<html>
<head>
<meta name="generator" content="Windows Mail 17.5.9600.20856">
<style data-externalstyle="true"><!--
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
}
p.MsoNormal, li.MsoNormal, div.MsoNormal {
margin:0in;
margin-bottom:.0001pt;
}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst,
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle,
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
line-height:115%;
}
--></style></head>
<body dir="ltr">
<div data-externalstyle="false" dir="ltr" style="font-family: 'Calibri', 'Segoe UI', 'Meiryo', 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'sans-serif';font-size:12pt;"><div>I installed strongswan 5.1.2 on Ubuntu server 14.04 using ‘apt-get install strongswan’. I configured strongswan using the instruction provided at <a href="https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-your-own-vpn/." target="_parent">https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-your-own-vpn/.<br><br></a>When I connect from my Windows Phone 8.1 using EAP, I get ‘loading EAP_MSCHAPV2 method failed’ (see line#95 below) and the phone also reports authentication failure.<br><br><strong>tail -100 /var/log/syslog:</strong></div><div>=====================================================================================</div><div>=====================================================================================</div><div>=====================================================================================<br>May 10 03:46:58 vpns charon: 14[CFG] selecting proposal:<br>May 10 03:46:58 vpns charon: 14[CFG] no acceptable PSEUDO_RANDOM_FUNCTION found<br>May 10 03:46:58 vpns charon: 14[CFG] selecting proposal:<br>May 10 03:46:58 vpns charon: 14[CFG] no acceptable ENCRYPTION_ALGORITHM found<br>May 10 03:46:58 vpns charon: 14[CFG] selecting proposal:<br>May 10 03:46:58 vpns charon: 14[CFG] no acceptable DIFFIE_HELLMAN_GROUP found<br>May 10 03:46:58 vpns charon: 14[CFG] selecting proposal:<br>May 10 03:46:58 vpns charon: 14[CFG] no acceptable ENCRYPTION_ALGORITHM found<br>May 10 03:46:58 vpns charon: 14[CFG] selecting proposal:<br>May 10 03:46:58 vpns charon: 14[CFG] no acceptable PSEUDO_RANDOM_FUNCTION found<br>May 10 03:46:58 vpns charon: 14[CFG] selecting proposal:<br>May 10 03:46:58 vpns charon: 14[CFG] no acceptable ENCRYPTION_ALGORITHM found<br>May 10 03:46:58 vpns charon: 14[CFG] selecting proposal:<br>May 10 03:46:58 vpns charon: 14[CFG] no acceptable PSEUDO_RANDOM_FUNCTION found<br>May 10 03:46:58 vpns charon: 14[CFG] selecting proposal:<br>May 10 03:46:58 vpns charon: 14[CFG] no acceptable ENCRYPTION_ALGORITHM found<br>May 10 03:46:58 vpns charon: 14[CFG] selecting proposal:<br>May 10 03:46:58 vpns charon: 14[CFG] no acceptable PSEUDO_RANDOM_FUNCTION found<br>May 10 03:46:58 vpns charon: 14[CFG] selecting proposal:<br>May 10 03:46:58 vpns charon: 14[CFG] no acceptable ENCRYPTION_ALGORITHM found<br>May 10 03:46:58 vpns charon: 14[CFG] selecting proposal:<br>May 10 03:46:58 vpns charon: 14[CFG] no acceptable PSEUDO_RANDOM_FUNCTION found<br>May 10 03:46:58 vpns charon: 14[CFG] selecting proposal:<br>May 10 03:46:58 vpns charon: 14[CFG] no acceptable ENCRYPTION_ALGORITHM found<br>May 10 03:46:58 vpns charon: 14[CFG] selecting proposal:<br>May 10 03:46:58 vpns charon: 14[CFG] proposal matches<br>May 10 03:46:58 vpns charon: 14[CFG] received proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:3DES_CBC/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024<br>May 10 03:46:58 vpns charon: 14[CFG] configured proposals: IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256, IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/ECP_384, IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_4096, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_4096, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_4096, IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536, IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_2048, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1536, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536, IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br>May 10 03:46:58 vpns charon: 14[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024<br>May 10 03:46:58 vpns charon: 14[IKE] sending cert request for "C=CH, O=strongSwan, CN=strongSwan Root CA"<br>May 10 03:46:58 vpns charon: 14[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]<br>May 10 03:46:58 vpns charon: 14[NET] sending packet: from 10.120.237.34[500] to 10.110.7.240[500] (337 bytes)<br>May 10 03:46:58 vpns charon: 10[NET] sending packet: from 10.120.237.34[500] to 10.110.7.240[500]<br>May 10 03:46:58 vpns charon: 09[NET] received packet: from 10.110.7.240[4500] to 10.120.237.34[4500]<br>May 10 03:46:58 vpns charon: 09[NET] waiting for data on sockets<br>May 10 03:46:58 vpns charon: 16[NET] received packet: from 10.110.7.240[4500] to 10.120.237.34[4500] (968 bytes)<br>May 10 03:46:58 vpns charon: 16[ENC] parsed IKE_AUTH request 1 [ IDi CERTREQ N(MOBIKE_SUP) CPRQ(ADDR DNS NBNS SRV ADDR6 DNS6 SRV6) SA TSi TSr ]<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 0e:ac:82:60:40:56:27:97:e5:25:13:fc:2a:e1:0a:53:95:59:e4:a4<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid dd:bc:bd:86:9c:3f:07:ed:40:e3:1b:08:ef:ce:c4:d1:88:cd:3b:15<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for "C=CH, O=strongSwan, CN=strongSwan Root CA"<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 4a:5c:75:22:aa:46:bf:a4:08:9d:39:97:4e:bd:b4:a3:60:f7:a0:1d<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 5c:b8:69:fe:8d:ef:c1:ed:66:27:ee:b2:12:0f:72:1b:b8:0a:0e:04<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 6a:47:a2:67:c9:2e:2f:19:68:8b:9b:86:61:66:95:ed:c1:2c:13:00<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 01:f0:33:4c:1a:a1:d9:ee:5b:7b:a9:de:43:bc:02:7d:57:09:33:fb<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 88:a9:5a:ef:c0:84:fc:13:74:41:6b:b1:63:32:c2:cf:92:59:bb:3b<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 22:cd:37:f1:b1:47:50:ae:53:7c:8c:6a:03:67:47:e2:b7:1e:17:b7<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 34:4f:30:2d:25:69:31:91:ea:f7:73:5c:ab:f5:86:8d:37:82:40:ec<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 3e:df:29:0c:c1:f5:cc:73:2c:eb:3d:24:e1:7e:52:da:bd:27:e2:f0<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid c0:7a:98:68:8d:89:fb:ab:05:64:0c:11:7d:aa:7d:65:b8:ca:cc:4e<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 30:a4:e6:4f:de:76:8a:fc:ed:5a:90:84:28:30:46:79:2c:29:15:70<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 48:e6:68:f9:2b:d2:b2:95:d7:47:d8:23:20:10:4f:33:98:90:9f:d4<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 87:db:d4:5f:b0:92:8d:4e:1d:f8:15:67:e7:f2:ab:af:d6:2b:67:75<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 4a:81:0c:de:f0:c0:90:0f:19:06:42:31:35:a2:a2:8d:d3:44:fd:08<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid d5:2e:13:c1:ab:e3:49:da:e8:b4:95:94:ef:7c:38:43:60:64:66:bd<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 59:79:12:de:61:75:d6:6f:c4:23:b7:77:13:74:c7:96:de:6f:88:72<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 6c:ca:bd:7d:b4:7e:94:a5:75:99:01:b6:a7:df:d4:5d:1c:09:1c:cc<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid e2:7f:7b:d8:77:d5:df:9e:0a:3f:9e:b4:cb:0e:2e:a9:ef:db:69:77<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 48:2b:59:17:75:e2:61:7b:ef:c7:20:d3:7a:9c:ec:be:36:9e:84:e3<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 5f:f3:24:6c:8f:91:24:af:9b:5f:3e:b0:34:6a:f4:2d:5c:a8:5d:cc<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 