<div dir="ltr">I'd like to try to get EAP/PSK working, as certificates introduce additional complexity on the client side.<div>Does anyone have a working configuration they can share with me? Or suggest changes I could make to my configuration?</div><div><br></div><div>regards,</div><div>imran</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Nov 30, 2014 at 4:25 PM, Imran Akbar <span dir="ltr"><<a href="mailto:skunkwerk@gmail.com" target="_blank">skunkwerk@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Success!<div>I finally got it working by using certificates and following this example: <a href="http://endlessroad1991.blogspot.com/2014/04/setup-ipsec-vpn-on-ec2.html" target="_blank">http://endlessroad1991.blogspot.com/2014/04/setup-ipsec-vpn-on-ec2.html</a></div><div>Still don't know what the issue was with the EAP/PSK config.</div><div><br></div><div>many thanks,</div><div>imran</div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Nov 30, 2014 at 2:43 PM, Imran Akbar <span dir="ltr"><<a href="mailto:skunkwerk@gmail.com" target="_blank">skunkwerk@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Sure Noel, <div><br></div><div>Here's the complete server log from startup up to and including the authentication request: <a href="http://pastebin.com/X8a0xunC" target="_blank">http://pastebin.com/X8a0xunC</a></div><div>And this is a <a href="https://s3.amazonaws.com/pushbullet-uploads/ujBvnCpT4IC-kZXEDbaZszgiNSnbFKRLvu9QxRtio85p/Screenshot_2014-11-30-14-35-29.png" target="_blank">screenshot</a> of how I'm connecting via the StrongSwan Android app</div><div><br></div><div>yours,</div><div>imran</div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Nov 30, 2014 at 1:23 PM, Noel Kuntze <span dir="ltr"><<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span><br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA256<br>
<br>
Hello Imran,<br>
<br>
</span>Do you mind posting the complete log from daemon start to the error?<br>
<br>
And yes, PSK is the easiest way, but if you are experienced with certificates, you can also take that approach.<br>
<span><br>
<br>
Mit freundlichen Grüßen/Regards,<br>
Noel Kuntze<br>
<br>
GPG Key ID: 0x63EC6658<br>
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
<br>
</span>Am 30.11.2014 um 20:34 schrieb Imran Akbar:<br>
<span>> Hey Noel,<br>
> I feel like it's close to working, but still getting the same message after making that change and restarting. Do you think it's the "config inacceptable" error that's causing authentication to fail, or is it something in my secrets file?<br>
><br>
> ipsec.conf now looks like: <a href="http://pastebin.com/tUN6jmaS" target="_blank">http://pastebin.com/tUN6jmaS</a><br>
><br>
> the server log says:<br>
> Nov 30 19:16:02 ip-172-31-25-2 charon: 14[CFG] looking for peer configs matching 172.31.25.2[%any]...76.126.165.62[app]<br>
> Nov 30 19:16:02 ip-172-31-25-2 charon: 14[CFG] selected peer config 'vpn'<br>
> Nov 30 19:16:02 ip-172-31-25-2 charon: 14[IKE] peer requested EAP, config inacceptable<br>
> Nov 30 19:16:02 ip-172-31-25-2 charon: 14[CFG] no alternative config found<br>
> Nov 30 19:16:02 ip-172-31-25-2 charon: 14[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding<br>
> Nov 30 19:16:02 ip-172-31-25-2 charon: 14[IKE] peer supports MOBIKE<br>
> Nov 30 19:16:02 ip-172-31-25-2 charon: 14[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>
