<div dir="ltr"><div><div><div><div><div><div><div><div><div><div>Hi Tobias<br><br></div>Firstly thank you so much for taking out your time and sending in your reply to my query.<br><br></div>I think i identified the issue with the cisco-vpn-client or the vpn-server-strongswan<br></div><div><br>Yes, ofcourse. I have enabled aggressive-mode in the "strongswan.d/charon.conf" file. (The alternate test which worked with x509-certs ofcourse used only main-mode)<br><br></div>So for my tests with PSK and remote cisco-vpn-clients (right=%any) i had been using the config on server as below:<br>====================================================<br># /etc/ipsec.conf - strongSwan IPsec configuration file<br><br>config setup<br> strictcrlpolicy=no<br> charondebug="ike 4, enc 4, dmn 4, chd 4, knl 3, cfg 3, net 3, esp 3, lib=3, mgr=3"<br><br>conn %default<br> ikelifetime=24h<br> keylife=18h<br> mobike=no<br><br>conn c2s_group1<br> aggressive=yes<br> left=2.2.2.5<br> leftsubnet=<a href="http://192.168.25.0/24,192.168.33.0/24">192.168.25.0/24,192.168.33.0/24</a><br> right=%any<br> rightsourceip=<a href="http://10.9.9.0/24">10.9.9.0/24</a><br> leftid=2.2.2.5<br> rightid=@group1<br> leftauth=psk<br> rightauth=psk<br> rightauth2=xauth<br> type=tunnel<br> keyexchange=ikev1<br> modeconfig=pull<br> auto=add<br> <br>root@OptiPlex-7010:/usr/local/etc# cat ipsec.secrets<br>#/etc/ipsec.secrets - strongSwan IPsec secrets file<br>2.2.2.5 group1 : PSK "123456789abc"<br>#: RSA Group1Key1.pem<br>user1 : XAUTH "config123"<br>root@OptiPlex-7010:/usr/local/etc#<br>========================================<br><br></div>The remote clients are cisco-vpn-v5.x clients and some more clients which are hardware gateways running openwrt with strongswan-v5.3. There are also some other cisco-hardware clients (such as 800/17xx series small routers). The server is ofcourse on a openwrt-based gateway running strongswan-v5.3 (with cisco-unity plugin enabled and "attr.conf" file configured with the unity options)<br><br></div>I have attached a txt file with the debug output on the server when the cisco-vpn-client tried to connect. An extract sample is as below:<br><br>==========================================================<br>....<br>....<br><br>08[CFG] no acceptable ENCRYPTION_ALGORITHM found<br>08[CFG] selecting proposal:<br>08[CFG] no acceptable ENCRYPTION_ALGORITHM found<br>08[CFG] selecting proposal:<br>08[CFG] proposal matches<br>08[CFG] received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_128/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_128/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024<br>08[CFG] configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536, IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/AES_CTR_128/AES_CTR_192/AES_CTR_256/CAMELLIA_CTR_128/CAMELLIA_CTR_192/CAMELLIA_CTR_256/HMAC_MD5_96/HMAC_SHA1_96/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/PRF_HMAC_MD5/PRF_HMAC_SHA1/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_AES128_CMAC/MODP_2048/MODP_2048_224/MODP_2048_256/MODP_1536/MODP_3072/MODP_4096/MODP_8192/MODP_1024/MODP_1024_160/ECP_256/ECP_384/ECP_521/ECP_224/ECP_192/ECP_224_BP/ECP_256_BP/ECP_384_BP/ECP_512_BP, IKE:AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/AES_CCM_8_128/AES_CCM_8_192/AES_CCM_8_256/AES_CCM_12_128/AES_CCM_12_192/AES_CCM_12_256/AES_CCM_16_128/AES_CCM_16_192/AES_CCM_16_256/CAMELLIA_CCM_8_128/CAMELLIA_CCM_8_192/CAMELLIA_CCM_8_256/CAMELLIA_CCM_12_128/CAMELLIA_CCM_12_192/CAMELLIA_CCM_12_256/CAMELLIA_CCM_16_128/CAMELLIA_CCM_16_192/CAMELLIA_CCM_16_256/PRF_HMAC_MD5/PRF_HMAC_SHA1/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_AES128_CMAC/MODP_2048/MODP_2048_224/MODP_2048_256/MODP_1536/MODP_3072/MODP_4096/MODP_8192/MODP_1024/MODP_1024_160/ECP_256/ECP_384/ECP_521/ECP_224/ECP_192/ECP_224_BP/ECP_256_BP/ECP_384_BP/ECP_512_BP<br>08[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br>08[CFG] looking