<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">Hi, we are bringing up a VPN between strongswan and windows 7</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">We see a strange problem. When strongswan initiates to windows, the VPN is up OK.</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">But when strongswan responds, the negotiation fails in Phase 2 quick mode.</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color:
transparent; font-style: normal;">The main mode ECDSA cert auth is OK, but not quick mode.</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">Can someone please comment and see if we are missing something?</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">After a lot of trial and error, I ended up writing a windows netsh script to automate the firewall rule.</div><div style="color: rgb(0, 0, 0); font-size: 16px;
font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">It is included below in the hopes it will be helpful to others.</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">In our configuration we are using ECDSA-P256 machine certificate</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new
york,times,serif; background-color: transparent; font-style: normal;">The strongswan wiki is very helpful to get up to speed how to configure Windows <br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">firewall from the MMC snap-in and netsh command line. <br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">wiki.strongswan.org/projects/strongswan/wiki/WindowsSuiteB<br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">However the IKE main mode methods (mmsecmethods) used
in that example include ECDHP256 <br>but we don't use it. Instead, we use a standard DH group 2 Modp 1024.</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">Strongswan configuration:<br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">ike=aes128-sha256-modp1024!<br>esp=aes128-sha1! </div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color:
transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">Windows rule:<br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">dhgroup2:aese128-sha256<br>auth1=computercertecdsap256<br>auth1ecdsap256ca=...</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">Here is the netsh script that
does the complete setup of the firewall rule</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">After the machine certificates are installed, then this script is run and adds the rule from scratch.</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">rem restart windows firewall:<br>net stop mpssvc<br>net start mpssvc<br><br>rem configure global IPSec mainmode settings:<br>netsh advfirewall set global mainmode mmsecmethods
dhgroup2:aes128-sha256<br>netsh advfirewall show global<br><br><br>rem configure the suiteb firewall rule:<br><br>netsh advfirewall consec del rule name=suiteb<br><br>netsh advfirewall consec add rule name=suiteb ^<br>description="SuiteB Configuration" ^<br>endpoint1=192.168.0.1 ^<br>endpoint2=192.168.0.100 ^<br>action=requireinrequireout ^<br>qmsecmethods=esp:sha1-aes128
^<br>auth1=computercertecdsap256 ^<br>auth1ecdsap256ca="O=\'XYZ Company\', OU=Operations, E=info@xyz.com, L=Anytown, S=CA, C=US, CN=\'XYZ Company\'"<br><br><br>netsh advfirewall consec show rule name=suiteb<br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br><br></div></div></body></html>