> Nov 30 19:16:02 ip-172-31-25-2 charon: 14[NET] sending packet: from 172.31.25.2[4500] to 76.126.165.62[37721] (76 bytes)<br>
><br>
> and the client log says "parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>
><br>
> Is using a PSK the easiest way to setup StrongSwan? I assumed that was the case, but I tried using certificates as well by following this example (<a href="http://kleinerman.org/ipsec-with-strongswan/" target="_blank">http://kleinerman.org/ipsec-with-strongswan/</a>) but I get stuck at the last step, as the Android app wants a client certificate as well, which I haven't generated.<br>
><br>
> thanks again,<br>
> imran<br>
><br>
><br>
><br>
</span><span>> On Sun, Nov 30, 2014 at 2:39 AM, Noel Kuntze <<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>>> wrote:<br>
><br>
><br>
> Hello Imran,<br>
><br>
</span><span>> I gave you wrong information in my last email. I'm sorry.<br>
><br>
> The correct setting is "eap-mschapv2", not "eap-mschap".<br>
><br>
><br>
> Mit freundlichen Grüßen/Regards,<br>
> Noel Kuntze<br>
><br>
> GPG Key ID: 0x63EC6658<br>
> Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
><br>
> Am 30.11.2014 um 05:09 schrieb Imran Akbar:<br>
> > thanks Noel,<br>
><br>
> > I've made those changes and restarted ipsec, but I'm still getting the same error in my server log:<br>
><br>
> > "peer requested EAP, config inacceptable"<br>
> > "no alternative config found"<br>
><br>
> > This is my updated ipsec: <a href="http://pastebin.com/TnZaiZX8" target="_blank">http://pastebin.com/TnZaiZX8</a><br>
><br>
> > Does that look correct?<br>
><br>
> > appreciate the help,<br>
> > imran<br>
><br>
</span><div><div>> > On Sat, Nov 29, 2014 at 5:47 PM, Noel Kuntze <<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>>>> wrote:<br>
><br>
><br>
> > Hello Imram,<br>
><br>
> > If you want to use psk-mschapv2, you need to specify<br>
> > leftauth=psk<br>
> > rightauth=psk<br>
> > rightauth2=eap-mschap<br>
><br>
> > Please make sure this is in your configuration.<br>
><br>
> > Mit freundlichen Grüßen/Regards,<br>
> > Noel Kuntze<br>
><br>
> > GPG Key ID: 0x63EC6658<br>
> > Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
><br>
> > Am 30.11.2014 um 02:09 schrieb Imran Akbar:<br>
> > > thanks for pointing me in the right direction Noel.<br>
><br>
> > > I've installed strongswan-plugin-eap-mschapv2, added rightauth=eap-mschapv2 to my ipsec.conf file, and restart ipsec.<br>
> > > I now see the following when I try to connect:<br>
><br>
> > > Nov 30 00:29:27 ip-172-31-25-2 charon: 01[CFG] looking for peer configs matching 172.31.25.2[%any]...76.126.165.62[app]<br>
> > > Nov 30 00:29:27 ip-172-31-25-2 charon: 01[CFG] selected peer config 'vpn'<br>
> > > Nov 30 00:29:27 ip-172-31-25-2 charon: 01[IKE] using configured EAP-Identity app<br>
> > > Nov 30 00:29:27 ip-172-31-25-2 charon: 01[IKE] initiating EAP_MSCHAPV2 method (id 0xBE)<br>
> > > Nov 30 00:29:27 ip-172-31-25-2 charon: 01[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding<br>
> > > Nov 30 00:29:27 ip-172-31-25-2 charon: 01[IKE] peer supports MOBIKE<br>
> > > Nov 30 00:29:27 ip-172-31-25-2 charon: 01[CFG] no IDr configured, fall back on IP address<br>
> > > Nov 30 00:29:27 ip-172-31-25-2 charon: 01[IKE] no private key found for '172.31.25.2'<br>
> > > Nov 30 00:29:27 ip-172-31-25-2 charon: 01[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>