for XAuthInitPSK peer configs matching 2.2.2.5...172.29.1.251[group1]<br>08[CFG] peer config match local: 1 (ID_ANY)<br><b>08[CFG] peer config match remote: 0 (ID_KEY_ID -> 67:72:6f:75:70:31)</b><br><b>08[CFG] ike config match: 1052 (2.2.2.5 172.29.1.251 IKEv1)<br>08[IKE] no peer config found<br></b>08[IKE] queueing INFORMATIONAL task<br>08[IKE] activating new tasks<br>08[IKE] activating INFORMATIONAL task<br>08[ENC] added payload of type NOTIFY_V1 to message<br>08[ENC] order payloads in message<br>08[ENC] added payload of type NOTIFY_V1 to message<br><b>08[ENC] generating INFORMATIONAL_V1 request 2713950181 [ N(AUTH_FAILED) ]</b><br>08[ENC] not encrypting payloads<br>08[ENC] generating payload of type HEADER<br>...<br>...<br>================================================<br><br></div>The ID being sent by Cisco-VPN-Client is of type KEY_ID, whereas the server is configured to expect a ID_FQDN type (which the hardware clients running strongswan are sending as such). This is was i think the authentication was failing<br><br></div>Therefore i once again read thru the very good strongswan wiki site (read the topic on Identity Parsing in Strongswan) and changed the above config as below:<br><br>conn c2s_group1<br> aggressive=yes<br> left=2.2.2.5<br> leftsubnet=<a href="http://192.168.25.0/24,192.168.33.0/24">192.168.25.0/24,192.168.33.0/24</a><br> right=%any<br> rightsourceip=<a href="http://10.9.9.0/24">10.9.9.0/24</a><br> leftid=2.2.2.5<br> rightid=keyid:group1<br> leftauth=psk<br> rightauth=psk<br> rightauth2=xauth<br> type=tunnel<br> keyexchange=ikev1<br> modeconfig=pull<br> auto=add<br>===========================<br></div>specifically i configured the rightid as "rightid=keyid:group1". All other configs (including in ipsec.secrets) remained as earlier.<br><br></div>Then the cisco-vpn-client connected successfully and the tunnel was established. <br><br>Now i have to change all the strongswan-based clients to configure with "leftid=keyid:group1". else i will need to create a separate connection entry in server, which accepts a fqdn as id type from these clients (who send ID_FQDN as their id types)...another connection entry in the same server may also mean that i have to use a different groupid such as group2...Is this correct? or can i do it in some other way?<br><br></div><div>Do all cisco clients (software and the hardware-clients such as Cisco800/Cisco1700/Cisco1200 etc ) send their IDs as KEY_ID when PSK with group-names are used in their config for IKEv1?<br><br><br></div><div>thank you once again<br><br></div><div>with regards<br></div><div>rajiv<br><br></div><div><div><div><br><br><div><div><div><br><div><br><div><br></div></div></div></div></div></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Oct 28, 2015 at 3:05 PM, Tobias Brunner <span dir="ltr"><<a href="mailto:tobias@strongswan.org" target="_blank">tobias@strongswan.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Rajiv,<br>
<br>
> I need to use PSK based auth (with aggressive-mode) for many of the<br>
> cisco clients being used in my organization...hence cannot avoid the ><br>
use of PSK/Xauth/Aggressive combination...<br>
<br>
You need to enable<br>
<br>
charon.i_dont_care_about_security_and_use_aggressive_mode_psk<br>
<br>
in strongswan.conf [1] to allow XAuth with PSKs in Aggressive Mode on a<br>
server.<br>
<br>
Regards,<br>
Tobias<br>
<br>
[1] <a href="https://wiki.strongswan.org/projects/strongswan/wiki/StrongswanConf" rel="noreferrer" target="_blank">https://wiki.strongswan.org/projects/strongswan/wiki/StrongswanConf</a><br>
<br>
</blockquote></div><br></div>