<div dir="ltr">Dear Noel,<div> I have made progress with this issue.</div><div> Issue was the Assigned Name in the certifcate. I have set it to the gateway IP, generated the certifcaets and re-installed the certificates on the UE and server side.</div><div> </div><div> I refered to the following link to solve this issue: <a href="http://marc.info/?t=134837490100004&r=1&w=2">http://marc.info/?t=134837490100004&r=1&w=2</a></div><div><br></div><div> Now my strongswan Android App is connnected to my gateway.</div><div><br></div><div>Thanks much for your quick support.</div><div><br></div><div>Regards,</div><div>Ravikanth</div><div><br></div><div> </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Dec 22, 2014 at 2:12 PM, Ravi Kanth Vanapalli <span dir="ltr"><<a href="mailto:vvnrk.vanapalli@gmail.com" target="_blank">vvnrk.vanapalli@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>Dear Noel,<br></div> I was able to make some progress after setting the leftauth to pubkey.<br><br></div><div> I generated the certificates using the procedure outlined in the link.<br></div><div> Now I am running into the issue where gateway sends the last IKE_AUTH message with IP address. Then UE sends back AUTH failed. On looking into charon.log, there was an error like <br><br>Dec 22 14:02:52 12[CFG] constraint check failed: identity '192.168.43.185' required <br>Dec 22 14:02:52 12[CFG] selected peer config 'android' inacceptable: constraint checking failed<br><br></div><div>Here is the print of daemon log (/var/log/syslog)on the strongswan server side<br>---------------------------------------------------------------------------------------------------------------<br><br><br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 14[NET] received packet: from 192.168.43.94[54252] to 192.168.43.185[500]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 14[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N((16430)) ]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 14[IKE] 192.168.43.94 is initiating an IKE_SA<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 14[IKE] remote host is behind NAT<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 14[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 14[NET] sending packet: from 192.168.43.185[500] to 192.168.43.94[54252]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 15[NET] received packet: from 192.168.43.94[46301] to 192.168.43.185[4500]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 15[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ CP(ADDR ADDR6 DNS DNS6) N(ESP_TFC_PAD_N) SA TSi TSr N(MOBIKE_SUP) N(ADD_6_ADDR) N(ADD_6_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 15[IKE] received cert request for "C=CH, O=strongSwan, CN=strongSwan Root CA"<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 15[CFG] looking for peer configs matching 192.168.43.185[%any]...192.168.43.94[user1]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 15[CFG] selected peer config 'ssandroid'<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 15[IKE] initiating EAP-Identity request<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 15[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 15[IKE] peer supports MOBIKE<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 15[IKE] authentication of 'C=CH, O=strongSwan, CN=strongSwan Root CA' (myself) with RSA signature successful<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 15[IKE] sending end entity cert "C=CH, O=strongSwan, CN=strongSwan Root CA"<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 15[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 15[NET] sending packet: from 192.168.43.185[4500] to 192.168.43.94[46301]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 09[NET] received packet: from 192.168.43.94[46301] to 192.168.43.185[4500]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 09[ENC] parsed IKE_AUTH request 2 [ EAP/RES/ID ]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 09[IKE] received EAP identity 'user1'<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 09[IKE] initiating EAP_MSCHAPV2 method (id 0x87)<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 09[ENC] generating IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 09[NET] sending packet: from 192.168.43.185[4500] to 192.168.43.94[46301]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 10[NET] received packet: from 192.168.43.94[46301] to 192.168.43.185[4500]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 10[ENC] parsed IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 10[ENC] generating IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 10[NET] sending packet: from 192.168.43.185[4500] to 192.168.43.94[46301]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 11[NET] received packet: from 192.168.43.94[46301] to 192.168.43.185[4500]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 11[ENC] parsed IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 11[IKE] EAP method EAP_MSCHAPV2 succeeded, MSK established<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 