<div dir="ltr">I think you should try with either one of these options:<div><br></div><div style> 1. In ipsec.secrets file, uncomment this line</div><div style> <span style="font-family:'times new roman','new york',times,serif;font-size:16px">#: RSA server_priv.pem </span></div>
<div style> The assumption here is that this private key is the one that matches with server_cert.crt used in the ipsec.conf file. And also, that this private key file is not password protected. If it is, you'd have to provide it at the end of the line in double quotes</div>
<div style><br></div><div style> 2. In the ipsec.conf file, <span style="font-family:arial,sans-serif;font-size:13px">conn rclientscerts</span></div><div style> leftcert=elcCert.pem</div><div style><br>
</div><div style> This option will ensure that the connection profile makes use of "eleCert.pem" which is proven to work for teknerds connection. No changes would be required for ipsec.secrets</div><div style>
<br></div><div style>Thanks,<br></div><div style>Bharath Kumar</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Dec 31, 2012 at 1:55 PM, Chris Arnold <span dir="ltr"><<a href="mailto:carnold@electrichendrix.com" target="_blank">carnold@electrichendrix.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="font-size:12pt;font-family:times new roman,new york,times,serif"><p>Here is the complete (with lines commented out) ipsec.secrets file:</p>
<p># ipsec.secrets<br>#<br># This file holds the RSA private keys or the PSK preshared secrets for<br># the IKE/IPsec authentication. See the ipsec.secrets(5) manual page.<br>#<br>: RSA elcKey.pem<br>#: RSA akimmo-key.pem<br>
#: RSA server_priv.pem<br>#kimmo : EAP "test"<br>#: RSA elcKey.pem ----->commented out to see if this was the issue<br>#username : XAUTH "" --->commented out to see if this was the issue</p>
<div><br></div>
<hr>
<div style="font-size:12pt;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-weight:normal"><b>From: </b>"Chris Arnold" <<a href="mailto:carnold@electrichendrix.com" target="_blank">carnold@electrichendrix.com</a>><br>
<b>To: </b><a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a><br><b>Sent: </b>Monday, December 31, 2012 4:42:00 PM<br><b>Subject: </b>Re: [strongSwan] Auth Failed<div><div class="h5">
<br>
<div><br></div>
<div style="font-size:12pt;font-family:times new roman,new york,times,serif">
<div><span style="FONT-FAMILY:arial,sans-serif;FONT-SIZE:13px">>Chris,</span></div>
<div style="font-size:12pt;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-weight:normal">
<div dir="ltr">
<div style="FONT-FAMILY:arial,sans-serif;FONT-SIZE:13px"><br></div>
<div style="FONT-FAMILY:arial,sans-serif;FONT-SIZE:13px">>Assuming elcKey.pem is the private key associated with the certificate elcCert.pem (used for conn teknerds), shouldn't there be another private key associated with server_cert.crt used in conn rclientscerts? Just >wondering since you are using separate (left) certificates for the connections...</div>
<div style="FONT-FAMILY:arial,sans-serif;FONT-SIZE:13px"><br>Nothing has been changed in the ipsec.secret file except ios secret commented out. This worked for months without any issues. Kimmo, a user here on the list, configured it and tested it and it was working. The last thing that was done was SLES strongSwan update from 4.3 to 4.4. The other conn, teknerds, works fine.</div>
<div style="FONT-FAMILY:arial,sans-serif;FONT-SIZE:13px"> </div>
<div style="FONT-FAMILY:arial,sans-serif;FONT-SIZE:13px">>The ipsec.secrets should be more like</div>
<div style="FONT-FAMILY:arial,sans-serif;FONT-SIZE:13px">> : RSA eleKey.pem</div>
<div style="FONT-FAMILY:arial,sans-serif;FONT-SIZE:13px">> : RSA server_Key.pem <"my-passphrase"></div>
<div style="FONT-FAMILY:arial,sans-serif;FONT-SIZE:13px">><br></div>
<div style="FONT-FAMILY:arial,sans-serif;FONT-SIZE:13px">>Where the passphrase is needed only if the private key is password protected.</div>
<div style="FONT-FAMILY:arial,sans-serif;FONT-SIZE:13px"><br> </div>
<div class="gmail_extra">
<div><br></div>
<div class="gmail_quote">
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">
<div>
<div>
<div class="gmail_extra">
