<div dir="ltr"><div><div>Hello,<br><br></div>I configure strongswan but the client (win XP) is connected to the server but I am not able from the client to ping the internal network. <br><br>Where can be the problem??<br></div>
Thank you<br><br><br>---------------------------------------------------------------------<br>root@debian:~# ipsec start --nofork --debug-all <br>Starting strongSwan 5.0.2 IPsec [starter]...<br>!! Your strongswan.conf contains manual plugin load options for charon.<br>
!! This is recommended for experts only, see<br>!! <a href="http://wiki.strongswan.org/projects/strongswan/wiki/PluginLoad">http://wiki.strongswan.org/projects/strongswan/wiki/PluginLoad</a><br>Loading config setup<br>Loading conn %default<br>
ikelifetime=60m<br> keylife=20m<br> rekeymargin=3m<br> keyingtries=1<br> keyexchange=ikev1<br>Loading conn 'rw'<br> left=172.16.151.100<br> leftcert=server.crt<br> leftid=@<a href="http://ipsec.org">ipsec.org</a><br>
leftsubnet=<a href="http://192.168.7.0/24">192.168.7.0/24</a><br> leftfirewall=yes<br> right=%any<br> rightsourceip=<a href="http://192.168.7.0/24">192.168.7.0/24</a><br> auto=add<br>found netkey IPsec stack<br>Attempting to start charon...<br>
00[DMN] Starting IKE charon daemon (strongSwan 5.0.2, Linux 3.2.0-0.bpo.4-amd64, x86_64)<br>00[LIB] enabled AES_CBC[aes]: passed 6 test vectors<br>00[LIB] enabled AES_CBC[aes]: passed 6 test vectors<br>00[LIB] enabled AES_CBC[aes]: passed 6 test vectors<br>
00[LIB] enabled 3DES_CBC[des]: passed 2 test vectors<br>00[LIB] enabled DES_CBC[des]: passed 2 test vectors<br>00[LIB] enabled DES_ECB[des]: passed 2 test vectors<br>00[LIB] enabled HASH_SHA1[sha1]: passed 4 test vectors<br>
00[LIB] enabled PRF_KEYED_SHA1[sha1]: no test vectors found<br>00[LIB] enabled HASH_SHA224[sha2]: passed 3 test vectors<br>00[LIB] enabled HASH_SHA256[sha2]: passed 3 test vectors<br>00[LIB] enabled HASH_SHA384[sha2]: passed 3 test vectors<br>
00[LIB] enabled HASH_SHA512[sha2]: passed 3 test vectors<br>00[LIB] enabled HASH_MD5[md5]: passed 7 test vectors<br>00[LIB] enabled RNG_STRONG[random]: passed 3 test vectors<br>00[LIB] enabled RNG_TRUE[random]: skipping test (disabled by config)<br>
00[LIB] enabled PRF_HMAC_SHA1[hmac]: passed 6 test vectors<br>00[LIB] enabled PRF_HMAC_MD5[hmac]: passed 6 test vectors<br>00[LIB] enabled PRF_HMAC_SHA2_256[hmac]: passed 6 test vectors<br>00[LIB] enabled PRF_HMAC_SHA2_384[hmac]: passed 6 test vectors<br>
00[LIB] enabled PRF_HMAC_SHA2_512[hmac]: passed 6 test vectors<br>00[LIB] enabled HMAC_SHA1_96[hmac]: passed 2 test vectors<br>00[LIB] enabled HMAC_SHA1_128[hmac]: passed 2 test vectors<br>00[LIB] enabled HMAC_SHA1_160[hmac]: passed 2 test vectors<br>
00[LIB] enabled HMAC_MD5_96[hmac]: passed 2 test vectors<br>00[LIB] enabled HMAC_MD5_128[hmac]: passed 2 test vectors<br>00[LIB] enabled HMAC_SHA2_256_128[hmac]: passed 3 test vectors<br>00[LIB] enabled HMAC_SHA2_256_256[hmac]: no test vectors found<br>
00[LIB] enabled HMAC_SHA2_384_192[hmac]: passed 3 test vectors<br>00[LIB] enabled HMAC_SHA2_384_384[hmac]: no test vectors found<br>00[LIB] enabled HMAC_SHA2_512_256[hmac]: passed 3 test vectors<br>00[LIB] enabled PRF_AES128_XCBC[xcbc]: passed 7 test vectors<br>
00[LIB] enabled AES_XCBC_96[xcbc]: passed 5 test vectors<br>00[LIB] enabled PRF_AES128_CMAC[cmac]: passed 7 test vectors<br>00[LIB] enabled AES_CMAC_96[cmac]: passed 4 test vectors<br>00[LIB] enabled AES_CTR[ctr]: passed 9 test vectors<br>
00[LIB] enabled AES_CTR[ctr]: passed 9 test vectors<br>00[LIB] enabled AES_CTR[ctr]: passed 9 test vectors<br>00[LIB] enabled AES_CCM_8[ccm]: passed 5 test vectors<br>00[LIB] enabled AES_CCM_8[ccm]: passed 5 test vectors<br>