><br>
> > > It seems like I need to tell it to use the username/password, instead of looking for a key... or is a certificate mandatory for all EAP configurations, even using a username/password?<br>
><br>
> > > regards,<br>
> > > imran<br>
><br>
</div></div><span>> > > On Sat, Nov 29, 2014 at 4:03 PM, Noel Kuntze <<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>>> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>>>>> wrote:<br>
><br>
><br>
> > > Hello Imran,<br>
><br>
> > > You need to specify rightauth2=eap-mschapv2, so strongSwan is configured correctly to accept<br>
> > > eap authentication using mschapv2 in round 2.<br>
><br>
> > > You also lack the eap-mschapv2 modules, that you need for eap-mschapv2.<br>
> > > Install it via your package manager or, if you built strongSwan yourself, configure the strongSwan sources with --enable-eap-mschapv2,<br>
> > > "make uninstall" "make clean" "make" and "make install".<br>
><br>
> > > Also, please make sure you send your answer to all parties involved, not just me.<br>
><br>
> > > Mit freundlichen Grüßen/Regards,<br>
> > > Noel Kuntze<br>
><br>
> > > GPG Key ID: 0x63EC6658<br>
> > > Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
><br>
> > > Am 30.11.2014 um 00:54 schrieb Imran Akbar:<br>
> > > > Hey Noel and Thomas,<br>
><br>
> > > > thanks for your help.<br>
> > > > I've made some progress - I'm now getting an "AUTH FAILED" error from my client.<br>
> > > > I'm trying to connect via the StrongSwan client on Android using IKEv2 EAP (username/password).<br>
><br>
> > > > Here is my ipsec.conf: <a href="http://pastebin.com/Ap5gUX0f" target="_blank">http://pastebin.com/Ap5gUX0f</a><br>
><br>
> > > > Here is my secrets.conf: <a href="http://pastebin.com/hhX9micY" target="_blank">http://pastebin.com/hhX9micY</a><br>
><br>
> > > > Here is my server log: <a href="http://pastebin.com/W99PPKt3" target="_blank">http://pastebin.com/W99PPKt3</a> (looks like the key issue is "peer requested EAP, config inacceptable")<br>
><br>
> > > > Here is my client log: <a href="http://pastebin.com/2w9NS1Zs" target="_blank">http://pastebin.com/2w9NS1Zs</a><br>
><br>
> > > > I'm going to keep tweaking the authentication configs to see if I can make it work.<br>
><br>
> > > > yours,<br>
> > > > imran<br>
><br>
><br>
</span><div><div>> > > > On Sat, Nov 29, 2014 at 9:04 AM, Noel Kuntze <<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>>> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>>>> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>>> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>>>>>> wrote:<br>
><br>
><br>
> > > > Hello Imran,<br>
><br>
> > > > IPsec/L2TP is mostly used with IKEv1, not IKEv2. Please tell us what clients you're trying to use,<br>
> > > > to make sure they try to use IKEv2, too.<br>
><br>
> > > > L2TP is not handled by strongSwan. You need to use xl2tp for that. Most clients try to use transport mode<br>
> > > > for the IPsec connection. Make sure your peer configuration has that specified. Also, plese make strongSwan<br>
> > > > write a log [1] with the settings shown in [2], show us the log that was created and show us your ipsec.conf.<br>
><br>
> > > > [1] <a href="https://wiki.strongswan.org/projects/strongswan/wiki/LoggerConfiguration" target="_blank">https://wiki.strongswan.org/projects/strongswan/wiki/LoggerConfiguration</a><br>
