<div dir="ltr"><div><div><div><div>Hi everybody,<br></div>I have this problem: the Windows Machine connect to the debian server but the client doesn't receive the IP address, in fact in the ipsec log I have this error:<br>
"Apr 14 07:49:08 debian charon: 10[IKE] no virtual IP found for %any
requested by 'C=UK, ST=Luton, O=Beds, OU=IT, CN=ipsec, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>'"<br><br></div>How can I solve this problem?<br></div>I see an other thing, in the wireshark I don't see any communication from the server to the client. It is right or not?<br>
<br></div><div>Below the configuration files and log.<br></div><div><br></div>Thank you<br><div><div><div><div><div><br><br>-----------------------------------------------------------------------------------------------------------------------------<br>
<br></div><div>LOG FILE<br></div><div><br>Apr 14 07:49:08 debian charon: 14[NET] received packet: from 172.16.151.141[500] to 172.16.151.100[500] (3756 bytes)<br>Apr 14 07:49:08 debian charon: 14[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V V V ]<br>
Apr 14 07:49:08 debian charon: 14[IKE] received draft-ietf-ipsec-nat-t-ike-00 vendor ID<br>Apr 14 07:49:08 debian charon: 14[ENC] received unknown vendor ID: 16:f6:ca:16:e4:a4:06:6d:83:82:1a:0f:0a:ea:a8:62<br>Apr 14 07:49:08 debian charon: 14[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID<br>
Apr 14 07:49:08 debian charon: 14[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID<br>Apr 14 07:49:08 debian charon: 14[IKE] received NAT-T (RFC 3947) vendor ID<br>Apr 14 07:49:08 debian charon: 14[IKE] received FRAGMENTATION vendor ID<br>
Apr 14 07:49:08 debian charon: 14[IKE] received DPD vendor ID<br>Apr 14 07:49:08 debian charon: 14[ENC] received unknown vendor ID: f1:4b:94:b7:bf:f1:fe:f0:27:73:b8:c4:9f:ed:ed:26<br>Apr 14 07:49:08 debian charon: 14[ENC] received unknown vendor ID: 16:6f:93:2d:55:eb:64:d8:e4:df:4f:d3:7e:23:13:f0:d0:fd:84:51<br>
Apr 14 07:49:08 debian charon: 14[ENC] received unknown vendor ID: 84:04:ad:f9:cd:a0:57:60:b2:ca:29:2e:4b:ff:53:7b<br>Apr 14 07:49:08 debian charon: 14[IKE] received Cisco Unity vendor ID<br>Apr 14 07:49:08 debian charon: 14[IKE] 172.16.151.141 is initiating a Main Mode IKE_SA<br>
Apr 14 07:49:08 debian charon: 14[ENC] generating ID_PROT response 0 [ SA V V V ]<br>Apr 14 07:49:08 debian charon: 14[NET] sending packet: from 172.16.151.100[500] to 172.16.151.141[500] (140 bytes)<br>Apr 14 07:49:08 debian charon: 16[NET] received packet: from 172.16.151.141[500] to 172.16.151.100[500] (365 bytes)<br>
Apr 14 07:49:08 debian charon: 16[ENC] parsed ID_PROT request 0 [ KE No CERTREQ NAT-D NAT-D ]<br>Apr 14 07:49:08 debian charon: 16[IKE] ignoring certificate request without data<br>Apr 14 07:49:08 debian charon: 16[IKE] sending cert request for "C=UK, ST=Luton, L=Luton, O=Beds, OU=IT, CN=ipsec, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>"<br>
Apr 14 07:49:08 debian charon: 16[ENC] generating ID_PROT response 0 [ KE No CERTREQ NAT-D NAT-D ]<br>Apr 14 07:49:08 debian charon: 16[NET] sending packet: from 172.16.151.100[500] to 172.16.151.141[500] (499 bytes)<br>Apr 14 07:49:08 debian charon: 08[NET] received packet: from 172.16.151.141[500] to 172.16.151.100[500] (1148 bytes)<br>
Apr 14 07:49:08 debian charon: 08[ENC] parsed ID_PROT request 0 [ ID CERT SIG ]<br>Apr 14 07:49:08 debian charon: 08[IKE] received end entity cert "C=UK, ST=Luton, O=Beds, OU=IT, CN=ipsec, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>"<br>
Apr 14 07:49:08 debian charon: 08[CFG] looking for RSA signature peer configs matching 172.16.151.100...172.16.151.141[C=UK, ST=Luton, O=Beds, OU=IT, CN=ipsec, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>]<br>Apr 14 07:49:08 debian charon: 08[CFG] selected peer config "rw"<br>
Apr 14 07:49:08 debian charon: 08[CFG] using certificate "C=UK, ST=Luton, O=Beds, OU=IT, CN=ipsec, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>"<br>Apr 14 07:49:08 debian charon: 08[CFG] using trusted ca certificate "C=UK, ST=Luton, L=Luton, O=Beds, OU=IT, CN=ipsec, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>"<br>
Apr 14 07:49:08 debian charon: 08[CFG] checking certificate status of "C=UK, ST=Luton, O=Beds, OU=IT, CN=ipsec, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>"<br>Apr 14 07:49:08 debian charon: 08[CFG] certificate status is not available<br>