00[LIB] enabled AES_CCM_8[ccm]: passed 5 test vectors<br>00[LIB] enabled AES_CCM_12[ccm]: passed 1 test vectors<br>00[LIB] enabled AES_CCM_12[ccm]: passed 1 test vectors<br>00[LIB] enabled AES_CCM_12[ccm]: passed 1 test vectors<br>
00[LIB] enabled AES_CCM_16[ccm]: passed 5 test vectors<br>00[LIB] enabled AES_CCM_16[ccm]: passed 5 test vectors<br>00[LIB] enabled AES_CCM_16[ccm]: passed 5 test vectors<br>00[LIB] enabled AES_GCM_8[gcm]: passed 1 test vectors<br>
00[LIB] enabled AES_GCM_8[gcm]: passed 1 test vectors<br>00[LIB] enabled AES_GCM_8[gcm]: passed 1 test vectors<br>00[LIB] enabled AES_GCM_12[gcm]: passed 1 test vectors<br>00[LIB] enabled AES_GCM_12[gcm]: passed 1 test vectors<br>
00[LIB] enabled AES_GCM_12[gcm]: passed 1 test vectors<br>00[LIB] enabled AES_GCM_16[gcm]: passed 5 test vectors<br>00[LIB] enabled AES_GCM_16[gcm]: passed 5 test vectors<br>00[LIB] enabled AES_GCM_16[gcm]: passed 5 test vectors<br>
00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'<br>00[CFG] loaded ca certificate "C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=Beds CA, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>" from '/etc/ipsec.d/cacerts/ca.crt'<br>
00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'<br>00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'<br>00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'<br>
00[CFG] loading crls from '/etc/ipsec.d/crls'<br>00[CFG] loading secrets from '/etc/ipsec.secrets'<br>00[CFG] loaded RSA private key from '/etc/ipsec.d/private/server.key'<br>00[DMN] loaded plugins: charon curl test-vectors aes des sha1 sha2 md5 pem pkcs1 pkcs8 gmp random nonce x509 revocation hmac xcbc cmac ctr ccm gcm stroke kernel-netlink socket-default updown<br>
00[JOB] spawning 16 worker threads<br>charon (2651) started after 40 ms<br>08[CFG] received stroke: add connection 'rw'<br>08[CFG] adding virtual IP address pool <a href="http://192.168.7.0/24">192.168.7.0/24</a><br>
08[CFG] loaded certificate "C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=server, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>" from 'server.crt'<br>08[CFG] id '<a href="http://ipsec.org">ipsec.org</a>' not confirmed by certificate, defaulting to 'C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=server, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>'<br>
08[CFG] added configuration 'rw'<br>09[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (3756 bytes)<br>09[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V V V ]<br>09[IKE] received draft-ietf-ipsec-nat-t-ike-00 vendor ID<br>
09[ENC] received unknown vendor ID: 16:f6:ca:16:e4:a4:06:6d:83:82:1a:0f:0a:ea:a8:62<br>09[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID<br>09[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID<br>09[IKE] received NAT-T (RFC 3947) vendor ID<br>
09[IKE] received FRAGMENTATION vendor ID<br>09[IKE] received DPD vendor ID<br>09[ENC] received unknown vendor ID: f1:4b:94:b7:bf:f1:fe:f0:27:73:b8:c4:9f:ed:ed:26<br>09[ENC] received unknown vendor ID: 16:6f:93:2d:55:eb:64:d8:e4:df:4f:d3:7e:23:13:f0:d0:fd:84:51<br>
09[ENC] received unknown vendor ID: 84:04:ad:f9:cd:a0:57:60:b2:ca:29:2e:4b:ff:53:7b<br>09[IKE] received Cisco Unity vendor ID<br>09[IKE] 172.16.151.131 is initiating a Main Mode IKE_SA<br>09[ENC] generating ID_PROT response 0 [ SA V V V ]<br>
09[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (140 bytes)<br>10[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (365 bytes)<br>10[ENC] parsed ID_PROT request 0 [ KE No CERTREQ NAT-D NAT-D ]<br>
10[IKE] ignoring certificate request without data<br>10[IKE] sending cert request for "C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=Beds CA, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>"<br>
