<div dir="ltr">Hi, <div><br></div><div>Just to complete the thread, the IP of my strongswan machine was going through a NAT process on the way to the peer, the source IP was changed and being understood as a remote client by the peer.</div><div><br></div><div>no bug so far</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jun 5, 2015 at 8:32 PM, Randy Wyatt <span dir="ltr"><<a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Increase your loglevel so we can see the initial messages of the connection. We need to see all the ISAKMP exchange messages.</div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jun 5, 2015 at 10:48 AM, Alexandre DEPREZ <span dir="ltr"><<a href="mailto:alex@madrouter.com" target="_blank">alex@madrouter.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Here's everything I got<div><br></div><div><div>Jun 5 18:44:32 x pluto[23543]: "tunnel-1" #686575: initiating Main Mode to replace #686529</div><div>Jun 5 18:44:32 x pluto[23543]: "tunnel-1" #686575: ignoring Vendor ID payload [FRAGMENTATION c0000000]</div><div>Jun 5 18:44:42 x pluto[23543]: "tunnel-1" #686575: Informational Exchange message must be encrypted</div><div>Jun 5 18:45:02 x pluto[23543]: "tunnel-1" #686575: Informational Exchange message must be encrypted</div><div>Jun 5 18:45:42 x pluto[23543]: "tunnel-1" #686575: max number of retransmissions (2) reached STATE_MAIN_I2</div><div>Jun 5 18:45:42 x pluto[23543]: "tunnel-1" #686575: starting keying attempt 49 of an unlimited number</div><div>Jun 5 18:45:42 x pluto[23543]: "tunnel-1" #686617: initiating Main Mode to replace #686575</div><div>Jun 5 18:45:42 x pluto[23543]: "tunnel-1" #686617: ignoring Vendor ID payload [FRAGMENTATION c0000000]</div><div>Jun 5 18:45:52 x pluto[23543]: "tunnel-1" #686617: Informational Exchange message must be encrypted</div><div>Jun 5 18:46:12 x pluto[23543]: "tunnel-1" #686617: Informational Exchange message must be encrypted</div><div>Jun 5 18:46:52 x pluto[23543]: "tunnel-1" #686617: max number of retransmissions (2) reached STATE_MAIN_I2</div><div>Jun 5 18:46:52 x pluto[23543]: "tunnel-1" #686617: starting keying attempt 50 of an unlimited number</div><div>Jun 5 18:46:52 x pluto[23543]: "tunnel-1" #686661: initiating Main Mode to replace #686617</div><div>Jun 5 18:46:52 x pluto[23543]: "tunnel-1" #686661: ignoring Vendor ID payload [FRAGMENTATION c0000000]</div><div>Jun 5 18:47:02 x pluto[23543]: "tunnel-1" #686661: Informational Exchange message must be encrypted</div><div>Jun 5 18:47:22 x pluto[23543]: "tunnel-1" #686661: Informational Exchange message must be encrypted</div></div><div><br></div><div><br></div><div>Continuously</div><div><br></div><div><br></div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jun 5, 2015 at 7:44 PM, Randy Wyatt <span dir="ltr"><<a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Can you post your logfile ? <div><br></div><div>The difference in configurations is the wiki has authby=secret in the default connection whereas you have it in the individual connection.</div><div><br></div><div>Regards,</div><div>Randy</div></div><div class="gmail_extra"><div><div><br><div class="gmail_quote">On Fri, Jun 5, 2015 at 10:39 AM, Alexandre DEPREZ <span dir="ltr"><<a href="mailto:alex@madrouter.com" target="_blank">alex@madrouter.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">yes, true, they are for openswan, my bad.<div><br></div><div>I do not have a hand on the other side. Can't tell</div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jun 5, 2015 at 7:35 PM, Noel Kuntze <span dir="ltr"><<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span><br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA256<br>