Apr 14 07:49:08 debian charon: 08[CFG] reached self-signed root ca with a path length of 0<br>Apr 14 07:49:08 debian charon: 08[IKE] authentication of 'C=UK, ST=Luton, O=Beds, OU=IT, CN=ipsec, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>' with RSA successful<br>
Apr 14 07:49:08 debian charon: 08[IKE] authentication of 'C=UK, ST=Luton, O=Beds, OU=IT, CN=ipsec-gw2, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>' (myself) successful<br>Apr 14 07:49:08 debian charon: 08[IKE] IKE_SA rw[7] established between 172.16.151.100[C=UK, ST=Luton, O=Beds, OU=IT, CN=ipsec-gw2, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>]...172.16.151.141[C=UK, ST=Luton, O=Beds, OU=IT, CN=ipsec, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>]<br>
Apr 14 07:49:08 debian charon: 08[IKE] scheduling reauthentication in 3404s<br>Apr 14 07:49:08 debian charon: 08[IKE] maximum IKE_SA lifetime 3584s<br>Apr 14 07:49:08 debian charon: 08[IKE] sending end entity cert "C=UK, ST=Luton, O=Beds, OU=IT, CN=ipsec-gw2, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>"<br>
Apr 14 07:49:08 debian charon: 08[ENC] generating ID_PROT response 0 [ ID CERT SIG ]<br>Apr 14 07:49:08 debian charon: 08[NET] sending packet: from 172.16.151.100[500] to 172.16.151.141[500] (1148 bytes)<br>Apr 14 07:49:08 debian charon: 12[NET] received packet: from 172.16.151.141[500] to 172.16.151.100[500] (92 bytes)<br>
Apr 14 07:49:08 debian charon: 12[ENC] parsed INFORMATIONAL_V1 request 3937839819 [ HASH N(INITIAL_CONTACT) ]<br>Apr 14 07:49:08 debian charon: 10[NET] received packet: from 172.16.151.141[500] to 172.16.151.100[500] (92 bytes)<br>
Apr 14 07:49:08 debian charon: 10[ENC] parsed TRANSACTION request 1841991445 [ HASH CP ]<br>Apr 14 07:49:08 debian charon: 10[IKE] peer requested virtual IP %any<br>Apr 14 07:49:08 debian charon: 10[IKE] no virtual IP found for %any requested by 'C=UK, ST=Luton, O=Beds, OU=IT, CN=ipsec, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>'<br>
Apr 14 07:49:08 debian charon: 10[ENC] generating TRANSACTION response 1841991445 [ HASH CP ]<br>Apr 14 07:49:08 debian charon: 10[NET] sending packet: from 172.16.151.100[500] to 172.16.151.141[500] (76 bytes)<br>Apr 14 07:49:08 debian charon: 11[NET] received packet: from 172.16.151.141[500] to 172.16.151.100[500] (92 bytes)<br>
Apr 14 07:49:08 debian charon: 11[ENC] parsed INFORMATIONAL_V1 request 1182985237 [ HASH D ]<br>Apr 14 07:49:08 debian charon: 11[IKE] received DELETE for IKE_SA rw[7]<br>Apr 14 07:49:08 debian charon: 11[IKE] deleting IKE_SA rw[7] between 172.16.151.100[C=UK, ST=Luton, O=Beds, OU=IT, CN=ipsec-gw2, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>]...172.16.151.141[C=UK, ST=Luton, O=Beds, OU=IT, CN=ipsec, E=<a href="mailto:root@ipsec.com">root@ipsec.com</a>]<br>
<br><br><br><br><br>-----------------------------------------------------------------------------------------------------<br><br>/etc/ipsec.conf<br><br><br># ipsec.conf - strongSwan IPsec configuration file<br><br>config setup<br>
# # strictcrlpolicy=yes<br># # uniqueids = no<br><br>conn %default<br> type=tunnel<br> ike=aes128-sha1-modp2048,3des-sha1-modp1536 <br> ikelifetime=60m<br> keylife=20m<br> rekeymargin=3m<br> keyingtries=1<br>
keyexchange=ikev1<br> esp=aes128-sha1,3des-sha1<br> mobike=yes<br> leftikeport=4500<br> rightikeport=4500<br><br><br>conn rw<br> left=172.16.151.100<br> leftcert=gatewayCert.pem<br> leftid=@<a href="http://ipsec.org">ipsec.org</a><br>
leftsubnet=<a href="http://192.168.7.0/24">192.168.7.0/24</a><br> leftfirewall=yes<br> right=%any<br> auto=add<br><br><br><br>------------------------------------------------------------------------------------------------<br>
<br>/etc/strongswan.conf <br><br># strongswan.conf - strongSwan configuration file<br><br>charon {<br><br> load = curl test-vectors aes des sha1 sha2 md5 pem pkcs1 pkcs8 gmp random nonce x509 revocation hmac xcbc cmac ctr ccm gcm stroke kernel-netlink socket-default updown<br>
<br><br>pluto {<br><br>}<br><br>libstrongswan {<br><br>}<br><br><br><br><br><br><br><br><br><br><br><br><br><br clear="all"><br>-- <br><a href="http://www.2dd.it" target="_blank">http://www.2dd.it</a>
</div></div></div></div></div></div>