<div dir="ltr"><div>Hi, </div><div><br></div><div>I am having a hard time to get an IpSec VPN working in my machine... it works fine in other OS, and I am sure I am doing something stupid here, hope some guru can give me guidance!</div>
<div><br></div><div>I am running Ubuntu 12.10, and installed strongswan (4.5.2), added the key secret in /etc/ipsec.secrets file, and setup the VPN through network manager.</div><div><br></div><div>Without tempering with the strongswan.conf file, I have this output (noted a similar output is :</div>
<div><br></div><div>--- /var/log/syslog ---</div><div><br></div><div><div>Jan 7 22:00:06 mac17 NetworkManager[1092]: <info> Starting VPN service 'strongswan'...</div><div>Jan 7 22:00:06 mac17 NetworkManager[1092]: <info> VPN service 'strongswan' started (org.freedesktop.NetworkManager.strongswan), PID 840</div>
<div>Jan 7 22:00:06 mac17 charon: 00[DMN] Starting IKEv2 charon daemon (strongSwan 4.5.2)</div><div>Jan 7 22:00:06 mac17 charon: 00[KNL] listening on interfaces:</div><div>Jan 7 22:00:06 mac17 charon: 00[KNL] eth0</div>
<div>Jan 7 22:00:06 mac17 charon: 00[KNL] wlan0</div><div>Jan 7 22:00:06 mac17 charon: 00[KNL] 192.168.1.1</div><div>Jan 7 22:00:06 mac17 charon: 00[KNL] fe80::129a:ddff:feae:e16a</div><div>Jan 7 22:00:06 mac17 charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'</div>
<div>Jan 7 22:00:06 mac17 charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'</div><div>Jan 7 22:00:06 mac17 charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'</div>
<div>Jan 7 22:00:06 mac17 charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'</div><div>Jan 7 22:00:06 mac17 charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'</div><div>Jan 7 22:00:06 mac17 charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'</div>
<div>Jan 7 22:00:06 mac17 charon: 00[CFG] loaded IKE secret for x.x.x.x %any</div><div>Jan 7 22:00:06 mac17 charon: 00[CFG] sql plugin: database URI not set</div><div>Jan 7 22:00:06 mac17 charon: 00[LIB] plugin 'sql': failed to load - sql_plugin_create returned NULL</div>
<div>Jan 7 22:00:06 mac17 charon: 00[CFG] loaded 0 RADIUS server configurations</div><div>Jan 7 22:00:06 mac17 charon: 00[LIB] plugin 'medsrv' failed to load: /usr/lib/ipsec/plugins/libstrongswan-medsrv.so: cannot open shared object file: No such file or directory</div>
<div>Jan 7 22:00:06 mac17 charon: 00[CFG] mediation client database URI not defined, skipped</div><div>Jan 7 22:00:06 mac17 charon: 00[LIB] plugin 'medcli': failed to load - medcli_plugin_create returned NULL</div>
<div>Jan 7 22:00:06 mac17 NetworkManager[1092]: <info> VPN service 'strongswan' appeared; activating connections</div><div>Jan 7 22:00:06 mac17 charon: 00[CFG] HA config misses local/remote address</div><div>
Jan 7 22:00:06 mac17 charon: 00[LIB] plugin 'ha': failed to load - ha_plugin_create returned NULL</div><div>Jan 7 22:00:06 mac17 charon: 00[DMN] loaded plugins: test-vectors curl ldap aes des sha1 sha2 md5 random x509 revocation constraints pubkey pkcs1 pgp pem openssl fips-prf gmp agent pkcs11 xcbc hmac ctr ccm gcm attr kernel-netlink resolve socket-raw farp stroke updown eap-identity eap-aka eap-md5 eap-gtc eap-mschapv2 eap-radius eap-tls eap-ttls eap-tnc nm dhcp led addrblock </div>
<div>Jan 7 22:00:06 mac17 charon: 00[JOB] spawning 16 worker threads</div><div>Jan 7 22:00:06 mac17 charon: 06[CFG] received initiate for NetworkManager connection TestVPN</div><div>Jan 7 22:00:06 mac17 NetworkManager[1092]: <info> VPN plugin state changed: starting (3)</div>
<div>Jan 7 22:00:06 mac17 charon: 06[CFG] using CA certificate, gateway identity x.x.x.x'</div><div>Jan 7 22:00:06 mac17 charon: 06[IKE] initiating IKE_SA TestVPN[1] to x.x.x.x</div><div>Jan 7 22:00:06 mac17 charon: 06[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</div>
<div>Jan 7 22:00:06 mac17 charon: 06[NET] sending packet: from 192.168.1.1[500] to x.x.x.x[500]</div><div>Jan 7 22:00:06 mac17 NetworkManager[1092]: <info> VPN connection 'TestVPN' (Connect) reply received.</div>
<div>Jan 7 22:00:10 mac17 charon: 11[IKE] retransmit 1 of request with message ID 0</div><div>Jan 7 22:00:10 mac17 charon: 11[NET] sending packet: from 192.168.1.1[500] to x.x.x.x[500]</div><div>Jan 7 22:00:17 mac17 charon: 12[IKE] retransmit 2 of request with message ID 0</div>
<div>Jan 7 22:00:17 mac17 charon: 12[NET] sending packet: from 192.168.1.1[500] to x.x.x.x[500]</div><div>Jan 7 22:00:30 mac17 wpa_supplicant[1361]: wlan0: WPA: Group rekeying completed with 00:24:a5:ea:a5:a2 [GTK=CCMP]</div>
