<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>
<br> Hi Andreas,<BR> <BR>Thanks for your quick reply. Actually, I tested the same config without NAT, it works well.<BR> <BR>I dump some info on my linux [B].<BR>I am not sure if it is caused by the "00[NET] enabling UDP decapsulation for IPv4 on port 4500 failed" <BR>message while starting charon. (for quick reproduce, I use psk auth)<BR> <BR>ip xfrm policy<br>src 192.168.56.3/32 dst 192.168.56.0/24 <br> dir fwd priority 1827 ptype main <br> tmpl src 172.16.118.119 dst 172.16.118.124<br> proto esp reqid 1 mode tunnel<br>src 192.168.56.3/32 dst 192.168.56.0/24 <br> dir in priority 1827 ptype main <br> tmpl src 172.16.118.119 dst 172.16.118.124<br> proto esp reqid 1 mode tunnel<br>src 192.168.56.0/24 dst 192.168.56.3/32 <br> dir out priority 1827 ptype main <br> tmpl src 172.16.118.124 dst 172.16.118.119<br> proto esp reqid 1 mode tunnel<br>[root@localhost ~]# ipsec statusall<br>Status of IKE charon daemon (strongSwan 5.0.1, Linux 3.3.4-5.fc17.i686, i686):<br> uptime: 108 seconds, since Jan 14 18:01:26 2013<br> malloc: sbrk 135168, mmap 0, used 71600, free 63568<br> worker threads: 8 of 16 idle, 7/1/0/0 working, job queue: 0/0/0/0, scheduled: 2<br> loaded plugins: charon aes des sha1 sha2 md5 x509 pem random nonce hmac stroke socket-default updown kernel-netlink kernel-pfkey openssl<br>Virtual IP pools (size/online/offline):<br> 192.168.56.2/24: 254/1/0<br>Listening IP addresses:<br> 172.16.118.124<br>Connections:<br> tun1: 172.16.118.124...%any IKEv2<br> tun1: local: [172.16.118.124] uses pre-shared key authentication<br> tun1: remote: uses pre-shared key authentication<br> tun1: child: 192.168.56.0/24 === dynamic TUNNEL<br>Security Associations (1 up, 0 connecting):<br> tun1[1]: ESTABLISHED 78 seconds ago, 172.16.118.124[172.16.118.124]...172.16.118.119[192.168.0.2]<br> tun1[1]: IKEv2 SPIs: 4f8da8d36fc953b3_i 3ea89b4569e84f30_r*, pre-shared key reauthentication in 23 hours<br> tun1[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048<br> tun1{1}: INSTALLED, TUNNEL, ESP in UDP SPIs: c44fa932_i cca368ae_o<br> tun1{1}: AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 23 hours<br> tun1{1}: 192.168.56.0/24 === 192.168.56.3/32 <BR> ipsec restart --nofork --debug-all<br>Stopping strongSwan IPsec failed: starter is not running<br>Starting strongSwan 5.0.1 IPsec [starter]...<br>!! Your strongswan.conf contains manual plugin load options for charon.<br>!! This is recommended for experts only, see<br>!! <a href="http://wiki.strongswan.org/projects/strongswan/wiki/PluginLoad">http://wiki.strongswan.org/projects/strongswan/wiki/PluginLoad</a><br>Loading config setup<br>Loading conn 'tun1'<br> keyexchange=ikev2<br> rekeymargin=3m<br> authby=psk<br> keyingtries=1<br> mobike=no<br> leftsourceip=192.168.56.2/24<br> right=172.16.118.124<br> rightsubnet=192.168.56.1/24<br> ikelifetime=86400s<br> keylife=86400s<br> ike=aes128-sha1_160-modp2048<br> esp=aes-sha1_160<br> auto=add<br>found netkey IPsec stack<br>Attempting to start charon...