<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Microsoft Theme 2.00" content="Iris 010">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:Webdings;
panose-1:5 3 1 2 1 5 9 6 7 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Verdana",sans-serif;
color:black;
mso-fareast-language:EN-US;}
h1
{mso-style-priority:9;
mso-style-link:"Heading 1 Char";
margin-top:12.0pt;
margin-right:0cm;
margin-bottom:0cm;
margin-left:0cm;
margin-bottom:.0001pt;
page-break-after:avoid;
font-size:16.0pt;
font-family:"Verdana",sans-serif;
color:black;
mso-fareast-language:EN-US;}
h2
{mso-style-priority:9;
mso-style-link:"Heading 2 Char";
margin-top:2.0pt;
margin-right:0cm;
margin-bottom:0cm;
margin-left:0cm;
margin-bottom:.0001pt;
page-break-after:avoid;
font-size:14.0pt;
font-family:"Verdana",sans-serif;
color:black;
mso-fareast-language:EN-US;
font-weight:normal;}
h3
{mso-style-priority:9;
mso-style-link:"Heading 3 Char";
margin-top:2.0pt;
margin-right:0cm;
margin-bottom:0cm;
margin-left:0cm;
margin-bottom:.0001pt;
page-break-after:avoid;
font-size:13.0pt;
font-family:"Verdana",sans-serif;
color:black;
mso-fareast-language:EN-US;
font-weight:normal;}
h4
{mso-style-priority:9;
mso-style-link:"Heading 4 Char";
margin-top:2.0pt;
margin-right:0cm;
margin-bottom:0cm;
margin-left:0cm;
margin-bottom:.0001pt;
page-break-after:avoid;
font-size:14.0pt;
font-family:"Verdana",sans-serif;
color:black;
mso-fareast-language:EN-US;
font-weight:normal;}
h5
{mso-style-priority:9;
mso-style-link:"Heading 5 Char";
margin-top:2.0pt;
margin-right:0cm;
margin-bottom:0cm;
margin-left:0cm;
margin-bottom:.0001pt;
page-break-after:avoid;
font-size:13.0pt;
font-family:"Verdana",sans-serif;
color:black;
mso-fareast-language:EN-US;
font-weight:normal;}
h6
{mso-style-priority:9;
mso-style-link:"Heading 6 Char";
margin-top:2.0pt;
margin-right:0cm;
margin-bottom:0cm;
margin-left:0cm;
margin-bottom:.0001pt;
page-break-after:avoid;
font-size:11.0pt;
font-family:"Verdana",sans-serif;
color:black;
mso-fareast-language:EN-US;
font-weight:normal;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#8634C6;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#731202;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.Heading1Char
{mso-style-name:"Heading 1 Char";
mso-style-priority:9;
mso-style-link:"Heading 1";
font-family:"Verdana",sans-serif;
color:black;
font-weight:bold;}
span.Heading2Char
{mso-style-name:"Heading 2 Char";
mso-style-priority:9;
mso-style-link:"Heading 2";
font-family:"Verdana",sans-serif;
color:black;}
span.Heading3Char
{mso-style-name:"Heading 3 Char";
mso-style-priority:9;
mso-style-link:"Heading 3";
font-family:"Verdana",sans-serif;
color:black;}
span.Heading4Char
{mso-style-name:"Heading 4 Char";
mso-style-priority:9;
mso-style-link:"Heading 4";
font-family:"Verdana",sans-serif;
color:black;}
span.Heading5Char
{mso-style-name:"Heading 5 Char";
mso-style-priority:9;
mso-style-link:"Heading 5";
font-family:"Verdana",sans-serif;
color:black;}
span.Heading6Char
{mso-style-name:"Heading 6 Char";
mso-style-priority:9;
mso-style-link:"Heading 6";
font-family:"Verdana",sans-serif;
color:black;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="NL" link="#8634C6" vlink="#731202">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">Hi all,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">We’re using Strongswan to connect to Amazon AWS. So far we’ve been using strongswan 4.6.2 to connect windows 7 / 8 clients using eap-mschapv2
with IkeV2 to the linux Strongswan server.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">Recently we’ve installed a new linux Strongswan server, and we’ve copied the installation to the new server. Of course we’ve created a new server
certificate for this new server.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">Unfortunately we’re not able to connect with any windows client to the server. The security assertion is created, but somehow the VPN connection
is not created, the windows clients (win 7 and win 8) report an 809 error.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">Any ideas what to do?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">Log:<o:p></o:p></span></b></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[DMN] Starting IKE charon daemon (strongSwan 5.3.0, Linux 3.14.42-31.38.amzn1.x86_64, x86_64)<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[LIB] openssl FIPS mode(0) - disabled
<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[CFG] loading crls from '/etc/ipsec.d/crls'<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[CFG] loading secrets from '/etc/ipsec.secrets'<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[CFG] loaded RSA private key from '/etc/ipsec.d/private/aws_gateway.key'<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[CFG] loaded RSA private key from '/etc/ipsec.d/private/aws_gateway_frankfurt.key'<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[CFG] loaded EAP secret for hanboo1<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[CFG] loaded EAP secret for marvel<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[CFG] loaded IKE secret for gateway.ph@globiq.com %any<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[CFG] loaded IKE secret for gateway.ph@globiq.com zywall_usg_20w_ph@globiq.com<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[LIB] loaded plugins: charon aes des rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1
pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp xcbc cmac hmac attr kernel-netlink resolve socket-default stroke updown eap-identity eap-mschapv2 eap-tls xauth-generic<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 00[JOB] spawning 16 worker threads<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 11[CFG] received stroke: add connection 'win7'<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 11[CFG] adding virtual IP address pool 10.100.0.0/24<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 11[CFG] loaded certificate "C=NL, ST=Utrecht, L=Amersfoort, O=Globiq BV, CN=<<full qualified host name>>" from
'aws_gateway_frankfurt.crt'<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:57:13 11[CFG] added configuration 'win7'<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 13[NET] <1> received packet: from 222.127.206.61[60052] to 10.10.0.125[500] (528 bytes)<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 13[ENC] <1> parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 13[IKE] <1> 222.127.206.61 is initiating an IKE_SA<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 13[IKE] <1> local host is behind NAT, sending keep alives<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 13[IKE] <1> remote host is behind NAT<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 13[ENC] <1> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 13[NET] <1> sending packet: from 10.10.0.125[500] to 222.127.206.61[60052] (312 bytes)<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 14[NET] <1> received packet: from 222.127.206.61[39239] to 10.10.0.125[4500] (1100 bytes)<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 14[ENC] <1> parsed IKE_AUTH request 1 [ IDi CERTREQ N(MOBIKE_SUP) CPRQ(ADDR DNS NBNS SRV ADDR6 DNS6 SRV6) SA TSi
TSr ]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 14[IKE] <1> received cert request for "C=NL, ST=Utrecht, L=Amersfoort, O=Globiq BV, CN=<<full qualified host name>>"<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 14[IKE] <1> received 37 cert requests for an unknown ca<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 14[CFG] <1> looking for peer configs matching 10.10.0.125[%any]...222.127.206.61[192.168.100.199]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 14[CFG] <win7|1> selected peer config 'win7'<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 14[IKE] <win7|1> initiating EAP_IDENTITY method (id 0x00)<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 14[IKE] <win7|1> peer supports MOBIKE<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 14[IKE] <win7|1> authentication of '<<full qualified host name>>' (myself) with RSA signature successful<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 14[IKE] <win7|1> sending end entity cert "C=NL, ST=Utrecht, L=Amersfoort, O=Globiq BV, CN=<<full qualified host
name>>"<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 14[ENC] <win7|1> generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:07 14[NET] <win7|1> sending packet: from 10.10.0.125[4500] to 222.127.206.61[39239] (1468 bytes)<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:08 15[NET] <win7|1> received packet: from 222.127.206.61[39239] to 10.10.0.125[4500] (1100 bytes)<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:08 15[ENC] <win7|1> parsed IKE_AUTH request 1 [ IDi CERTREQ N(MOBIKE_SUP) CPRQ(ADDR DNS NBNS SRV ADDR6 DNS6 SRV6)
SA TSi TSr ]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:08 15[IKE] <win7|1> received retransmit of request with ID 1, retransmitting response<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:08 15[NET] <win7|1> sending packet: from 10.10.0.125[4500] to 222.127.206.61[39239] (1468 bytes)<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:11 06[NET] <win7|1> received packet: from 222.127.206.61[39239] to 10.10.0.125[4500] (1100 bytes)<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:11 06[ENC] <win7|1> parsed IKE_AUTH request 1 [ IDi CERTREQ N(MOBIKE_SUP) CPRQ(ADDR DNS NBNS SRV ADDR6 DNS6 SRV6)
SA TSi TSr ]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:11 06[IKE] <win7|1> received retransmit of request with ID 1, retransmitting response<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:11 06[NET] <win7|1> sending packet: from 10.10.0.125[4500] to 222.127.206.61[39239] (1468 bytes)<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:27 16[IKE] <win7|1> sending keep alive to 222.127.206.61[39239]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">May 19 08:59:37 05[JOB] <win7|1> deleting half open IKE_SA after timeout</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">Ipsec.conf:<o:p></o:p></span></b></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">conn win7<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> keyexchange=ikev2<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> ike=aes256-sha1-modp1024!<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> esp=aes256-sha1!<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> dpdaction=clear<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> dpddelay=300s<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> rekey=no<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> # The "left" parameter is the gateway's private IP<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> left=10.10.0.125<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> # We are protecting the entire VPC, not just this subnet<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> leftsubnet=10.10.0.0/24,10.10.10.0/24,10.10.20.0/24,10.10.30.0/24<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> leftfirewall=yes<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> leftauth=pubkey<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> # both the dns name and the ip adress are stored in the machine certificates<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> # if the leftid doensn't match the dns name, windows vpn client will not<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> # open the VPN tunnel<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> leftcert=aws_gateway_frankfurt.crt<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> leftid=@<<full qualified host name>><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> right=%any<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> rightsourceip=10.100.0.0/24<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> rightauth=eap-mschapv2<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> # rightauth=eap-tls<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> rightsendcert=never<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> eap_identity=%any<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">