<br>
Hello Alexandre,<br>
<br>
</span>These options don't exist:<br>
leftxauthclient=no<br>
rightxauthserver=no<br>
You described using those in one of your last emails.<br>
What is the config on the other side?<br>
<span><br>
Mit freundlichen Grüßen/Kind Regards,<br>
Noel Kuntze<br>
<br>
GPG Key ID: 0x63EC6658<br>
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
<br>
</span><div><div>Am 05.06.2015 um 19:29 schrieb Alexandre DEPREZ:<br>
> Randy,<br>
><br>
> I'll change if there is no other possibilities.<br>
><br>
> As for the link you gave me, thank you for it. I did a lot of digging in the documentation I could read. So far, nothing seems to work.<br>
><br>
><br>
> Noel,<br>
><br>
> version 2.0<br>
><br>
> config setup<br>
> charonstart=no<br>
> interfaces="%none"<br>
> nat_traversal=no<br>
><br>
> conn clear<br>
> auto=ignore<br>
><br>
> conn clear-or-private<br>
> auto=ignore<br>
><br>
> conn private-or-clear<br>
> auto=ignore<br>
><br>
> conn private<br>
> auto=ignore<br>
><br>
> conn block<br>
> auto=ignore<br>
><br>
> conn packetdefault<br>
> auto=ignore<br>
><br>
> conn %default<br>
> keyexchange=ikev1<br>
><br>
> conn tunnel-1<br>
> left=a.a.a.a<br>
> right=b.b.b.b<br>
</div></div><span>> leftsubnet=<a href="http://10.252.243.128/28" target="_blank">10.252.243.128/28</a> <<a href="http://10.252.243.128/28" target="_blank">http://10.252.243.128/28</a>><br>
> rightsubnet=<a href="http://172.23.149.0/24" target="_blank">172.23.149.0/24</a> <<a href="http://172.23.149.0/24" target="_blank">http://172.23.149.0/24</a>><br>
> leftsourceip=a.a.a.a<br>
> ike=aes256-sha1-modp1024,aes128-sha1-modp1024!<br>
> ikelifetime=86400s<br>
> dpddelay=15s<br>
> dpdtimeout=30s<br>
> dpdaction=restart<br>
> esp=aes256-sha1!<br>
> keylife=3600s<br>
> rekeymargin=540s<br>
> type=tunnel<br>
> authby=secret<br>
> pfs=no<br>
> compress=no<br>
> auto=start<br>
> keyingtries=%forever<br>
><br>
><br>
</span><span>> Also, I didnt get the imaginary configuration option part ?<br>
><br>
> Thanks<br>
><br>
><br>
><br>
><br>
</span><span>> On Fri, Jun 5, 2015 at 7:20 PM, Noel Kuntze <<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>>> wrote:<br>
><br>
><br>
> Hello Alexandre,<br>
><br>
> Please stop trying to use some imaginary configuration options and stick to those<br>
> on the man page of ipsec.conf.<br>
><br>
> What is your complete ipsec.conf? Pay attention to conn %default, if you have that,<br>
> as it will beqeust its own options to _all_ other conns.<br>
><br>
><br>
><br>
> Mit freundlichen Grüßen/Kind Regards,<br>
> Noel Kuntze<br>
><br>
> GPG Key ID: 0x63EC6658<br>
> Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
><br>
> Am 05.06.2015 um 19:07 schrieb Alexandre DEPREZ:<br>
> > Hi Randy,<br>
><br>
> > I forgot to mention, i'm using this version:<br>
><br>
> > Linux strongSwan U4.5.2/K3.2.0-4-amd64<br>
><br>
> > Here is it :<br>
><br>
> > conn tunnel-1<br>
> > left=a.a.a.a<br>
> > right=b.b.b.b<br>
</span>> > leftsubnet=<a href="http://10.252.243.128/28" target="_blank">10.252.243.128/28</a> <<a href="http://10.252.243.128/28" target="_blank">http://10.252.243.128/28</a>> <<a href="http://10.252.243.128/28" target="_blank">http://10.252.243.128/28</a>><br>
> > rightsubnet=<a href="http://172.23.149.0/24" target="_blank">172.23.149.0/24</a> <<a href="http://172.23.149.0/24" target="_blank">http://172.23.149.0/24</a>> <<a href="http://172.23.149.0/24" target="_blank">http://172.23.149.0/24</a>><br>
