<div dir="ltr"><div>Hi Thomas, <br> I have tried it on a Palo Alto Network FW and got the same result. Here is the IKE_SA_INIT packet I got from the firewall. From the packet, I can see that it is sending DH group as undefined in the Key Exchange section.<br><br></div>These are the logs that I see generated from strongswan charon. I have set the default log value to be 3 in filelog section in strongswan.conf file. <br>charon: 07[IKE] initiating IKE_SA load-test[1] to 2.2.2.1<br>charon: 07[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) ]<br>charon: 07[NET] sending packet: from 2.2.2.20[500] to 2.2.2.1[500] (288 bytes)<br>charon: 11[CFG] assigning new lease to 'ext-3'<br>charon: 11[CFG] installed load-tester IP 2.2.2.21 on eth1<br>charon: 11[IKE] initiating IKE_SA load-test[2] to 2.2.2.1<br>charon: 11[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) ]<br>charon: 11[NET] sending packet: from 2.2.2.21[500] to 2.2.2.1[500] (288 bytes)<br>charon: 08[NET] received packet: from 2.2.2.1[500] to 2.2.2.20[500] (38 bytes)<br>charon: 08[ENC] parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]<br>charon: 08[IKE] peer didn't accept DH group MODP_768, it requested MODP_768<br>charon: 08[DMN] thread 8 received 11<br>charon: 08[LIB] dumping 12 stack frame addresses:<br>charon: 08[LIB] /lib/x86_64-linux-gnu/libpthread.so.0 @ 0x7f79582c9000 [0x7f79582d88d0]<br>charon: 08[LIB] -> ??:?<br>charon: 08[LIB] /usr/lib/ipsec/libstrongswan.so.0 @ 0x7f7958c6d000 [0x7f7958c961f0]<br>charon: 08[LIB] -> /root/strongswan/strongswan-5.3.5/src/libstrongswan/networking/packet.c:117 (discriminator 1)<br>charon: 08[LIB] /usr/lib/ipsec/libcharon.so.0 @ 0x7f79587e7000 [0x7f795882bf1f]<br>charon: 08[LIB] -> /root/strongswan/strongswan-5.3.5/src/libcharon/sa/ikev2/tasks/ike_init.c:748 (discriminator 1)<br>charon: 08[LIB] /usr/lib/ipsec/libcharon.so.0 @ 0x7f79587e7000 [0x7f795881d8e2]<br>charon: 08[LIB] -> /root/strongswan/strongswan-5.3.5/src/libcharon/sa/ikev2/task_manager_v2.c:1774<br>charon: 08[LIB] /usr/lib/ipsec/libcharon.so.0 @ 0x7f79587e7000 [0x7f795882c714]<br>charon: 08[LIB] -> /root/strongswan/strongswan-5.3.5/src/libcharon/sa/ikev2/tasks/ike_init.c:657<br>charon: 08[LIB] /usr/lib/ipsec/libcharon.so.0 @ 0x7f79587e7000 [0x7f795881fdb9]<br>charon: 08[LIB] -> /root/strongswan/strongswan-5.3.5/src/libcharon/sa/ikev2/task_manager_v2.c:664<br>charon: 08[LIB] /usr/lib/ipsec/libcharon.so.0 @ 0x7f79587e7000 [0x7f7958814d57]<br>charon: 08[LIB] -> /root/strongswan/strongswan-5.3.5/src/libcharon/sa/ike_sa.c:1402<br>charon: 08[LIB] /usr/lib/ipsec/libcharon.so.0 @ 0x7f79587e7000 [0x7f795880dab1]<br>charon: 08[LIB] -> /root/strongswan/strongswan-5.3.5/src/libcharon/processing/jobs/process_message_job.c:74<br>charon: 08[LIB] /usr/lib/ipsec/libstrongswan.so.0 @ 0x7f7958c6d000 [0x7f7958c9ad93]<br>charon: 08[LIB] -> /root/strongswan/strongswan-5.3.5/src/libstrongswan/processing/processor.c:235<br>charon: 08[LIB] /usr/lib/ipsec/libstrongswan.so.0 @ 0x7f7958c6d000 [0x7f7958caa6d8]<br>charon: 08[LIB] -> /root/strongswan/strongswan-5.3.5/src/libstrongswan/threading/thread.c:304 (discriminator 3)<br>charon: 08[LIB] /lib/x86_64-linux-gnu/libpthread.so.0 @ 0x7f79582c9000 [0x7f79582d10a4]<br>charon: 08[LIB] -> /build/glibc-Ir_s5K/glibc-2.19/nptl/pthread_create.c:309 (discriminator 2)<br>charon: 08[LIB] /lib/x86_64-linux-gnu/libc.so.6 @ 0x7f7957d1c000 (clone+0x6d) [0x7f7957e0204d]<br>charon: 08[LIB] -> /build/glibc-Ir_s5K/glibc-2.19/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:113<br>charon: 08[DMN] killing ourself, received critical signal<br>charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.0.0-kali1-amd64, x86_64)<br>charon: 00[CFG] loaded load-tester address pool <a href="http://2.2.2.20/24">2.2.2.20/24</a> on eth1<br>charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.0.0-kali1-amd64, x86_64)<br>charon: 00[CFG] loaded load-tester address pool <a href="http://2.2.2.20/24">2.2.2.20/24</a> on eth1<br>charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'<br>charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'<br>charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'<br>charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'<br>charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'<br>charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'<br>charon: 00[CFG] expanding file expression '/var/lib/strongswan/ipsec.secrets.inc' failed<br>charon: 00[LIB] loaded plugins: charon aes agent gcm openssl des rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem fips-prf gmp xcbc cmac hmac attr load-tester kernel-netlink resolve socket-default stroke updown xauth-generic<br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Jan 31, 2016 at 1:57 AM, Thomas Egerer <span dir="ltr"><<a href="mailto:hakke_007@gmx.de" target="_blank">hakke_007@gmx.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA256<br>
