<div dir="ltr"><div><span style="font-size:12.8000001907349px">Hello Benjamin,</span><br></div><div><span style="font-size:12.8000001907349px"><br></span></div>It's the same error if I leave out left/rightid. This changes nothing in authentication.<div><br></div><div>Thank you</div><div><span style="font-size:12.8000001907349px">Benjamin</span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Aug 10, 2015 at 6:59 PM, Noel Kuntze <span dir="ltr"><<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA256<br>
<br>
Hello Benjamin,<br>
<br>
If you use right/leftsourceip on one side of the connection, you also need to do so on<br>
the other side. In your config, you use it on the "host", but not on the roadwarrior.<br>
<br>
Mit freundlichen Grüßen/Kind Regards,<br>
Noel Kuntze<br>
<br>
GPG Key ID: 0x63EC6658<br>
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
<div><div class="h5"><br>
Am 10.08.2015 um 18:51 schrieb Benjamin Häublein:<br>
> Hello,<br>
> I'm new to this mailing list, so please give me notice if something in my mail<br>
> is not up to the usual standards.<br>
><br>
> I have set up a strongswan host(5.2.1 on Debian Jessie) and a<br>
> roadwarrior(5.1.2 on Ubuntu 15.04) with authentication by certificates.<br>
> When I try connect I get "received AUTHENTICATION_FAILED notify error" and on<br>
> the host "no matching peer config found".<br>
> First of all: Connecting from an android client does work. Google tells me to<br>
> make sure I've included leftid and rightid with the DNs of the certificate.<br>
> I've done that.<br>
><br>
> Configuration and logs follow.<br>
><br>
> Thank you for your help<br>
> Benjamin<br>
><br>
> The ipsec.conf of the host is as follows:<br>
>> config setup<br>
>> strictcrlpolicy=no<br>
>> charondebug="cfg 2, dmn 2, ike 2, net 2"<br>
>><br>
>> conn %default<br>
>><br>
>> keyexchange=ikev2<br>
>> ike=aes256-sha1-modp1024!<br>
>> esp=aes256-sha1!<br>
>> dpdaction=clear<br>
>> dpddelay=300s<br>
>> rekey=no<br>
>> left=%any<br>
>> leftsubnet=<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
>> leftcert=vpnHostCert.pem<br>
>> leftfirewall=yes<br>
>> right=%any<br>
>> rightsourceip=<a href="http://172.16.16.1/24" rel="noreferrer" target="_blank">172.16.16.1/24</a><br>
>><br>
>> conn IPSec-IKEv2<br>
>> keyexchange=ikev2<br>
>> auto=add<br>
><br>
> of the roadwarrior:<br>
>> conn %default<br>
>> keyexchange=ikev2<br>
>><br>
>> conn pi<br>
>><br>
>> left=%any<br>
>> leftcert=roadwarriorCert.pem<br>
>> leftid=road@warrior<br>
>> leftfirewall=yes<br>
>> leftauth=pubkey<br>
>> right=<a href="http://my.host.com" rel="noreferrer" target="_blank">my.host.com</a><br>
>> rightauth=pubkey<br>
>> auto=add<br>
><br>
> When I call "ipsec up pi"(I've replace M.Y.I.P):<br>
>> initiating IKE_SA pi[1] to M.Y.I.P<br>
>> generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>
>> sending packet: from 192.168.1.20[500] to M.Y.I.P[500] (1212 bytes)<br>
>> received packet: from M.Y.I.P[500] to 192.168.1.20[500] (38 bytes)<br>
>> parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]<br>
>> peer didn't accept DH group MODP_2048, it requested MODP_1024<br>
>> initiating IKE_SA pi[1] to M.Y.I.P<br>
>> generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>
>> sending packet: from 192.168.1.20[500] to M.Y.I.P[500] (1084 bytes)<br>
>> received packet: from M.Y.I.P[500] to 192.168.1.20[500] (337 bytes)<br>
>> parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ<br>
>> N(MULT_AUTH) ] local host is behind NAT, sending keep alives<br>
>> remote host is behind NAT<br>
>> received cert request for "C=DE, O=bla, CN=Pi strongSwan Root CA"<br>
>> sending cert request for "C=DE, O=bla, CN=Pi strongSwan Root CA"<br>
>> authentication of 'C=CH, O=strongSwan, CN=road@warrior' (myself) with<br>
>> RSA signature successful sending end entity cert "C=DE, O=bla,<br>
>> CN=road@warrior" establishing CHILD_SA pi<br>
>> generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH SA<br>
>> TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ] sending<br>
