<p>Lars,</p>
<p>When I got this error previously, it was because I didn't have a matching leftid / rightid in my ipsec.conf files. this should be the subject or altsubjectname from your cert.</p>
<p>I'm not seeing the leftid or rightid in your configs. If you add them, that might fix it.</p>
<p>Justin</p>
<div class="gmail_quote">On Mar 13, 2013 10:26 AM, "Larsen" <<a href="mailto:larsen007@web.de">larsen007@web.de</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<br>
I am still trying to establish a VPN connection between my Windows XP box<br>
using the ShrewSoft client and our IPFire server running Strongswan 5.0.2,<br>
but now I get the error "no peer config found" in the server log:<br>
<br>
<br>
charon: 16[NET] received packet: from 192.168.120.24[500] to #external<br>
IP#[500] (365 bytes)<br>
charon: 16[IKE] ignoring certificate request without data<br>
charon: 16[IKE] sending cert request for "C=DE, ST=city, L=city,<br>
O=mycompany, OU=IPFire, CN=mycompanyCA, E=<a href="mailto:noone@example.com">noone@example.com</a>"<br>
charon: 16[NET] sending packet: from #external IP#[500] to<br>
192.168.120.24[500] (549 bytes)<br>
charon: 12[NET] sending packet: from #external IP#[500] to<br>
192.168.120.24[500]<br>
charon: 16[MGR] checkin IKE_SA (unnamed)[5]<br>
charon: 16[MGR] check-in of IKE_SA successful.<br>
charon: 06[NET] received packet: from 192.168.120.24[500] to #external<br>
IP#[500]<br>
charon: 06[NET] waiting for data on sockets<br>
charon: 08[MGR] checkout IKE_SA by message<br>
charon: 08[MGR] IKE_SA (unnamed)[5] successfully checked out<br>
charon: 08[NET] received packet: from 192.168.120.24[500] to #external<br>
IP#[500] (1292 bytes)<br>
charon: 08[IKE] received end entity cert "C=DE, ST=city, O=mycompany,<br>
OU=IPFire, CN=JonDoe"<br>
charon: 08[CFG] looking for RSA signature peer configs matching #external<br>
IP#...192.168.120.24<br>
charon: 08[IKE] no peer config found<br>
charon: 08[NET] sending packet: from #external IP#[500] to<br>
192.168.120.24[500] (92 bytes)<br>
charon: 08[MGR] checkin and destroy IKE_SA (unnamed)[5]<br>
charon: 08[MGR] check-in and destroy of IKE_SA successful<br>
<br>
<br>
I already did a search, but couldn´t find the right answers to my problem.<br>
As far as I understand this error, it seems to me that the certificate is<br>
missing on the server, but I have created it there via IPFire. That client<br>
cert was then imported into the local computer store according to<br>
<a href="http://wiki.strongswan.org/projects/strongswan/wiki/Win7Certs" target="_blank">http://wiki.strongswan.org/projects/strongswan/wiki/Win7Certs</a> .<br>
<br>
I get the same error message trying this with TheGreenBow client or an<br>
iPhone. My computer is on the same subnet it shall connect to via VPN, but<br>
I guess that shouldn´t be a problem for now. Also, the iPhone is not using<br>
the LAN, but still has the same problem.<br>
<br>
<br>
# cat /etc/ipsec.conf<br>
version 2<br>
<br>
config setup<br>
charondebug="dmn 2, mgr 2, ike 1, chd 2, job 2, cfg 1, knl 2, net<br>
2, asn 1, enc 0, lib 1, esp 2, tls 2, tnc 2, imc 2, imv 2, pts 2"<br>
<br>
conn %default<br>
keyingtries=%forever<br>
<br>
include /etc/ipsec.user.conf<br>
<br>
conn JonDoe<br>
left=#external IP#<br>
leftsubnet=<a href="http://192.168.120.0/24" target="_blank">192.168.120.0/24</a><br>
leftfirewall=yes<br>
lefthostaccess=yes<br>
right=%any<br>
rightsubnet=vhost:%no,%priv<br>
leftcert=/var/ipfire/certs/hostcert.pem<br>
rightcert=/var/ipfire/certs/JonDoecert.pem<br>