<br>00[DMN] Starting IKE charon daemon (strongSwan 5.0.1, Linux 3.3.4-5.fc17.i686, i686)<br>00[LIB] plugin 'farp' failed to load: /usr/local/lib/ipsec/plugins/libstrongswan-farp.so: cannot open shared object file: No such file or directory<br>00[NET] installing IKE bypass policy failed<br>00[NET] installing IKE bypass policy failed<br>00[NET] enabling UDP decapsulation for IPv6 on port 4500 failed<br>00[NET] installing IKE bypass policy failed<br>00[NET] installing IKE bypass policy failed<br>00[NET] enabling UDP decapsulation for IPv4 on port 4500 failed<br>00[LIB] plugin 'farp' failed to load: /usr/local/lib/ipsec/plugins/libstrongswan-farp.so: cannot open shared object file: No such file or directory<br>00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'<br>00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'<br>00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'<br>00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'<br>00[CFG] loading crls from '/etc/ipsec.d/crls'<br>00[CFG] loading secrets from '/etc/ipsec.secrets'<br>00[LIB] opening '/etc/ipsec.d/private/segw.key' failed: No such file or directory<br>00[LIB] building CRED_PRIVATE_KEY - RSA failed, tried 3 builders<br>00[CFG] loading private key from '/etc/ipsec.d/private/segw.key' failed<br>00[CFG] loaded IKE secret for 172.16.118.124 %any<br>00[DMN] loaded plugins: charon aes des sha1 sha2 md5 x509 pem random nonce hmac stroke socket-default updown kernel-netlink kernel-pfkey openssl<br>00[JOB] spawning 16 worker threads<br>charon (2148) started after 20 ms<br>12[CFG] received stroke: add connection 'tun1'<br>12[CFG] adding virtual IP address pool 192.168.56.2/24<br>12[CFG] added configuration 'tun1'<br>14[NET] received packet: from 172.16.118.119[500] to 172.16.118.124[500]<br>14[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>14[IKE] 172.16.118.119 is initiating an IKE_SA<br>14[IKE] remote host is behind NAT<br>14[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>14[NET] sending packet: from 172.16.118.124[500] to 172.16.118.119[500]<br>15[NET] received packet: from 172.16.118.119[4500] to 172.16.118.124[4500]<br>15[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr AUTH CP(ADDR) SA TSi TSr N(EAP_ONLY) ]<br>15[IKE] received 1 cert requests for an unknown ca<br>15[CFG] looking for peer configs matching 172.16.118.124[172.16.118.124]...172.16.118.119[192.168.0.2]<br>15[CFG] selected peer config 'tun1'<br>15[IKE] authentication of '192.168.0.2' with pre-shared key successful<br>15[IKE] authentication of '172.16.118.124' (myself) with pre-shared key<br>15[IKE] IKE_SA tun1[1] established between 172.16.118.124[172.16.118.124]...172.16.118.119[192.168.0.2]<br>15[IKE] scheduling reauthentication in 86111s<br>15[IKE] maximum IKE_SA lifetime 86291s<br>15[IKE] peer requested virtual IP %any<br>15[CFG] assigning new lease to '192.168.0.2'<br>15[IKE] assigning virtual IP 192.168.56.3 to peer '192.168.0.2'<br>15[IKE] CHILD_SA tun1{1} established with SPIs c44fa932_i cca368ae_o and TS 192.168.56.0/24 === 192.168.56.3/32 <br>15[ENC] generating IKE_AUTH response 1 [ IDr AUTH CP(ADDR) SA TSi TSr N(AUTH_LFT) ]<br>15[NET] sending packet: from 172.16.118.124[4500] to 172.16.118.119[4500]<br>16[NET] received packet: from 