10[ENC] generating ID_PROT response 0 [ KE No CERTREQ NAT-D NAT-D ]<br>10[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (527 bytes)<br>11[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (1724 bytes)<br>
11[ENC] parsed ID_PROT request 0 [ ID CERT SIG ]<br>11[IKE] received end entity cert "C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=client, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>"<br>
11[CFG] looking for RSA signature peer configs matching 172.16.151.100...172.16.151.131[C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=client, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>]<br>11[CFG] selected peer config "rw"<br>
11[CFG] using certificate "C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=client, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>"<br>11[CFG] using trusted ca certificate "C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=Beds CA, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>"<br>
11[CFG] checking certificate status of "C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=client, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>"<br>11[CFG] certificate status is not available<br>
11[CFG] reached self-signed root ca with a path length of 0<br>11[IKE] authentication of 'C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=client, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>' with RSA successful<br>
11[IKE] authentication of 'C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=server, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>' (myself) successful<br>11[IKE] IKE_SA rw[1] established between 172.16.151.100[C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=server, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>]...172.16.151.131[C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=client, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>]<br>
11[IKE] scheduling reauthentication in 3297s<br>11[IKE] maximum IKE_SA lifetime 3477s<br>11[IKE] sending end entity cert "C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=server, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>"<br>
11[ENC] generating ID_PROT response 0 [ ID CERT SIG ]<br>11[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (1756 bytes)<br>13[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (92 bytes)<br>
13[ENC] parsed INFORMATIONAL_V1 request 2720293503 [ HASH N(INITIAL_CONTACT) ]<br>13[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (92 bytes)<br>13[ENC] parsed TRANSACTION request 640267562 [ HASH CP ]<br>
13[IKE] peer requested virtual IP %any<br>13[CFG] assigning new lease to 'C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=client, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>'<br>13[IKE] assigning virtual IP 192.168.7.1 to peer 'C=UK, ST=Beds, L=Luton, O=Beds, OU=IT, CN=client, N=Strongswan, E=<a href="mailto:root@ipsec.beds.com">root@ipsec.beds.com</a>'<br>
13[ENC] generating TRANSACTION response 640267562 [ HASH CP ]<br>13[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (76 bytes)<br>15[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (684 bytes)<br>
15[ENC] parsed QUICK_MODE request 2781654303 [ HASH SA No ID ID ]<br>15[IKE] received 3600s lifetime, configured 1200s<br>15[ENC] generating QUICK_MODE response 2781654303 [ HASH SA No ID ID ]<br>15[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (172 bytes)<br>
07[IKE] sending retransmit 1 of response message ID 2781654303, seq 5<br>07[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (172 bytes)<br>08[IKE] sending retransmit 2 of response message ID 2781654303, seq 5<br>
08[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (172 bytes)<br>09[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (92 bytes)<br>09[ENC] parsed INFORMATIONAL_V1 request 51255654 [ HASH N(DPD) ]<br>