<span>> > leftsourceip=a.a.a.a<br>
> > ike=aes256-sha1-modp1024,aes128-sha1-modp1024!<br>
> > ikelifetime=86400s<br>
> > dpddelay=15s<br>
> > dpdtimeout=30s<br>
> > dpdaction=restart<br>
> > esp=aes256-sha1!<br>
> > keylife=3600s<br>
> > rekeymargin=540s<br>
> > type=tunnel<br>
> > authby=secret<br>
> > pfs=no<br>
> > compress=no<br>
> > auto=start<br>
> > keyingtries=%forever<br>
><br>
> > I also tried to use<br>
><br>
> > leftxauthclient=no<br>
> > rightxauthserver=no<br>
><br>
> > No changes.<br>
><br>
> > Thanks<br>
><br>
><br>
><br>
><br>
><br>
</span><span>> > On Fri, Jun 5, 2015 at 7:02 PM, Randy Wyatt <<a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a> <mailto:<a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a>> <mailto:<a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a> <mailto:<a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a>>>> wrote:<br>
><br>
> > Please send a sanitized version of your configuration. xauth should only be sent if you configured it to be sent.<br>
><br>
</span><span>> > On Fri, Jun 5, 2015 at 9:09 AM, Alexandre DEPREZ <<a href="mailto:alex@madrouter.com" target="_blank">alex@madrouter.com</a> <mailto:<a href="mailto:alex@madrouter.com" target="_blank">alex@madrouter.com</a>> <mailto:<a href="mailto:alex@madrouter.com" target="_blank">alex@madrouter.com</a> <mailto:<a href="mailto:alex@madrouter.com" target="_blank">alex@madrouter.com</a>>>> wrote:<br>
><br>
> > Hi,<br>
><br>
> > I'm using strongswan only for L2L VPN.<br>
><br>
> > It's been some times now, I can not be the initiator of the VPN because strongswan is always sending an XAUTH option in the phase 1 establishment.<br>
><br>
> > When the other side is not configured to receive remote user, it's working but when it is, I'm receiving L2TP/IPsec or some other remote access vpn protocols.<br>
><br>
> > I can not wait for the other side to send me trafic in order to be the responder. I tried to recompile strongswan removing xauth, but it's not working.<br>
><br>
> > Is there any configuration command I can use to force strongswan not to send XAUTH ?<br>
><br>
> > Thanks<br>
><br>
> > Alex<br>
><br>
><br>
><br>
><br>
><br>
><br>
> > _______________________________________________<br>
> > Users mailing list<br>
</span>> > <a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>>><br>
<span>> > <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
><br>
><br>
><br>
><br>
> > --<br>
> > Randy W. Wyatt<br>
</span>> > <a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a> <mailto:<a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a>> <mailto:<a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a> <mailto:<a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a>>><br>
> > Home: <a href="tel:858-309-5303" value="+18583095303" target="_blank">858-309-5303</a> <tel:<a href="tel:858-309-5303" value="+18583095303" target="_blank">858-309-5303</a>> <tel:<a href="tel:858-309-5303" value="+18583095303" target="_blank">858-309-5303</a> <tel:<a href="tel:858-309-5303" value="+18583095303" target="_blank">858-309-5303</a>>><br>
> > Cell: <a href="tel:858-598-4421" value="+18585984421" target="_blank">858-598-4421</a> <tel:<a href="tel:858-598-4421" value="+18585984421" target="_blank">858-598-4421</a>> <tel:<a href="tel:858-598-4421" value="+18585984421" target="_blank">858-598-4421</a> <tel:<a href="tel:858-598-4421" value="+18585984421" target="_blank">858-598-4421</a>>><br>