<div>Jan 7 22:00:30 mac17 charon: 13[IKE] retransmit 3 of request with message ID 0</div><div>Jan 7 22:00:30 mac17 charon: 13[NET] sending packet: from 192.168.1.1[500] to x.x.x.x[500]</div><div>Jan 7 22:00:46 mac17 NetworkManager[1092]: <warn> VPN connection 'TestVPN' (IP Config Get) timeout exceeded.</div>
<div>Jan 7 22:00:46 mac17 NetworkManager[1092]: <info> Policy set 'Braga' (wlan0) as default for IPv4 routing and DNS.</div><div>Jan 7 22:00:46 mac17 charon: 01[IKE] destroying IKE_SA in state CONNECTING without notification</div>
<div>Jan 7 22:00:51 mac17 charon: 00[DMN] signal of type SIGTERM received. Shutting down</div><div>Jan 7 22:00:51 mac17 NetworkManager[1092]: <info> VPN service 'strongswan' disappeared</div></div><div><br>
</div><div>My initial configuration file was:</div><div><br></div><div><div>--- /etc/strongswan.conf ---</div><div><br></div><div><div># strongswan.conf - strongSwan configuration file</div><div>charon {<br>
</div><div><span style="white-space:pre-wrap"> </span>threads = 16<br></div><div><span style="white-space:pre-wrap"> </span>plugins {<br></div><div><span style="white-space:pre-wrap"> </span>sql {<br></div><div>
<span style="white-space:pre-wrap"> </span>loglevel = -1<br></div><div><span style="white-space:pre-wrap"> </span>}<br></div><div><span style="white-space:pre-wrap"> </span>}</div><div>}<br></div><div><br></div>
<div>pluto {</div><div>}<br></div><div>libstrongswan {<br></div><div>}<br></div></div><div><div><br></div><div>----------------</div></div><div><br></div><div>And here is the Network Manager configuration:</div><div>
<br></div><div><div>--- /etc/NetworkManager/system-connections/TestVPN ---</div><div><br></div><div>[connection]</div><div>id=TestVPN</div><div>uuid=07ac4ce3-c6c3-4d42-8bb6-29e56a8751db</div><div>type=vpn</div><div>
autoconnect=false</div><div><br></div><div>[vpn]</div><div>service-type=org.freedesktop.NetworkManager.strongswan</div><div>virtual=no</div><div>encap=no</div><div>address=x.x.x.x</div><div>user=??????</div><div>method=eap</div>
<div>ipcomp=yes</div><div>password-flags=1</div><div><br></div><div>[ipv4]</div><div>method=auto</div><div>----------------</div></div><div><br></div><div>Besides the timeout issue, I noted the plugin loading issues in the charon logs. Looking at what I got in the system by default:</div>
<div><br></div><div><div>$ ls /usr/lib/ipsec/plugins/</div><div>libstrongswan-addrblock.so libstrongswan-eap-tls.so libstrongswan-pkcs11.so</div><div>libstrongswan-aes.so libstrongswan-eap-tnc.so libstrongswan-pkcs1.so</div>
<div>libstrongswan-agent.so libstrongswan-eap-ttls.so libstrongswan-pubkey.so</div><div>libstrongswan-attr.so libstrongswan-farp.so libstrongswan-random.so</div><div>libstrongswan-attr-sql.so libstrongswan-fips-prf.so libstrongswan-resolve.so</div>
<div>libstrongswan-ccm.so libstrongswan-gcm.so libstrongswan-revocation.so</div><div>libstrongswan-constraints.so libstrongswan-gmp.so libstrongswan-sha1.so</div><div>libstrongswan-ctr.so libstrongswan-ha.so libstrongswan-sha2.so</div>
<div>libstrongswan-curl.so libstrongswan-hmac.so libstrongswan-socket-raw.so</div><div>libstrongswan-des.so libstrongswan-kernel-netlink.so libstrongswan-sql.so</div><div>libstrongswan-dhcp.so libstrongswan-ldap.so libstrongswan-stroke.so</div>
<div>libstrongswan-dnskey.so libstrongswan-led.so libstrongswan-test-vectors.so</div><div>libstrongswan-eap-aka.so libstrongswan-md5.so libstrongswan-updown.so</div><div>libstrongswan-eap-gtc.so libstrongswan-medcli.so libstrongswan-x509.so</div>
<div>libstrongswan-eap-identity.so libstrongswan-nm.so libstrongswan-xauth.so</div><div>libstrongswan-eap-md5.so libstrongswan-openssl.so libstrongswan-xcbc.so</div><div>libstrongswan-eap-mschapv2.so libstrongswan-pem.so</div>
<div>libstrongswan-eap-radius.so libstrongswan-pgp.so</div><div><br></div></div><div style>By adding the load into the strongswan.conf file at least clears the warnings, but I am not sure on if these modules should be here, and loaded... </div>
<div><br></div></div><div style>Any help really appreciated!</div><div style><br></div><div style>Thanks,</div><div><br></div><div><br><span style="font-family:'courier new',monospace">--</span><br style="font-family:'courier new',monospace">
<b style="font-family:'courier new',monospace">Braga, Bruno</b><br style="font-family:'courier new',monospace">
<a style="font-family:'courier new',monospace" href="http://www.brunobraga.net" target="_blank">www.brunobraga.net</a><br style="font-family:'courier new',monospace"><a style="font-family:'courier new',monospace" href="mailto:bruno.braga@gmail.com" target="_blank">bruno.braga@gmail.com</a></div>
</div>