>> packet: from 192.168.1.20[4500] to M.Y.I.P[4500] (1836 bytes)<br>
>> received packet: from M.Y.I.P[4500] to 192.168.1.20[4500] (76 bytes)<br>
>> parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>
>> received AUTHENTICATION_FAILED notify error<br>
>> establishing connection 'pi' failed<br>
><br>
> The logs of the host are:<br>
>> Aug 10 18:34:21 02[NET] <49> received packet: from 37.49.112.130[500] to<br>
>> 192.168.1.3[500] (1212 bytes)<br>
>> Aug 10 18:34:21 02[ENC] <49> parsed<br>
>> IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>
>> Aug 10 18:34:21 02[IKE] <49> 37.49.112.130 is initiating an IKE_SA<br>
>> Aug 10 18:34:21 02[IKE] <49> local host is behind NAT, sending keep alives<br>
>> Aug 10 18:34:21 02[IKE] <49> remote host is behind NAT<br>
>> Aug 10 18:34:21 02[IKE] <49> DH group MODP_2048 inacceptable, requesting<br>
>> MODP_1024<br>
>> Aug 10 18:34:21 02[ENC] <49> generating IKE_SA_INIT response 0 [<br>
>> N(INVAL_KE) ]<br>
>> Aug 10 18:34:21 02[NET] <49> sending packet: from 192.168.1.3[500] to<br>
>> 37.49.112.130[500] (38 bytes)<br>
>> Aug 10 18:34:22 11[NET] <50> received packet: from 37.49.112.130[500] to<br>
>> 192.168.1.3[500] (1084 bytes)<br>
>> Aug 10 18:34:22 11[ENC] <50> parsed IKE_SA_INIT request 0 [ SA KE No<br>
>> N(NATD_S_IP) N(NATD_D_IP) ]<br>
>> Aug 10 18:34:22 11[IKE] <50> 37.49.112.130 is initiating an IKE_SA<br>
>> Aug 10 18:34:22 11[IKE] <50> local host is behind NAT, sending keep alives<br>
>> Aug 10 18:34:22 11[IKE] <50> remote host is behind NAT<br>
>> Aug 10 18:34:22 11[IKE] <50> sending cert request for "C=DE, O=benjamin,<br>
>> CN=Pi strongSwan Root CA"<br>
>> Aug 10 18:34:22 11[ENC] <50> generating IKE_SA_INIT response 0 [ SA KE No<br>
>> N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]<br>
>> Aug 10 18:34:22 11[NET] <50> sending packet: from 192.168.1.3[500] to<br>
>> 37.49.112.130[500] (337 bytes)<br>
>> Aug 10 18:34:22 13[NET] <50> received packet: from 37.49.112.130[33056] to<br>
>> 192.168.1.3[4500] (1836 bytes)<br>
>> Aug 10 18:34:22 13[ENC] <50> parsed IKE_AUTH request 1 [ IDi CERT<br>
>> N(INIT_CONTACT) CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR)<br>
>> N(MULT_AUTH) N(EAP_ONLY) ]<br>
>> Aug 10 18:34:22 13[IKE] <50> received cert request for "C=DE, O=benjamin,<br>
>> CN=Pi strongSwan Root CA"<br>
>> Aug 10 18:34:22 13[IKE] <50> received end entity cert "C=CH, O=strongSwan,<br>
>> CN=benjaminh@fairphone"<br>
>> Aug 10 18:34:22 13[CFG] <50> looking for peer configs matching<br>
>> 192.168.1.3[<a href="http://benjaminh.duckdns.org" rel="noreferrer" target="_blank">benjaminh.duckdns.org</a>]...37.49.112.130[C=CH,<br>
>> O=strongSwan, CN=benjaminh@fairphone]<br>
>> Aug 10 18:34:22 13[CFG] <50> no matching peer config found<br>
>> Aug 10 18:34:22 13[IKE] <50> peer supports MOBIKE<br>
>> Aug 10 18:34:22 13[ENC] <50> generating IKE_AUTH response 1 [ N(AUTH_FAILED)<br>
>> ]<br>
>> Aug 10 18:34:22 13[NET] <50> sending packet: from 192.168.1.3[4500] to<br>
>> 37.49.112.130[33056] (76 bytes)<br>
><br>
><br>
</div></div>> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
> <a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2<br>
<br>
iQIcBAEBCAAGBQJVyNhuAAoJEDg5KY9j7GZYm5EP/i2iBEeK1/EXfNY8yCRQ+Nl0<br>
oan3EpDFuLrmcRztkbGMfEE6LsVQ9RydewjxyRF52XfSFw9HhVCP2Q5j4FrS+Ncl<br>
Z7sFr8D7V4pmfr1BbzS/tBOGhKA3bmO735dp1T3lIl6Yt+N3CDpTOh4BqA/lShl4<br>
1ZjVqx55OmqfSPv6Ozr/9Uone4/CWLWdsLi2MhF76s2yjituY5YVKmaIEGi9+uBL<br>
sCxvX3JPpFqrJ2oZv/eqrQVAsBKTR12Mvqx95y5R5ZIiPqjbJtWD6r1yVf2dSX+l<br>
o4kYUtTdpXOYJLbIoDKsCdE7EO+0Ychpzy2KXd5MLk4Uvn5TtCP/ZiG7cnHHytcB<br>
NR7ZWQvAt67rLGLy1Jzdt3Abj4fptz7Q5/FwdzsxRDmraHEduUCPawkcfGux4rx5<br>
IbHeg9tWlrTL+R76l/HLBvPiFFIkwJW/QH7LMPMRXIbrb19QviqENlkX3aEFdoam<br>
LFil4hzronsYM8tmdrauUfbBL+Wlv5woDqY2ePJOdUnVWVIUjyO7KLK7B1vJofK+<br>
BX9aXrSUzn/FlVCftvoBiwyM2WRYVVna+T+sAYU4Qi2JKCQBqKwbkP70fsRYDueJ<br>
LOIvG3wuFdKdcUZ9zqC5kzu0a+aeAt1S02lZxunLo82zRR1lgc+438zTCz52btwt<br>
QdLC6w/whtvvXLz8cbSU<br>
=Xc3w<br>
-----END PGP SIGNATURE-----<br>
<br>
</blockquote></div><br></div>