11[ENC] generating IKE_AUTH response 4 [ EAP/SUCC ]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 11[NET] sending packet: from 192.168.43.185[4500] to 192.168.43.94[46301]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 13[NET] received packet: from 192.168.43.94[46301] to 192.168.43.185[4500]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 13[ENC] parsed IKE_AUTH request 5 [ AUTH ]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 13[IKE] authentication of 'user1' with EAP successful<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 13[IKE] authentication of 'C=CH, O=strongSwan, CN=strongSwan Root CA' (myself) with EAP<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 13[IKE] IKE_SA ssandroid[2] established between 192.168.43.185[C=CH, O=strongSwan, CN=strongSwan Root CA]...192.168.43.94[user1]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 13[IKE] scheduling reauthentication in 3250s<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 13[IKE] maximum IKE_SA lifetime 3430s<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 13[IKE] peer requested virtual IP %any6<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 13[CFG] assigning new lease to 'user1'<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 13[IKE] assigning virtual IP 10.0.0.3 to peer 'user1'<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 13[IKE] CHILD_SA ssandroid{1} established with SPIs c04897ea_i 87a8ff7a_o and TS <a href="http://192.168.43.185/32" target="_blank">192.168.43.185/32</a> === <a href="http://10.0.0.3/32" target="_blank">10.0.0.3/32</a> <br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 13[ENC] generating IKE_AUTH response 5 [ AUTH CP(ADDR) SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_6_ADDR) N(ADD_6_ADDR) ]<br>Dec 22 14:02:54 samsung-600B4B-600B5B charon: 13[NET] sending packet: from 192.168.43.185[4500] to 192.168.43.94[46301]<br>Dec 22 14:02:55 samsung-600B4B-600B5B charon: 01[NET] received packet: from 192.168.43.94[46301] to 192.168.43.185[4500]<br>Dec 22 14:02:55 samsung-600B4B-600B5B charon: 01[ENC] parsed INFORMATIONAL request 6 [ N(AUTH_FAILED) ]<br>Dec 22 14:02:55 samsung-600B4B-600B5B charon: 01[ENC] generating INFORMATIONAL response 6 [ ]<br>Dec 22 14:02:55 samsung-600B4B-600B5B charon: 01[NET] sending packet: from 192.168.43.185[4500] to 192.168.43.94[46301]<br><br><br></div><div>ipsec.conf file looks like below<br>-----------------------------------------------<br>conn ssandroid<br> left=192.168.43.185<br> leftfirewall=no<br> right=%any<br> rightsourceip = <a href="http://10.0.0.2/24" target="_blank">10.0.0.2/24</a><br> rightauth=eap-mschapv2<br> rightsendcert=never<br> eap_identity=%any<br> auto=start<br> leftcert=ServerCert.pem<br> leftauth=pubkey<br><br></div><div>ipsec.secrets file looks like below<br>------------------------------------<br>include /var/lib/strongswan/ipsec.secrets.inc<br><br>: RSA ServerPrivKey.pem<br><br>user1 : EAP "topsecretpassword"<br><br></div><div>On the charon.log on the Android client side here is the error<br>----------------------------------------------------------------------------------------<br><br></div><div>Note: <br></div><div><br>Dec 22 14:02:52 16[ENC] parsed IKE_AUTH response 4 [ EAP/SUCC ]<br>Dec 22 14:02:52 16[IKE] EAP method EAP_MSCHAPV2 succeeded, MSK established<br>Dec 22 14:02:52 16[IKE] authentication of 'user1' (myself) with EAP<br>Dec 22 14:02:52 16[ENC] generating IKE_AUTH request 5 [ AUTH ]<br>Dec 22 14:02:52 16[NET] sending packet: from 192.168.43.94[46301] to 192.168.43.185[4500] (92 bytes)<br>Dec 22 14:02:52 12[NET] received packet: from 192.168.43.185[4500] to 192.168.43.94[46301] (268 bytes)<br>Dec 22 14:02:52 12[ENC] parsed IKE_AUTH response 5 [ AUTH CPRP(ADDR) SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_6_ADDR) N(ADD_6_ADDR) ]<br>Dec 22 14:02:52 12[IKE] authentication of 'C=CH, O=strongSwan, CN=strongSwan Root CA' with EAP successful<br>Dec 22 14:02:52 12[CFG] constraint check failed: identity '192.168.43.185' required <br>Dec 22 14:02:52 12[CFG] selected peer config 'android' inacceptable: constraint checking failed<br>Dec 22 14:02:52 12[CFG] no alternative config found<br>Dec 22 14:02:52 12[ENC] generating INFORMATIONAL request 6 [ N(AUTH_FAILED) ]<br>Dec 22 14:02:52 12[NET] sending packet: from 192.168.43.94[46301] to 192.168.43.185[4500] (76 bytes)<br><br></div><div><br></div><div>Please let me know the issue here. Is something wrong with the certificates created. <br>I have attached the complete charon.log file to this email.<br><br></div><div>Thanks,<br>Ravikanth<br></div><div><br></div><div class="gmail_extra"><br></div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><font color="#666666">Regards,</font></div>
<div><br><font color="#666666">RaviKanth VN Vanapalli</font></div><div><font color="#666666">Ph: (469) 999 7567</font></div>
<div><font color="#666666">Email: </font><a href="mailto:vvnrk.vanapalli@gmail.com" target="_blank"><font color="#666666">vvnrk.vanapalli@gmail.com</font></a></div></div></div>
</div>