<div class="gmail_quote">On Mon, Dec 31, 2012 at 10:55 AM, Chris Arnold <span dir="ltr"><<a href="mailto:carnold@electrichendrix.com" target="_blank">carnold@electrichendrix.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">strongSwan 4.4.06 on SLES 11 SP2. This use to work, i am working on adding users with ios to strongSwan but have commented that out of ipsec.conf and ipsec.secret to verify this is not the problem. User with Windows 7 with client cert connects and receives:<br>
Error 13801: IKE Authentication Credentials are unacceptable<br>
<div><br></div>All other VPN connections work (like the conn teknerds which is strongSwan to sonicwall).<br>
<div><br></div>Error in the charon.log:<br>13[IKE] received end entity cert "O=Chris VPN service, CN=Client2"<br>13[CFG] looking for peer configs matching 192.168.1.18[%any]...public.ip[O=Chris VPN service, CN=Client2]<br>
13[CFG] selected peer config 'rclientscerts'<br>13[CFG] using certificate "O=Chris VPN service, CN=Client2"<br>13[CFG] using trusted ca certificate "C=US, ST=NC, L=Durham, O=Edens Land Corp, OU=ELC, CN=Jarrod, E=email@address"<br>
13[CFG] checking certificate status of "O=Chris VPN service, CN=Client2"<br>13[CFG] certificate status is not available<br>13[CFG] reached self-signed root ca with a path length of 0<br>13[IKE] authentication of 'O=Chris VPN service, CN=Client2' with RSA signature successful<br>
13[IKE] peer supports MOBIKE<br>13[IKE] no private key found for 'O=Chris VPN service, CN=70.63.136.95'<br>13[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>
<div><br></div>Here is ipsec.conf:<br>config setup<br> # plutodebug=all<br> crlcheckinterval=600<br> strictcrlpolicy=no<br> # cachecrls=yes<br> nat_traversal=yes<br> # charonstart=no<br>
plutostart=no<br> #charondebug="cfg 3,lib=3"<br>
<div><br></div># Add connections here.<br>
<div><br></div>conn %default<br> ikelifetime=28800s<br> keylife=20m<br> rekeymargin=3m<br> keyingtries=1<br> keyexchange=ikev2<br> mobike=no<br>
<div><br></div>conn rclientseap<br> rekey=no<br> left=%any<br> leftauth=pubkey<br> leftcert=server_cert.crt<br> leftid=@public.ip<br> leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br>
right=%any<br> rightsourceip=<a href="http://192.168.2.0/24" target="_blank">192.168.2.0/24</a><br> rightauth=eap-mschapv2<br> rightsendcert=never<br> eap_identity=%any<br> mobike=yes<br>
auto=ignore<br>
<div><br></div>conn rclientscerts<br> rekey=no<br> left=%any<br> leftauth=pubkey<br> leftcert=server_cert.crt<br> leftid=@public.ip<br> leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br>
right=%any<br> rightsourceip=<a href="http://192.168.2.0/24" target="_blank">192.168.2.0/24</a><br> #rightauth=eap-mschapv2<br> #rightsendcert=never<br> #eap_identity=%any<br> mobike=yes<br>
auto=add<br>
<div><br></div><br>
<div><br></div><br>conn teknerds<br> left=%defaultroute<br> leftcert=elcCert.pem<br> leftsubnet=<a href="http://192.168.1.0/24" target="_blank">192.168.1.0/24</a><br> #leftid="C=XX, O=X, CN=Edens Land Corp VPN"<br>
#leftfirewall=yes<br> right=sonicwall.public.ip<br> rightsubnet=<a href="http://192.168.123.0/24" target="_blank">192.168.123.0/24</a><br> rightcert=teknerdsCert.pem<br> rightid="C=XX, O=X, CN=Tek-Nerds VPN"<br>
auto=add<br>
<div><br></div><br>#conn iOS<br># keyexchange=ikev1<br># authby=xauthrsasig<br># xauth=server<br># left=%defaultroute<br># leftsubnet=<a href="http://192.168.1.0/24" target="_blank">192.168.1.0/24</a><br>
# leftcert=elcCert.pem<br># right=%any<br># rightsourceip=<a href="http://192.168.3.0/24" target="_blank">192.168.3.0/24</a><br># #rightcert=<br># pfs=no<br># auto=add<br>
<div><br></div>Here is ipsec.secret:<br>: RSA elcKey.pem<br>
<div><br></div>Any help with this is greatly appreciated<br>
<div><br></div>_______________________________________________<br>Users mailing list<br><a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a><br><a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
</blockquote></div><br></div></div></div></blockquote></div><br></div></div><br>_______________________________________________<br>Users mailing list<br><a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a></div>
<div><br></div></div><br>_______________________________________________<br>Users mailing list<br><a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a><br><a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a></div>
</div></div><br></div></div><br>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br></blockquote></div><br></div>