83:31:7e:62:85:42:53:d6:d7:78:31:90:ec:91:90:56:e9:91:b9:e3<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 53:32:d1:b3:cf:7f:fa:e0:f1:a0:5d:85:4e:92:d2:9e:45:1d:b4:4f<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 55:e4:81:d1:11:80:be:d8:89:b9:08:a3:31:f9:a1:24:09:16:b9:70<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid b1:81:08:1a:19:a4:c0:94:1f:fa:e8:95:28:c1:24:c9:9b:34:ac:c7<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 21:0f:2c:89:f7:c4:cd:5d:1b:82:5e:38:d6:c6:59:3b:a6:93:75:ae<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 23:4b:71:25:56:13:e1:30:dd:e3:42:69:c9:cc:30:d4:6f:08:41:e0<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 7c:d3:95:1f:f4:48:1b:32:cf:6b:e3:55:43:03:6d:0b:45:7d:72:26<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid ee:e5:9f:1e:2a:a5:44:c3:cb:25:43:a6:9a:5b:d4:6a:25:bc:bb:8e<br>May 10 03:46:58 vpns charon: 16[IKE] received cert request for unknown ca with keyid 4f:9c:7d:21:79:9c:ad:0e:d8:b9:0c:57:9f:1a:02:99:e7:90:f3:87<br>May 10 03:46:58 vpns charon: 16[IKE] received 30 cert requests for an unknown ca<br>May 10 03:46:58 vpns charon: 16[CFG] looking for peer configs matching 10.120.237.34[%any]...10.110.7.240[10.110.7.240]<br>May 10 03:46:58 vpns charon: 16[CFG] candidate "IPSec-IKEv2", match: 1/1/28 (me/other/ike)<br>May 10 03:46:58 vpns charon: 16[CFG] candidate "IPSec-IKEv2-EAP", match: 1/1/28 (me/other/ike)<br>May 10 03:46:58 vpns charon: 16[CFG] selected peer config 'IPSec-IKEv2'<br>May 10 03:46:58 vpns charon: 16[IKE] peer requested EAP, config inacceptable<br>May 10 03:46:58 vpns charon: 16[CFG] switching to peer config 'IPSec-IKEv2-EAP'<br>May 10 03:46:58 vpns charon: 16[IKE] initiating EAP_IDENTITY method (id 0x00)<br>May 10 03:46:58 vpns charon: 16[IKE] processing INTERNAL_IP4_ADDRESS attribute<br>May 10 03:46:58 vpns charon: 16[IKE] processing INTERNAL_IP4_DNS attribute<br>May 10 03:46:58 vpns charon: 16[IKE] processing INTERNAL_IP4_NBNS attribute<br>May 10 03:46:58 vpns charon: 16[IKE] processing INTERNAL_IP4_SERVER attribute<br>May 10 03:46:58 vpns charon: 16[IKE] processing INTERNAL_IP6_ADDRESS attribute<br>May 10 03:46:58 vpns charon: 16[IKE] processing INTERNAL_IP6_DNS attribute<br>May 10 03:46:58 vpns charon: 16[IKE] processing INTERNAL_IP6_SERVER attribute<br>May 10 03:46:58 vpns charon: 16[IKE] peer supports MOBIKE<br>May 10 03:46:58 vpns charon: 16[IKE] authentication of 'C=CH, O=strongSwan, CN=10.120.237.34' (myself) with RSA signature successful<br>May 10 03:46:58 vpns charon: 16[IKE] sending end entity cert "C=CH, O=strongSwan, CN=10.120.237.34"<br>May 10 03:46:58 vpns charon: 16[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]<br>May 10 03:46:58 vpns charon: 16[NET] sending packet: from 10.120.237.34[4500] to 10.110.7.240[4500] (1544 bytes)<br>May 10 03:46:58 vpns charon: 10[NET] sending packet: from 10.120.237.34[4500] to 10.110.7.240[4500]<br>May 10 03:46:58 vpns charon: 09[NET] received packet: from 10.110.7.240[4500] to 10.120.237.34[4500]<br>May 10 03:46:58 vpns charon: 09[NET] waiting for data on sockets<br>May 10 03:46:58 vpns charon: 11[NET] received packet: from 10.110.7.240[4500] to 10.120.237.34[4500] (104 bytes)<br>May 10 03:46:58 vpns charon: 11[ENC] parsed IKE_AUTH request 2 [ EAP/RES/ID ]<br>May 10 03:46:58 vpns charon: 11[IKE] received EAP identity 'Windows Phone\me'<br><strong>May 10 03:46:58 vpns charon: 11[IKE]</strong> <strong>loading EAP_MSCHAPV2 method failed</strong><br>May 10 03:46:58 vpns charon: 11[ENC] generating IKE_AUTH response 2 [ EAP/FAIL ]<br>May 10 03:46:58 vpns charon: 11[NET] sending packet: from 10.120.237.34[4500] to 10.110.7.240[4500] (88 bytes)<br>May 10 03:46:58 vpns charon: 11[IKE] IKE_SA IPSec-IKEv2-EAP[4] state change: CONNECTING => DESTROYING<br>May 10 03:46:58 vpns charon: 10[NET] sending packet: from 10.120.237.34[4500] to 