172.16.118.119[4500] to 172.16.118.124[4500]<br>16[ENC] parsed INFORMATIONAL request 2 [ ]<br>16[ENC] generating INFORMATIONAL response 2 [ ]<br>16[NET] sending packet: from 172.16.118.124[4500] to 172.16.118.119[4500]<br><BR> <BR><div><div id="SkyDrivePlaceholder"></div>> Date: Mon, 14 Jan 2013 10:17:58 +0100<br>> From: andreas.steffen@strongswan.org<br>> To: hw.tseng@hotmail.com<br>> CC: users@lists.strongswan.org<br>> Subject: Re: [strongSwan] NAT-T UDP-encap ESP received, but no decrypted packets out<br>> <br>> Hi,<br>> <br>> Your virtual IP pool range must either be distinct from<br>> the leftsubnet 192.168.56.0/24, e.g.<br>> <br>> rightsourceip=192.168.57.0/24<br>> <br>> or you can choose the virtual address pool as a subset<br>> of leftsubnet, e.g.<br>> <br>> rightsourceip=192.168.56.128/25<br>> <br>> but then you must add the farp plugin to [B] which handles<br>> the ARP requests as a proxy for the virtual host [A].<br>> <br>> Regards<br>> <br>> Andreas<br>> <br>> On 14.01.2013 08:50, hongwei tseng wrote:<br>> > I setup a scenarion [A] - - -> [NAT] - - -> [B]<br>> > [A] fedora 17, strongswan 5.0.1, is behind a NAT router (ip 192.168.0.2)<br>> > [NAT] is a linux NAT router (ip 172.16.118.119)<br>> > [B] fedora 17, strongswan 5.0.1, offer virtual ip pool<br>> > 192.168.56.2/24 (ip 172.16.118.124)<br>> ><br>> > 1. ikev2 and ipsec tunnel were established successfully<br>> > 2. ping 192.168.56.1 [B] from 192.168.56.3[A]<br>> > 3. tcpdump on [B] can sniffered UDP-encap ESP from [A] -> [B], then<br>> > disappeared ?<br>> ><br>> > Anything misconfigured or missed ?<br>> ><br>> > Thanks,<br>> > HW<br>> ><br>> > This is the config on [B]:<br>> > Loading conn 'tun1'<br>> > keyexchange=ikev2<br>> > rekeymargin=3m<br>> > authby=pubkey<br>> > keyingtries=1<br>> > mobike=no<br>> > leftsourceip=192.168.56.2/24<br>> > right=172.16.118.124<br>> > rightsubnet=192.168.56.1/24<br>> > leftid=C=te, CN=test<br>> > rightcert=segw.crt<br>> > ikelifetime=86400s<br>> > keylife=86400s<br>> > ike=aes-sha-modp2048<br>> > esp=aes-sha<br>> > auto=add<br>> ><br>> > tcpdump on [B] :<br>> > 14:30:10.930598 IP 172.16.118.119.ipsec-nat-t ><br>> > 172.16.118.124.ipsec-nat-t: UDP-encap: ESP(spi=0xc70472da,seq=0x65c),<br>> > length 132<br>> > 14:30:11.933938 IP 172.16.118.119.ipsec-nat-t ><br>> > 172.16.118.124.ipsec-nat-t: UDP-encap: ESP(spi=0xc70472da,seq=0x65d),<br>> > length 132<br>> > 14:30:12.934316 IP 172.16.118.119.ipsec-nat-t ><br>> > 172.16.118.124.ipsec-nat-t: UDP-encap: ESP(spi=0xc70472da,seq=0x65e),<br>> > length 132<br>> > 14:30:13.936215 IP 172.16.118.119.ipsec-nat-t ><br>> > 172.16.118.124.ipsec-nat-t: UDP-encap: ESP(spi=0xc70472da,seq=0x65f),<br>> > length 132<br>> <br>> ======================================================================<br>> Andreas Steffen andreas.steffen@strongswan.org<br>> strongSwan - the Linux VPN Solution! www.strongswan.org<br>> Institute for Internet Technologies and Applications<br>> University of Applied Sciences Rapperswil<br>> CH-8640 Rapperswil (Switzerland)<br>> ===========================================================[ITA-HSR]==<br>> <br></div> </div></body>
</html>