L=TimBuck2, O=ABC123, OU=ABC,
CN=crap-cacert-2048-GD]...1.1.1.58[C=US, ST=Florida, L=TimBuck2, O=ABC123,
OU=ABC, CN=0128-1024-MOTOROLA]<br>
Oct 24 16:49:36 16[IKE] scheduling reauthentication in 10160s<br>
Oct 24 16:49:36 16[IKE] maximum IKE_SA lifetime 10700s<br>
Oct 24 16:49:36 16[IKE] sending end entity cert "C=US, ST=Florida,
L=TimBuck2, O=ABC123, OU=ABC, CN=crap-cacert-2048-GD"<br>
Oct 24 16:49:36 16[IKE] peer requested virtual IP %any<br>
Oct 24 16:49:36 16[CFG] reassigning offline lease to 'C=US, ST=Florida,
L=TimBuck2, O=ABC123, OU=ABC, CN=0128-1024-MOTOROLA'<br>
Oct 24 16:49:36 16[IKE] assigning virtual IP 192.168.151.129 to peer 'C=US,
ST=Florida, L=TimBuck2, O=ABC123, OU=ABC, CN=0128-1024-MOTOROLA'<br>
Oct 24 16:49:36 16[CFG] received proposals: ESP:AES_GCM_16_256/NO_EXT_SEQ<br>
Oct 24 16:49:36 16[CFG] configured proposals:
ESP:AES_CBC_128/HMAC_SHA1_96/MODP_2048/NO_EXT_SEQ,
ESP:3DES_CBC/HMAC_SHA1_96/MODP_1536/NO_EXT_SEQ,
ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/BLOWFISH_CBC_256/HMAC_SHA1_96/AES_XCBC_96/HMAC_MD5_96/NO_EXT_SEQ<br>
Oct 24 16:49:36 16[IKE] no acceptable proposal found<br>
Oct 24 16:49:36 16[IKE] failed to establish CHILD_SA, keeping IKE_SA<br>
Oct 24 16:49:36 16[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH CP(ADDR
DNS) N(AUTH_LFT) N(NO_PROP) ]<br>
Oct 24 16:49:36 16[NET] sending packet: from 1.1.1.51[4500] to
1.1.1.58[64500]<br>
Oct 24 19:38:56 03[IKE] initiator did not reauthenticate as requested<br>
Oct 24 19:38:56 03[IKE] IKE_SA MOTOROLA[15] will timeout in 9 minutes<br>
Oct 24 19:47:56 05[IKE] deleting IKE_SA MOTOROLA[15] between 1.1.1.51[C=US,
ST=Florida, L=TimBuck2, O=ABC123, OU=ABC, CN=crap-cacert-2048-GD]...1.1.1.58[C=US,
ST=Florida, L=TimBuck2, O=ABC123, OU=ABC, CN=0128-1024-MOTOROLA]<br>
Oct 24 19:47:56 05[IKE] sending DELETE for IKE_SA MOTOROLA[15]<br>
Oct 24 19:47:56 05[ENC] generating INFORMATIONAL request 0 [ D ]<br>
Oct 24 19:47:56 05[NET] sending packet: from 1.1.1.51[4500] to
1.1.1.58[64500]<br>
Oct 24 19:48:00 15[IKE] retransmit 1 of request with message ID 0<br>
Oct 24 19:48:00 15[NET] sending packet: from 1.1.1.51[4500] to
1.1.1.58[64500]<br>
Oct 24 19:48:07 01[IKE] retransmit 2 of request with message ID 0<br>
Oct 24 19:48:07 01[NET] sending packet: from 1.1.1.51[4500] to
1.1.1.58[64500]<br>
Oct 24 19:48:20 02[IKE] retransmit 3 of request with message ID 0<br>
Oct 24 19:48:20 02[NET] sending packet: from 1.1.1.51[4500] to
1.1.1.58[64500]<br>
Oct 24 19:48:44 04[IKE] retransmit 4 of request with message ID 0<br>
Oct 24 19:48:44 04[NET] sending packet: from 1.1.1.51[4500] to
1.1.1.58[64500]<br>
Oct 24 19:49:26 03[IKE] retransmit 5 of request with message ID 0<br>
Oct 24 19:49:26 03[NET] sending packet: from 1.1.1.51[4500] to
1.1.1.58[64500]<br>
Oct 24 19:50:41 16[IKE] giving up after 5 retransmits<br>
Oct 24 19:50:41 16[IKE] proper IKE_SA delete failed, peer not responding<br>
Oct 24 19:50:41 16[CFG lease 192.168.151.129 by 'C=US, ST=Florida, L=TimBuck2,
O=ABC123, OU=ABC, CN=0128-1024-MOTOROLA' went offline<br>
</span></p></div></div></div>