09[ENC] generating INFORMATIONAL_V1 request 2918765658 [ HASH N(DPD_ACK) ]<br>09[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (92 bytes)<br>10[IKE] sending retransmit 3 of response message ID 2781654303, seq 5<br>
10[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (172 bytes)<br>12[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (684 bytes)<br>12[ENC] parsed QUICK_MODE request 2439206719 [ HASH SA No ID ID ]<br>
12[IKE] CHILD_SA rw{1} established with SPIs c8de18b3_i 6b57c330_o and TS <a href="http://192.168.7.0/24">192.168.7.0/24</a> === <a href="http://192.168.7.1/32">192.168.7.1/32</a> <br>13[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (92 bytes)<br>
13[ENC] parsed INFORMATIONAL_V1 request 959431080 [ HASH N(DPD) ]<br>13[ENC] generating INFORMATIONAL_V1 request 3238217689 [ HASH N(DPD_ACK) ]<br>13[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (92 bytes)<br>
14[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (684 bytes)<br>14[ENC] invalid HASH_V1 payload length, decryption failed?<br>14[ENC] could not decrypt payloads<br>14[IKE] message parsing failed<br>
14[ENC] generating INFORMATIONAL_V1 request 2658081635 [ HASH N(PLD_MAL) ]<br>14[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (76 bytes)<br>14[IKE] QUICK_MODE request with message ID 2439206719 processing failed<br>
15[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (684 bytes)<br>15[ENC] invalid HASH_V1 payload length, decryption failed?<br>15[ENC] could not decrypt payloads<br>15[IKE] message parsing failed<br>
15[ENC] generating INFORMATIONAL_V1 request 2558400398 [ HASH N(PLD_MAL) ]<br>15[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (76 bytes)<br>15[IKE] QUICK_MODE request with message ID 2439206719 processing failed<br>
07[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (684 bytes)<br>07[ENC] invalid HASH_V1 payload length, decryption failed?<br>07[ENC] could not decrypt payloads<br>07[IKE] message parsing failed<br>
07[ENC] generating INFORMATIONAL_V1 request 45400192 [ HASH N(PLD_MAL) ]<br>07[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (76 bytes)<br>07[IKE] QUICK_MODE request with message ID 2439206719 processing failed<br>
08[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (92 bytes)<br>08[ENC] parsed INFORMATIONAL_V1 request 1445932911 [ HASH N(DPD) ]<br>08[ENC] generating INFORMATIONAL_V1 request 446635703 [ HASH N(DPD_ACK) ]<br>
08[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (92 bytes)<br>09[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (684 bytes)<br>09[ENC] parsed QUICK_MODE request 3074289790 [ HASH SA No ID ID ]<br>
09[IKE] received 3600s lifetime, configured 1200s<br>09[IKE] detected rekeying of CHILD_SA rw{1}<br>09[ENC] generating QUICK_MODE response 3074289790 [ HASH SA No ID ID ]<br>09[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (172 bytes)<br>
10[IKE] sending retransmit 1 of response message ID 3074289790, seq 6<br>10[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (172 bytes)<br>11[IKE] sending retransmit 2 of response message ID 3074289790, seq 6<br>
11[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (172 bytes)<br>13[NET] received packet: from 172.16.151.131[500] to 172.16.151.100[500] (92 bytes)<br>13[ENC] parsed INFORMATIONAL_V1 request 4153077593 [ HASH N(DPD) ]<br>
13[ENC] generating INFORMATIONAL_V1 request 677315988 [ HASH N(DPD_ACK) ]<br>13[NET] sending packet: from 172.16.151.100[500] to 172.16.151.131[500] (92 bytes)<br><br><br clear="all"><div><div><div><br>-- <br><a href="http://www.2dd.it" target="_blank">http://www.2dd.it</a>
</div></div></div></div>