10.110.7.240[4500]<br></div><div><br></div><div><div>=====================================================================================</div><div>=====================================================================================</div><div>=====================================================================================</div><div><br></div><div><strong>cat /etc/IPsec.conf:</strong></div><div><div>=====================================================================================</div><div>=====================================================================================</div><div>=====================================================================================</div><div># ipsec.conf - strongSwan IPsec configuration file</div><div><br></div><div>config setup<br> # uniqueids=never<br> charondebug="cfg 2, dmn 2, ike 2, net 2"</div><div><br></div><div>conn %default<br> keyexchange=ikev2<br> ike=aes128-sha256-ecp256,aes256-sha384-ecp384,aes128-sha256-modp2048,aes128-sha1-modp2048,aes256-sha384-modp4096,aes256-sha256-modp4096,aes256-sha1-modp4096,aes128-sha256-modp1536,aes128-sha1-modp1536,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha384-modp1536,aes256-sha256-modp1536,aes256-sha1-modp1536,aes256-sha384-modp1024,aes256-sha256-modp1024,aes256-sha1-modp1024!<br> esp=aes128gcm16-ecp256,aes256gcm16-ecp384,aes128-sha256-ecp256,aes256-sha384-ecp384,aes128-sha256-modp2048,aes128-sha1-modp2048,aes256-sha384-modp4096,aes256-sha256-modp4096,aes256-sha1-modp4096,aes128-sha256-modp1536,aes128-sha1-modp1536,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha384-modp1536,aes256-sha256-modp1536,aes256-sha1-modp1536,aes256-sha384-modp1024,aes256-sha256-modp1024,aes256-sha1-modp1024,aes128gcm16,aes256gcm16,aes128-sha256,aes128-sha1,aes256-sha384,aes256-sha256,aes256-sha1!<br> dpdaction=clear<br> dpddelay=300s<br> rekey=no<br> left=%any<br> leftsubnet=0.0.0.0/0<br> leftcert=vpnHostCert2.pem<br> right=%any<br> rightdns=8.8.8.8,8.8.4.4<br> rightsourceip=172.16.16.0/24</div><div><br></div><div>conn IPSec-IKEv2<br> keyexchange=ikev2<br> auto=add</div><div><br></div><div>conn IPSec-IKEv2-EAP<br> also="IPSec-IKEv2"<br> rightauth=eap-mschapv2<br> rightsendcert=never<br> eap_identity=%any</div><div><br></div><div>conn CiscoIPSec<br> keyexchange=ikev1<br> # forceencaps=yes<br> rightauth=pubkey<br> rightauth2=xauth<br> auto=add</div><div>=====================================================================================</div><div><div>=====================================================================================</div><div>=====================================================================================</div><div><br></div><div><strong>cat /etc/strongswan.conf:</strong></div><div><br></div><div><div>=====================================================================================</div><div>=====================================================================================</div><div>=====================================================================================</div><div># strongswan.conf - strongSwan configuration file<br>#<br># Refer to the strongswan.conf(5) manpage for details<br>#<br># Configuration changes should be made in the included files</div><div><br></div><div>charon {<br> load_modular = yes<br> plugins {<br> include strongswan.d/charon/*.conf<br> }<br>}</div><div><br></div><div>include strongswan.d/*.conf<br></div><div><div>=====================================================================================</div><div>=====================================================================================</div><div>=====================================================================================</div></div></div></div></div><br><br></div><div data-signatureblock="true"><div><br></div><div>Sent from Windows Mail</div><div><br></div></div></div>
</body>
</html>