> > Fax: <a href="tel:858-408-7554" value="+18584087554" target="_blank">858-408-7554</a> <tel:<a href="tel:858-408-7554" value="+18584087554" target="_blank">858-408-7554</a>> <tel:<a href="tel:858-408-7554" value="+18584087554" target="_blank">858-408-7554</a> <tel:<a href="tel:858-408-7554" value="+18584087554" target="_blank">858-408-7554</a>>><br>
><br>
><br>
><br>
><br>
><br>
> > _______________________________________________<br>
> > Users mailing list<br>
> > <a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>><br>
> > <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
<span>><br>
><br>
> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a>><br>
> <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
><br>
><br>
<br>
</span><span>-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2<br>
<br>
</span>iQIcBAEBCAAGBQJVcd3FAAoJEDg5KY9j7GZYL74P/j6DkBsYDrRHMnz/GXRf3Zp8<br>
nh4lP69UwtikWftw0LZFtpXJCrARa/4R3bX7E7vEGnwW5Gt0aTtx4PJEPGffS+Oy<br>
KfDdcivIZhVL8GAGb6USYbpygcvzb1syoGOHj+6GTOVgTykHJr4eLxtCnIpNBXcg<br>
fJexVxkZX6ETI13zXXh9Ysis1B14BSustWAxODuSJf3BbTvjMB+1rdpWsKnx3xR4<br>
sIVagIAdLeRoShFfCNj37JzfcwufKGqJ8OiyZrkIFR8Xv3JW1BaBMymTyWzy+aGj<br>
WpBXlrLrXhYTftwYZ+CcjxmJMNUs+i+bP3dYZlZFKFyIxlG6WyhHYwd4s5IjzAaX<br>
6Sh6G7lpJLSSDcT+Wkvi06sLUvf+j8hT1cDyJUwVQkpcQGc6ibqZuAvDE+R+hGHG<br>
7l4qJri2HU6xOlUmNju+lbkGlQnKkdbqLwIC6WNXD1nvRWBnYgYsUVEzhfdliO2x<br>
+OK8c/RSQAwDTiBi0BkZe1vP1uQ++w7/cB2ydEuHTPNbN37JDYByPop0oB9WRz92<br>
4VsfhJ2ZgVptAPi9AEnLWak7ziIJljdFykokpm0Ee4YFfZEEJm8kZjryzcULYTFW<br>
fF9Zgnl6pKOYH5BIzEX0wbkcDkFImtXN3CqjTHmjZraC2RFxkL+DnsjlM8bs9jmu<br>
7n7QSIDcWhrXQdAOhVuV<br>
=RpI6<br>
-----END PGP SIGNATURE-----<br>
<br>
</blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br></div></div><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div>Randy W. Wyatt</div><div><a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a></div><span><div>Home: <a href="tel:858-309-5303" value="+18583095303" target="_blank">858-309-5303</a></div><div>Cell: <a href="tel:858-598-4421" value="+18585984421" target="_blank">858-598-4421</a></div><div>Fax: <a href="tel:858-408-7554" value="+18584087554" target="_blank">858-408-7554</a><table width="93%" align="center" style="background-color:rgb(242,245,247)" border="0" cellspacing="0" cellpadding="4"><tbody><tr><td valign="top" style="width:169px;line-height:155%"><font color="#000000" face="Verdana, Arial" style="font-size:11px;margin-top:4px" valign="top"><b></b></font></td><td valign="top"><span style="color:rgb(0,51,102);font-size:18px;font-weight:bold"><font color="#1155cc"><br></font></span></td></tr></tbody></table></div></span></div></div></div></div></div></div>
</div>
</blockquote></div><br></div>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div>Randy W. Wyatt</div><div><a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a></div><div>Home: <a href="tel:858-309-5303" value="+18583095303" target="_blank">858-309-5303</a></div><div>Cell: <a href="tel:858-598-4421" value="+18585984421" target="_blank">858-598-4421</a></div><div>Fax: <a href="tel:858-408-7554" value="+18584087554" target="_blank">858-408-7554</a><table width="93%" align="center" style="background-color:rgb(242,245,247)" border="0" cellspacing="0" cellpadding="4"><tbody><tr><td valign="top" style="width:169px;line-height:155%"><font color="#000000" face="Verdana, Arial" style="font-size:11px;margin-top:4px" valign="top"><b></b></font></td><td valign="top"><span style="color:rgb(0,51,102);font-size:18px;font-weight:bold"><font color="#1155cc"><br></font></span></td></tr></tbody></table></div></div></div></div></div></div></div>
</div>
</div></div></blockquote></div><br></div>