ike=aes256-sha2_256-modp8192,aes256-sha2_256-modp6144,aes256-sha2_256-modp4096,aes256-sha2_256-modp3072,aes256-sha2_256-modp2048,aes256-sha2_256-modp1536,aes256-sha2_256-modp1024,aes256-sha-modp8192,aes256-sha-modp6144,aes256-sha-modp4096,aes256-sha-modp3072,aes256-sha-modp2048,aes256-sha-modp1536,aes256-sha-modp1024,aes256-md5-modp8192,aes256-md5-modp6144,aes256-md5-modp4096,aes256-md5-modp3072,aes256-md5-modp2048,aes256-md5-modp1536,aes256-md5-modp1024,aes192-sha2_256-modp8192,aes192-sha2_256-modp6144,aes192-sha2_256-modp4096,aes192-sha2_256-modp3072,aes192-sha2_256-modp2048,aes192-sha2_256-modp1536,aes192-sha2_256-modp1024,aes192-sha-modp8192,aes192-sha-modp6144,aes192-sha-modp4096,aes192-sha-modp3072,aes192-sha-modp2048,aes192-sha-modp1536,aes192-sha-modp1024,aes192-md5-modp8192,aes192-md5-modp6144,aes192-md5-modp4096,aes192-md5-modp3072,aes192-md5-modp2048,aes192-md5-modp1536,aes192-md5-modp1024,aes128-sha2_256-modp8192,aes128-sha2_256-modp6144,aes128-sha2_256-modp4096,a<br>
es128-sha2_256-modp3072,aes128-sha2_256-modp2048,aes128-sha2_256-modp1536,aes128-sha2_256-modp1024,aes128-sha-modp8192,aes128-sha-modp6144,aes128-sha-modp4096,aes128-sha-modp3072,aes128-sha-modp2048,aes128-sha-modp1536,aes128-sha-modp1024,aes128-md5-modp8192,aes128-md5-modp6144,aes128-md5-modp4096,aes128-md5-modp3072,aes128-md5-modp2048,aes128-md5-modp1536,aes128-md5-modp1024,3des-sha2_256-modp8192,3des-sha2_256-modp6144,3des-sha2_256-modp4096,3des-sha2_256-modp3072,3des-sha2_256-modp2048,3des-sha2_256-modp1536,3des-sha2_256-modp1024,3des-sha-modp8192,3des-sha-modp6144,3des-sha-modp4096,3des-sha-modp3072,3des-sha-modp2048,3des-sha-modp1536,3des-sha-modp1024,3des-md5-modp8192,3des-md5-modp6144,3des-md5-modp4096,3des-md5-modp3072,3des-md5-modp2048,3des-md5-modp1536,3des-md5-modp1024<br>
esp=aes256-sha2_256-modp8192,aes256-sha2_256-modp6144,aes256-sha2_256-modp4096,aes256-sha2_256-modp3072,aes256-sha2_256-modp2048,aes256-sha2_256-modp1536,aes256-sha2_256-modp1024,aes256-sha1-modp8192,aes256-sha1-modp6144,aes256-sha1-modp4096,aes256-sha1-modp3072,aes256-sha1-modp2048,aes256-sha1-modp1536,aes256-sha1-modp1024,aes256-md5-modp8192,aes256-md5-modp6144,aes256-md5-modp4096,aes256-md5-modp3072,aes256-md5-modp2048,aes256-md5-modp1536,aes256-md5-modp1024,aes192-sha2_256-modp8192,aes192-sha2_256-modp6144,aes192-sha2_256-modp4096,aes192-sha2_256-modp3072,aes192-sha2_256-modp2048,aes192-sha2_256-modp1536,aes192-sha2_256-modp1024,aes192-sha1-modp8192,aes192-sha1-modp6144,aes192-sha1-modp4096,aes192-sha1-modp3072,aes192-sha1-modp2048,aes192-sha1-modp1536,aes192-sha1-modp1024,aes192-md5-modp8192,aes192-md5-modp6144,aes192-md5-modp4096,aes192-md5-modp3072,aes192-md5-modp2048,aes192-md5-modp1536,aes192-md5-modp1024,aes128-sha2_256-modp8192,aes128-sha2_256-modp6144,aes128-sha2_<br>
256-modp4096,aes128-sha2_256-modp3072,aes128-sha2_256-modp2048,aes128-sha2_256-modp1536,aes128-sha2_256-modp1024,aes128-sha1-modp8192,aes128-sha1-modp6144,aes128-sha1-modp4096,aes128-sha1-modp3072,aes128-sha1-modp2048,aes128-sha1-modp1536,aes128-sha1-modp1024,aes128-md5-modp8192,aes128-md5-modp6144,aes128-md5-modp4096,aes128-md5-modp3072,aes128-md5-modp2048,aes128-md5-modp1536,aes128-md5-modp1024,3des-sha2_256-modp8192,3des-sha2_256-modp6144,3des-sha2_256-modp4096,3des-sha2_256-modp3072,3des-sha2_256-modp2048,3des-sha2_256-modp1536,3des-sha2_256-modp1024,3des-sha1-modp8192,3des-sha1-modp6144,3des-sha1-modp4096,3des-sha1-modp3072,3des-sha1-modp2048,3des-sha1-modp1536,3des-sha1-modp1024,3des-md5-modp8192,3des-md5-modp6144,3des-md5-modp4096,3des-md5-modp3072,3des-md5-modp2048,3des-md5-modp1536,3des-md5-modp1024<br>
keyexchange=ikev1<br>
ikelifetime=1h<br>
keylife=8h<br>
compress=yes<br>
dpddelay=30<br>
dpdtimeout=120<br>
dpdaction=clear<br>
authby=rsasig<br>
leftrsasigkey=%cert<br>
rightrsasigkey=%cert<br>
auto=add<br>
rightsourceip=<br>
<br>
<br>
# ll /var/ipfire/certs/hostcert.pem<br>
-rw-r--r-- 1 nobody nobody 1639 2013-02-25 16:19<br>
/var/ipfire/certs/hostcert.pem<br>
<br>
~# ll /var/ipfire/certs/JonDoecert.pem<br>
-rw-r--r-- 1 nobody nobody 1533 2013-02-25 16:20<br>
/var/ipfire/certs/JonDoecert.pem<br>
<br>
<br>
What is the cause of this error message?<br>
<br>
<br>
Lars<br>
<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a></blockquote></div>