<br>
Michael,<br>
<br>
</span>can you provide the charon load-tester log with facility enc set to log<br>
level 3, see [1], and the pcap file from your cisco device (one IKE_INIT<br>
exchange should do).<br>
<br>
Thomas<br>
<br>
[1] <a href="https://wiki.strongswan.org/projects/strongswan/wiki/LoggerConfiguration" rel="noreferrer" target="_blank">https://wiki.strongswan.org/projects/strongswan/wiki/LoggerConfiguration</a><br>
<span class=""><br>
On 01/31/2016 09:12 AM, Michael Chan wrote:<br>
> I ran this against a cisco device. I looked at the packet capture and it<br>
> shows that the key exchange DH group is undefined. Has anyone tried with<br>
> load-tester on 5.3.5?<br>
><br>
> On Sat, Jan 30, 2016 at 2:22 AM, Thomas Egerer <<a href="mailto:hakke_007@gmx.de">hakke_007@gmx.de</a>> wrote:<br>
><br>
</span><div><div class="h5">> Michael,<br>
><br>
> while unloading the dishwasher I gave your issue another thought ;)<br>
> It seems I have somehow misread your problem. The peer you are trying<br>
> to connect the load tester to, runs which VPN-service? If it is a<br>
> strongwan instance, you should provide the version, log information<br>
> of the IKE negotiation and an output of your config (stroke statusall).<br>
> It seems odd, that the peer does not accept modp 1024 while it request<br>
> this same modp group in the response.<br>
> Does the peer a plugin loaded that provides modp 1024 (gcrypt, gmp,<br>
> openssl)? You should see this in 'stroke listall'.<br>
><br>
> Cheers,<br>
> Thomas<br>
><br>
> On 01/30/2016 12:20 AM, Michael Chan wrote:<br>
>>>> I looked at the ike logs and I see the following message<br>
>>>><br>
>>>> [ENC] parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]<br>
>>>> [IKE] peer didn't accept DH group MODP_1024, it requested MODP_1024<br>
>>>><br>
>>>> The packet capture shows the DH group is undefined. Is there a parameter<br>
> to<br>
>>>> set the DH group for the ike key exchange? I have the following parameter<br>
>>>> in my load-tester.conf file.<br>
>>>> proposal = aes-sha1-modp1024<br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>> On Fri, Jan 29, 2016 at 12:40 PM, Michael Chan <<a href="mailto:mchan49@gmail.com">mchan49@gmail.com</a>><br>
> wrote:<br>
>>>><br>
>>>>> Hi,<br>
>>>>> I'm wanting to use the load-tester plugin to perform load testing<br>
> on<br>
>>>>> remote host, but the remote host keeps sending back INVALID_KE_PAYLOAD<br>
>>>>> message back. When I do a packet capture I see that the DH group for key<br>
>>>>> exchange payload is undefined. I tried setting in the load-tester.conf<br>
> file<br>
>>>>> esp and proposal to use modp1024, but it doesn't change the key exchange<br>
>>>>> payload DH group at all. Is there a way to set the group in load-tester?<br>
>>>>><br>
>>>>> Thanks,<br>
>>>>> Michael<br>
>>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>> _______________________________________________<br>
>>>> Users mailing list<br>
>>>> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
>>>> <a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
>>>><br>
><br>
>> _______________________________________________<br>
>> Users mailing list<br>
>> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
>> <a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
>><br>
><br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2<br>
<br>
</div></div>iQIcBAEBCAAGBQJWrdqZAAoJEGK31ONirBTGOhAP/0rr7ZcgG4ljSwbRJUtGSQKv<br>
BwSO069RVcxTKSdV8bwvwL5u7gA1Gkbld1TASArN9auVfMcvmjuW6zlt+QpK9FSV<br>
o9qvJoPpJTeBTgbRlZmWEXTCr/flLl1Hd5eu4IZ+rG0MxM0GCtxXOBYWPlWNw3j7<br>
4lB6mj/hpwnvIW0iu3OvrzuRbvarFf7lKAEDBdZ0AVoiCJFPwj6C/R04K4ouRsav<br>
3ldWxh80fGH1WQHTHytEqlBSYBnj2cAcpgKtAiGqZQ7LzMzoCk05WQmJemW5DgEu<br>
zhrsMIxXlHxf1VjLKJ9zRP6oJIk8ZvDMGg3n84OIpqhJK6gnG+7p4YJCCL4JGQF5<br>
XyaDwy0DV6vfyiYP3rxCzqbeB7+e7kAKGeDUO+O+DyUTAK+K88SiAdTPL2cGc6sz<br>
io4JH7jqwnG0gaqkDPpRHkZRa/OJxeu6/p8u5tyMwC0PO1FHEPlkgqCBikXuvAko<br>
hA2XfvrmSnrPROViR2ujfSjlLqcJ0y0XrG4MrTFF1xFroXIhLsHsUDZ/vIM8lmT4<br>
pA+DQmNqToQ2m7ashz3fYu6zyPS+PGT9AFiEyqUrNKZ++7lHGW/DvvMomyymHCzb<br>
x2RoVDa/TMFiTInNfAqCQd0s6DDikfu/MUqGFfDi/4/lGQ9hkABd3bmYst8Wvms8<br>
bJFLJQSzB3Z0zP+AwUYK<br>
=48yJ<br>
-----END PGP SIGNATURE-----<br>
</blockquote></div><br></div>