<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I have been attempting to setup a vpn between my home file server and a blackberry z10, using a "generic ikev2 vpn" and self-signed certificates. All of my attempts are failing at the same place. Here is the piece of log where it fails:<br><br>Sep 3 22:19:09 firebrand charon: 09[CFG] loaded certificate "C=CA, O=none, CN=server" from 'serverCert.pem'<br>Sep 3 22:19:09 firebrand charon: 09[CFG] id '%any' not confirmed by certificate, defaulting to 'C=CA, O=none, CN=server'<br>Sep 3 22:19:09 firebrand charon: 09[CFG] added configuration 'z10'<br>Sep 3 22:19:09 firebrand charon: 09[CFG] adding virtual IP address pool 'z10': 10.90.0.3/32<br>Sep 3 22:23:08 firebrand charon: 03[NET] received packet: from 24.100.200.200[43337] to 192.168.16.50[500]<br>Sep 3 22:23:08 firebrand charon: 03[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>Sep 3 22:23:08 firebrand charon: 03[CFG] looking for an ike config for 192.168.16.50...24.100.200.200<br>Sep 3 22:23:08 firebrand charon: 03[CFG] candidate: 192.168.16.50...%any, prio 5<br>Sep 3 22:23:08 firebrand charon: 03[CFG] found matching ike config: 192.168.16.50...%any with prio 5<br>Sep 3 22:23:08 firebrand charon: 03[IKE] 24.100.200.200 is initiating an IKE_SA<br>Sep 3 22:23:08 firebrand charon: 03[CFG] selecting proposal:<br>Sep 3 22:23:08 firebrand charon: 03[CFG] proposal matches<br>Sep 3 21:39:19 firebrand charon: 03[CFG] received proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048<br>Sep
3 21:39:19 firebrand charon: 03[CFG] configured proposals:
IKE:AES_CBC_256/HMAC_SHA2_256_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_256/MODP_2048<br>Sep 3 21:39:19 firebrand charon: 03[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048<br>Sep 3 21:39:19 firebrand charon: 03[IKE] local host is behind NAT, sending keep alives<br>Sep 3 21:39:19 firebrand charon: 03[IKE] remote host is behind NAT<br>Sep 3 21:39:19 firebrand charon: 03[IKE] sending cert request for "C=CA, O=none, CN=AA-VPN-CA"<br>Sep
3 21:39:19 firebrand charon: 03[ENC] generating IKE_SA_INIT response 0 [
SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]<br>Sep 3 21:39:19 firebrand charon: 03[NET] sending packet: from 192.168.16.50[500] to 24.100.200.200[43387]<br>Sep 3 21:39:19 firebrand charon: 12[NET] received packet: from 24.100.200.200[43388] to 192.168.16.50[4500]<br>Sep 3 21:39:19 firebrand charon: 12[ENC] invalid X509 hash length (0) in certreq<br>Sep 3 21:39:19 firebrand charon: 12[ENC] CERTIFICATE_REQUEST verification failed<br>Sep 3 21:39:19 firebrand charon: 12[ENC] could not decrypt payloads<br>Sep 3 21:39:19 firebrand charon: 12[IKE] message verification failed<br>Sep 3 21:39:19 firebrand charon: 12[ENC] generating IKE_AUTH response 1 [ N(INVAL_SYN) ]<br>Sep 3 21:39:19 firebrand charon: 12[NET] sending packet: from 192.168.16.50[500] to 24.100.200.200[43387]<br>Sep 3 21:39:19 firebrand charon: 12[IKE] IKE_AUTH request with message ID 1 processing failed<br>Sep 3 21:39:31 firebrand charon: 13[NET] received packet: from 24.100.200.200[43388] to 192.168.16.50[4500]<br>Sep 3 21:39:31 firebrand charon: 13[ENC] invalid X509 hash length (0) in certreq<br>Sep 3 21:39:31 firebrand charon: 13[ENC] CERTIFICATE_REQUEST verification failed<br>Sep 3 21:39:31 firebrand charon: 13[ENC] could not decrypt payloads<br>Sep 3 21:39:31 firebrand charon: 13[IKE] message verification failed<br>Sep 3 21:39:31 firebrand charon: 13[ENC] generating IKE_AUTH response 1 [ N(INVAL_SYN) ]<br>Sep 3 21:39:31 firebrand charon: 13[NET] sending packet: from 192.168.16.50[500] to 24.100.200.200[43387]<br>Sep 3 21:39:31 firebrand charon: 13[IKE] IKE_AUTH request with message ID 1 processing failed<br><br>I don't exactly know what is failing here. I don't think there is a problem with the way I generated the certificates, I followed the instructions on the strongswan website for a setting up a simple CA. I generated a CA, an RSA keypair for my server and an RSA keypair for my z10. The CA certificate (CA.pem) was copied to both the server and z10, the RSA keypair for the z10 was copied to the z10(z10.pem), and the RSA keypair for the server(serverCert.pem, serverKey.pem) was placed on the server:<br><br>CA:<br>ipsec pki --gen --outform pem > caKey.pem<br>ipsec pki --self --in caKey.pem --dn "C=CA, O=none, CN=AA-VPN-CA" --san="AA-VPN-CA@unknown.planet" --ca --outform pem > caCert.pem<br><br>Server keypair:<br>ipsec pki --gen --outform pem > serverKey.pem<br>ipsec pki --pub --in
serverKey.pem | ipsec pki --issue --cacert caCert.pem --cakey caKey.pem
--dn "C=CA, O=none, CN=server" --san="fire@unknown.planet" --outform
pem > serverCert.pem<br><br>Client keypair:<br>ipsec pki --gen --outform pem > userKey.pem<br>ipsec pki --pub --in userKey.pem | ipsec pki --issue --cacert caCert.pem --cakey caKey.pem --dn "C=CA, O=none, CN=z10" --san="z10@unknown.planet" --outform pem > userCert.pem<br><br>When importing the client keypair to the Z10, I am pasting the public key below the private key in one text file so I can import it easily.<br><br><br>I have altered my configuration many times trying to get this working. The log I pasted above has this configuration:<br><br>***ipsec.conf***<br><br>config setup<br> crlcheckinterval=180<br> strictcrlpolicy=no<br> plutostart=no<br> charondebug="cfg 3"<br><br>conn %default<br> ikelifetime=60m<br> keylife=20m<br> rekeymargin=3m<br> keyingtries=1<br><br>conn z10<br> ike=aes256-sha256-sha256-modp2048!<br> esp=aes256-sha256-sha256-modp2048!<br> leftcert=serverCert.pem<br> leftid=%any<br> left=%defaultroute<br> leftsourceip=10.90.0.1<br> leftsubnet=192.168.16.0/24<br> leftfirewall=yes<br> right=%any<br> rightid="C=CA, O=none, CN=z10"<br> rightsubnet=10.90.0.0/24<br> rightsourceip=10.90.0.3<br> keyexchange=ikev2<br> auto=add<br><br><br>--ipsec listall:<br><br>List of X.509 End Entity Certificates:<br><br> altNames: fire@unknown.planet<br> subject: "C=CA, O=none, CN=server"<br> issuer: "C=CA, O=none, CN=AA-VPN-CA"<br> serial: 00:cc:d0:6f:e2:cd:0f:22:83<br> validity: not before Sep 03 21:31:11 2013, ok<br> not after Sep 02 21:31:11 2016, ok<br> pubkey: RSA 2048 bits, has private key<br> keyid: 0e:20:5c:6f:d4:7f:f4:48:e8:4f:00:00:9d:a5:cd:e8:65:3a:14:9f<br> subjkey: 67:85:d1:8e:8b:80:9d:34:89:3d:aa:be:58:c6:58:15:56:0f:cf:d1<br> authkey: 1e:b4:24:b5:7b:64:fe:41:e7:b9:01:ad:01:c1:70:20:02:49:3a:cf<br><br>List of X.509 CA Certificates:<br><br> altNames: AA-VPN-CA@unknown.planet<br> subject: "C=CA, O=none, CN=AA-VPN-CA"<br> issuer: "C=CA, O=none, CN=AA-VPN-CA"<br> serial: 1c:4f:c9:f1:71:38:43:a0<br> validity: not before Sep 03 21:31:03 2013, ok<br> not after Sep 02 21:31:03 2016, ok<br> pubkey: RSA 2048 bits<br> keyid: 7c:91:eb:71:14:0e:5e:49:0c:33:85:67:fc:9f:4f:cd:2b:f2:cc:2b<br> subjkey: 1e:b4:24:b5:7b:64:fe:41:e7:b9:01:ad:01:c1:70:20:02:49:3a:cf<br> authkey: 1e:b4:24:b5:7b:64:fe:41:e7:b9:01:ad:01:c1:70:20:02:49:3a:cf<br><br><br>What am I doing wrong?<br><br><br><br> </div></body>
</html>