<div dir="ltr"><span style="font-family:arial,sans-serif;font-size:13px">Chris,</span><div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px">Assuming elcKey.pem is the private key associated with the certificate elcCert.pem (used for conn teknerds), shouldn't there be another private key associated with server_cert.crt used in conn rclientscerts? Just wondering since you are using separate (left) certificates for the connections...</div>
<div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px">The ipsec.secrets should be more like</div><div style="font-family:arial,sans-serif;font-size:13px">
: RSA eleKey.pem</div><div style="font-family:arial,sans-serif;font-size:13px"> : RSA server_Key.pem <"my-passphrase"></div><div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px">
Where the passphrase is needed only if the private key is password protected.</div><div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px">Thanks,</div><div style="font-family:arial,sans-serif;font-size:13px">
Bharath Kumar</div><div class="gmail_extra"><br><br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5"><div class="gmail_extra">
<div class="gmail_quote">On Mon, Dec 31, 2012 at 10:55 AM, Chris Arnold <span dir="ltr"><<a href="mailto:carnold@electrichendrix.com" target="_blank">carnold@electrichendrix.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">strongSwan 4.4.06 on SLES 11 SP2. This use to work, i am working on adding users with ios to strongSwan but have commented that out of ipsec.conf and ipsec.secret to verify this is not the problem. User with Windows 7 with client cert connects and receives:<br>
Error 13801: IKE Authentication Credentials are unacceptable<br>
<br>
All other VPN connections work (like the conn teknerds which is strongSwan to sonicwall).<br>
<br>
Error in the charon.log:<br>
13[IKE] received end entity cert "O=Chris VPN service, CN=Client2"<br>
13[CFG] looking for peer configs matching 192.168.1.18[%any]...public.ip[O=Chris VPN service, CN=Client2]<br>
13[CFG] selected peer config 'rclientscerts'<br>
13[CFG] using certificate "O=Chris VPN service, CN=Client2"<br>
13[CFG] using trusted ca certificate "C=US, ST=NC, L=Durham, O=Edens Land Corp, OU=ELC, CN=Jarrod, E=email@address"<br>
13[CFG] checking certificate status of "O=Chris VPN service, CN=Client2"<br>
13[CFG] certificate status is not available<br>
13[CFG] reached self-signed root ca with a path length of 0<br>
13[IKE] authentication of 'O=Chris VPN service, CN=Client2' with RSA signature successful<br>
13[IKE] peer supports MOBIKE<br>
13[IKE] no private key found for 'O=Chris VPN service, CN=70.63.136.95'<br>
13[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>
<br>
Here is ipsec.conf:<br>
config setup<br>
# plutodebug=all<br>
crlcheckinterval=600<br>
strictcrlpolicy=no<br>
# cachecrls=yes<br>
nat_traversal=yes<br>
# charonstart=no<br>
plutostart=no<br>
#charondebug="cfg 3,lib=3"<br>
<br>
# Add connections here.<br>
<br>
conn %default<br>
ikelifetime=28800s<br>
keylife=20m<br>
rekeymargin=3m<br>
keyingtries=1<br>
keyexchange=ikev2<br>
mobike=no<br>
<br>
conn rclientseap<br>
rekey=no<br>
left=%any<br>
leftauth=pubkey<br>
leftcert=server_cert.crt<br>
leftid=@public.ip<br>
leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br>
right=%any<br>
rightsourceip=<a href="http://192.168.2.0/24" target="_blank">192.168.2.0/24</a><br>
rightauth=eap-mschapv2<br>
rightsendcert=never<br>
eap_identity=%any<br>
mobike=yes<br>
auto=ignore<br>
<br>
conn rclientscerts<br>
rekey=no<br>
left=%any<br>
leftauth=pubkey<br>
leftcert=server_cert.crt<br>
leftid=@public.ip<br>
leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br>
right=%any<br>
rightsourceip=<a href="http://192.168.2.0/24" target="_blank">192.168.2.0/24</a><br>
#rightauth=eap-mschapv2<br>
#rightsendcert=never<br>
#eap_identity=%any<br>
mobike=yes<br>
auto=add<br>
<br>
<br>
<br>
<br>
conn teknerds<br>
left=%defaultroute<br>
leftcert=elcCert.pem<br>
leftsubnet=<a href="http://192.168.1.0/24" target="_blank">192.168.1.0/24</a><br>
#leftid="C=XX, O=X, CN=Edens Land Corp VPN"<br>
#leftfirewall=yes<br>
right=sonicwall.public.ip<br>
rightsubnet=<a href="http://192.168.123.0/24" target="_blank">192.168.123.0/24</a><br>
rightcert=teknerdsCert.pem<br>
rightid="C=XX, O=X, CN=Tek-Nerds VPN"<br>
auto=add<br>
<br>
<br>
#conn iOS<br>
# keyexchange=ikev1<br>
# authby=xauthrsasig<br>
# xauth=server<br>
# left=%defaultroute<br>
# leftsubnet=<a href="http://192.168.1.0/24" target="_blank">192.168.1.0/24</a><br>
# leftcert=elcCert.pem<br>
# right=%any<br>
# rightsourceip=<a href="http://192.168.3.0/24" target="_blank">192.168.3.0/24</a><br>
# #rightcert=<br>
# pfs=no<br>
# auto=add<br>
<br>
Here is ipsec.secret:<br>
: RSA elcKey.pem<br>
<br>
Any help with this is greatly appreciated<br>
<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div></div>