><br>
> > > > [2]<br>
> > > > default = 3<br>
> > > > mgr = 1<br>
> > > > ike = 1<br>
> > > > net = 1<br>
> > > > enc = 0<br>
> > > > cfg = 2<br>
> > > > asn = 1<br>
> > > > job = 1<br>
> > > > knl = 1<br>
> > > > append=no<br>
> > > > ike_name=no<br>
> > > > flush_line=yes<br>
><br>
><br>
> > > > Mit freundlichen Grüßen/Regards,<br>
> > > > Noel Kuntze<br>
><br>
> > > > GPG Key ID: 0x63EC6658<br>
> > > > Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
><br>
> > > > Am 29.11.2014 um 17:53 schrieb Imran Akbar:<br>
> > > > > Hi everyone,<br>
> > > > > thanks for such a well-developed and maintained library.<br>
><br>
> > > > > I'm trying to setup Ipsec/L2TP on my Ubuntu 14 server with IKEv2 and a PSK.<br>
><br>
> > > > > I've read through a bunch of tutorials online:<br>
> > > > > <a href="http://trick77.com/2014/05/04/strongswan-5-vpn-ubuntu-14-04-lts-psk-xauth/" target="_blank">http://trick77.com/2014/05/04/strongswan-5-vpn-ubuntu-14-04-lts-psk-xauth/</a><br>
> > > > > <a href="http://www.foteviken.de/?p=2175" target="_blank">http://www.foteviken.de/?p=2175</a><br>
> > > > > <a href="http://endlessroad1991.blogspot.com/2014/04/setup-ipsec-vpn-on-ec2.html" target="_blank">http://endlessroad1991.blogspot.com/2014/04/setup-ipsec-vpn-on-ec2.html</a><br>
><br>
> > > > > and I've opened up UDP ports 500 & 4500, but I still have clients complaining about gateway timeouts and not being able to connect to the VPN.<br>
><br>
> > > > > Is there some sort of a configuration script that can walk you through all the necessary steps to get this working, or a gist that someone could share of their config?<br>
> > > > > I don't see anything in my /var/log/auth.conf that's indicative of VPN traffic.<br>
><br>
> > > > > yours,<br>
> > > > > imran<br>
><br>
><br>
> > > > > _______________________________________________<br>
> > > > > Users mailing list<br>
</div></div>> > > > > <a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>>>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>>>>><br>
<span>> > > > > <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
><br>
><br>
><br>
> > > > _______________________________________________<br>
> > > > Users mailing list<br>
</span>> > > > <a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>>>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>>>>><br>
<span>> > > > <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2<br>
<br>
</span>iQIcBAEBCAAGBQJUe4q3AAoJEDg5KY9j7GZYLegP/iLQwOkSohCgavmb86tucBe0<br>
dznDUF9RAlfnnwQSjxaYLEMYOHpDKjzpQcXbvvPydmCF6UsY30w4k271ZrfyE8e0<br>
H3Xp4r6aXJ+WZLzQXqxsjznp/rBzDyApZ9IR1kIKssqsA2cA0Um+C8CAE+VGxIwv<br>
k39SBDlbv7QTv9B8Ak2+42zmgMdAPyxWiBe1qvULenYtA0NVutPqcK3o8j1pyWA+<br>
8MXQlGqFIDwflCoAR5hs0XMegHT86ALXPL70bLDu5PaT211esHGCB6BGUGnp2lWS<br>
7wCMnoD170/J+xSU/fi5xpRhbsy7acT5DwLWQrwo9p+NXWvCBEjvsjHRpXR/EYdu<br>
5PkXyjUJAiG0alrCW2ppZCD6l/TCjwusq9qvLrhA4uDbdYifYO+ZUMOtl62F5K7U<br>
9xn+3UfsnrohFaVDey+dOd49yusnhjQL6AL1UsoUHQQP0diFnCA9D4nVIbE0aGYx<br>
uJW+j/yqDvYBPi0hF1N0W+V+o08vM/3Cymz6Rx4rWCQ6RJ/6uo7mD6rn1/YCWbXW<br>
VyWl9cM2ckWgraETwy2VXj6fWWVNEevLI0WLLiOW9HboiZbYfTSUkYweBIfYJ/2R<br>
C0fZS02dn1sdBm5BLd1TIwik8X4wCmq7yFW//w7Sb+gyBoRAaiUkyYAB6Ej63pHR<br>
1sdzXK6XJTFf9auBROqu<br>
=BmbJ<br>
-----END PGP SIGNATURE-----<br>
<br>
</blockquote></div><br></div></div></div></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>