<div dir="ltr">Hi Andreas,<div>I have changed the ipsec.secrets file and saw that secret values where read properly by both client and server, </div><div>I still get the authentication Failure, but i am not sure why EAP_ONLY is been sent, i that the cause for failure.</div>
<div><br></div><div><div><div>/*****Client *******/</div><div>13[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH CP(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]</div></div>
<div><br></div></div><div>/**********servre ******/</div><div><div>05[NET] received packet: from 10.43.135.221[4500] to 10.73.127.45[4500]</div><div>05[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH CP(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]</div>
<div>05[CFG] looking for peer configs matching 10.73.127.45[10.73.127.45]...10.43.135. 221[10.43.135.221]</div><div>05[CFG] selected peer config 'rw'</div><div>05[IKE] no shared key found for '10.73.127.45' - '10.43.135.221'</div>
<div>05[IKE] peer supports MOBIKE</div><div>05[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]</div><div>05[NET] sending packet: from 10.73.127.45[4500] to 10.43.135.221[4500]</div></div><div>/************************************/</div>
<div><br></div><div>I appreciate your response.</div><div><br></div><div>Thanks</div><div>Naveen</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Sep 13, 2013 at 11:36 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Naveen,<br>
<br>
due to a syntax error in your ipsec.secrets, the responder doesn't<br>
find a matching PSK an aborts:<br>
<div class="im"><br>
> /******** Server side log **********/<br>
</div>...<br>
<div class="im">> loading secrets from "/etc/ipsec.secrets"<br>
> loaded PSK secret for 10.73.127.45 10.43.135.221<br>
> "/etc/ipsec.secrets" line 12: PSK data malformed (input does not begin<br>
> with format prefix): 1234567890<br>
<br>
</div>The PSK must be of the form:<br>
<br>
10.73.127.45 10.43.135.221 : PSK "1234567890"<br>
<br>
if it is to be treated as a text string or<br>
<br>
10.73.127.45 10.43.135.221 : PSK 0x1234567890abcdef<br>
<br>
if it is to be a HEX value or<br>
<br>
10.73.127.45 10.43.135.221 : PSK 0s123456789abcxyzABCXYZ+/<br>
<br>
it it is to be interpreted as a Base64-encoded value.<br>
<br>
Regards<br>
<br>
Andreas<br>
<div><div class="h5"><br>
On 09/14/2013 05:47 AM, Naveen Neelakanta wrote:<br>
> Hi All,<br>
><br>
> I have installed both strongswan server and client .<br>
> I am trying the virtual ip scenario with PSK auth method, but the i am<br>
> not able to get it working with the attached configuration files used.<br>
> Please find the attached server and client configuration file.<br>
> I have installed the strongswan 5.1.0 version with the below<br>
> confguration to reduce the size.<br>
><br>
> "--disable-rc2 --disable-md5 --disable-sha1 --disable-sha2<br>
> --disable-fips-prf \<br>
> --disable-aes--disable-des --enable-openssl --disable-pkcs1<br>
> --disable-pkcs7 --disable-pkcs8 \<br>
> --disable-pkcs12--disable-pgp --disable-dnskey --disable-sshkey<br>
> --disable-hmac --disable-cmac \<br>
> --disable-xcbc --disable-gmp --disable-scripts --disable-ikev1<br>
> --disable-tools --enable-monolithic"<br>
><br>
> these below logs are collect from the command #ipsec start --nofork<br>
><br>
> /******** Client side log **********/<br>
> ipsec up host<br>
> initiating IKE_SA host[1] to 10.73.127.45<br>
> generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>
> sending packet: from 10.43.135.221[500] to 10.73.127.45[500] (752 bytes)<br>
> received packet: from 10.73.127.45[500] to 10.43.135.221[500] (440 bytes)<br>
> parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP)<br>
> N(MULT_AUTH)<br>
> ]<br>
> authentication of '10.43.135.221' (myself) with pre-shared key<br>
> establishing CHILD_SA host<br>
> generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH CP(ADDR<br>
> DNS) SA TSi<br>
> TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]<br>
> sending packet: from 10.43.135.221[4500] to 10.73.127.45[4500] (412 bytes)<br>
> received packet: from 10.73.127.45[4500] to 10.43.135.221[4500] (76 bytes)<br>
> parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>
> received AUTHENTICATION_FAILED notify error<br>
> establishing connection 'host' failed<br>
> /***************************************************/<br>
><br>
><br>
> /******** Server side log **********/<br>
> 11[CFG] adding virtual IP address pool 'rw': <a href="http://10.3.0.0/28" target="_blank">10.3.0.0/28</a><br>
</div></div>> <<a href="http://10.3.0.0/28" target="_blank">http://10.3.0.0/28</a>><br>
<div class="im">> loading ca certificates from '/etc/ipsec.d/cacerts'<br>
> loading aa certificates from '/etc/ipsec.d/aacerts'<br>
> loading ocsp certificates from '/etc/ipsec.d/ocspcerts'<br>
> Changing to directory '/etc/ipsec.d/crls'<br>
> loading attribute certificates from '/etc/ipsec.d/acerts'<br>
> spawning 4 worker threads<br>
> listening for IKE messages<br>
</div>> adding interface wlan0/wlan0 <a href="http://10.73.127.45:500" target="_blank">10.73.127.45:500</a> <<a href="http://10.73.127.45:500" target="_blank">http://10.73.127.45:500</a>><br>
> adding interface lo/lo <a href="http://127.0.0.1:500" target="_blank">127.0.0.1:500</a> <<a href="http://127.0.0.1:500" target="_blank">http://127.0.0.1:500</a>><br>
<div class="im">> adding interface lo/lo ::1:500<br>
> loading secrets from "/etc/ipsec.secrets"<br>
> loaded PSK secret for 10.73.127.45 10.43.135.221<br>
> "/etc/ipsec.secrets" line 12: PSK data malformed (input does not begin<br>
> with format prefix): 1234567890<br>
> added connection description "rw"<br>
> 06[NET] received packet: from 10.43.135.221[500] to 10.73.127.45[500]<br>
> 06[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>
> 06[IKE] 10.43.135.221 is initiating an IKE_SA<br>
> 06[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP)<br>
> N(NATD_D_IP) N(MULT_AUTH) ]<br>
> 06[NET] sending packet: from 10.73.127.45[500] to 10.43.135.221[500]<br>
> 05[NET] received packet: from 10.43.135.221[4500] to 10.73.127.45[4500]<br>
> 05[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH CP(ADDR<br>
> DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]<br>
> 05[CFG] looking for peer configs matching<br>
> 10.73.127.45[10.73.127.45]...10.43.135.221[10.43.135.221]<br>
> 05[CFG] no matching peer config found<br>
> 05[IKE] peer supports MOBIKE<br>
> 05[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>
> 05[NET] sending packet: from 10.73.127.45[4500] to 10.43.135.221[4500]<br>
> /**********************************************************************************/<br>
><br>
> Thanks<br>
> Naveen<br>
</div>======================================================================<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
strongSwan - the Open Source VPN Solution! <a href="http://www.strongswan.org" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
===========================================================[ITA-HSR]==<br>
<br>
</blockquote></div><br></div>