</span><span style="font-size:11.0pt;font-family:Consolas;color:windowtext">auto=add<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Consolas;color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">ipsec statusall:<o:p></o:p></span></b></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">Status of IKE charon daemon (strongSwan 5.3.0, Linux 3.14.42-31.38.amzn1.x86_64, x86_64):<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> uptime: 32 minutes, since May 19 08:57:13 2015<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> malloc: sbrk 1482752, mmap 0, used 350624, free 1132128<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 2<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> loaded plugins: charon aes des rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12
pgp dnskey sshkey pem openssl fips-prf gmp xcbc cmac hmac attr kernel-netlink resolve socket-default stroke updown eap-identity eap-mschapv2 eap-tls xauth-generic<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">Virtual IP pools (size/online/offline):<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> 10.100.0.0/24: 254/0/0<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">Listening IP addresses:<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> 10.10.0.125<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">Connections:<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> win7: 10.10.0.125...%any IKEv2, dpddelay=300s<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> win7: local: [<<full qualified host name>>] uses public key authentication<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> win7: cert: "C=NL, ST=Utrecht, L=Amersfoort, O=Globiq BV, CN=<<full qualified host name>>"<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> win7: remote: uses EAP_MSCHAPV2 authentication with EAP identity '%any'<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> win7: child: 10.10.0.0/24 10.10.10.0/24 10.10.20.0/24 10.10.30.0/24 === dynamic TUNNEL, dpdaction=clear<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">Security Associations (0 up, 1 connecting):<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> win7[2]: CONNECTING, 10.10.0.125[<<full qualified host name>>]...222.127.206.61[192.168.100.90]<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> win7[2]: IKEv2 SPIs: a65ea4c37c5f0fcd_i 86036036696d65c5_r*<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> win7[2]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"> win7[2]: Tasks passive: IKE_CERT_PRE IKE_AUTH IKE_CERT_POST IKE_CONFIG CHILD_CREATE IKE_AUTH_LIFETIME IKE_MOBIKE<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">I guess the problem has to do with the eap-mschapv2 authentication. If I change the entries in the ipsec.secrets, e.g. change my username, I would expect
an error and a challenge from the server to enter my username. In fact, I checked this on our strongswan 4.6.2 server. However the new server doesn’t inform me of my incorrect logon information, therefore I think the problem has to do with authentication not
working.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext">Extended key usage for the server certificates are identical for the old and new gateway, so I’m sure the problem is not related to that<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:Consolas;color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:windowtext;mso-fareast-language:NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:windowtext;mso-fareast-language:NL">Met vriendelijke groet, Kind regards,<br>
<br>
Hans Boone<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:windowtext;mso-fareast-language:NL"><br>
</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:windowtext;mso-fareast-language:NL">Business development manager<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:windowtext;mso-fareast-language:NL">Mob: + 31 (0) 650 62 83 23</span><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:windowtext;mso-fareast-language:NL"><br>
</span></b><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#32604D;mso-fareast-language:NL"><br>
</span></b><b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#32604D;mso-fareast-language:NL"><img width="494" height="192" id="Picture_x0020_1" src="cid:image001.png@01D09253.48FC4EA0" alt="email_footer"></span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext;mso-fareast-language:NL"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:24.0pt;font-family:Webdings;color:green;mso-fareast-language:NL">P</span><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:NL">
</span><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:green;mso-fareast-language:NL">Please consider the environment before printing this e-mail</span><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:NL">
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>