<div dir="ltr">Hi Kapil, <div><br></div><div>I am looking into this issue since couple of days and finally decided to post my query here. The first option (patch for old kernel) i tried but couldn't find it. How can i find if my kernel has that patch fixed ? </div><div><br></div><div>Second option is not workable for us. </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jun 22, 2016 at 10:41 AM, Kapil Adhikesavalu <span dir="ltr"><<a href="mailto:kapil20084@gmail.com" target="_blank">kapil20084@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">Seems you are hitting the Aes-ni 256 bit limitation. You have couple of options, </p>
<p dir="ltr">1. Move to kernel 4.1 or see if patches are available to port it to old kernel. </p>
<p dir="ltr">2. Try removing this kernel module, it might work(may be not) without the Aes-ni instructions support. If it works, throughput will be less. </p>
<p dir="ltr">Thanks <br><span class="HOEnZb"><font color="#888888">
Kapil </font></span></p><div class="HOEnZb"><div class="h5">
<div class="gmail_quote">On 22-Jun-2016 8:54 AM, "sandeep dubey" <<a href="mailto:sandeep.sanash@gmail.com" target="_blank">sandeep.sanash@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thanks Kapil for quick reply. <div><br></div><div>I grep for 'intel_aesni' at /proc/crypto and found below - </div><div><br></div><div><div>module : aesni_intel</div><div>driver : crc32c-intel</div></div><div><br></div><div>It seems that our EC2 instance is on that kernel. </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jun 22, 2016 at 8:42 AM, Kapil Adhikesavalu <span dir="ltr"><<a href="mailto:kapil20084@gmail.com" target="_blank">kapil20084@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">Hi Sandeep, </p>
<p dir="ltr">Are you by any chance using intel_aesni klm (check /proc/crypto) ? If so, aesgcm256 is not supported until kernel 4.1.</p>
<p dir="ltr">Otherwise you can check the logs to see for any errors. </p>
<p dir="ltr">Related to GCM256 - <a href="https://wiki.strongswan.org/issues/341" target="_blank">https://wiki.strongswan.org/issues/341</a> </p>
<p dir="ltr">Thanks <br>
Kapil </p>
<div class="gmail_quote"><div><div>On 22-Jun-2016 7:12 AM, "sandeep dubey" <<a href="mailto:sandeep.sanash@gmail.com" target="_blank">sandeep.sanash@gmail.com</a>> wrote:<br type="attribution"></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr">Hi Andreas, <div><br></div><div>Thanks for the reply, I tried but it didn't worked for me. </div><div><br></div><div>my config - </div><div><br></div><div><div>conn support-node</div><div> authby=secret</div><div> auto=start</div><div> type=tunnel</div><div> left=172.19.17.23</div><div> leftid=5.6.7.8</div><div> leftsubnet=<a href="http://172.19.0.0/16" target="_blank">172.19.0.0/16</a></div><div> leftauth=psk</div><div> right=1.2.3.4</div><div> rightsubnet=<a href="http://10.10.0.0/16" target="_blank">10.10.0.0/16</a></div><div> rightauth=psk</div><div> ike=aes256gcm12-modp1536</div><div> esp=aes256gcm12-modp1536</div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jun 21, 2016 at 6:53 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Sandeep,<br>
<br>
since AES-GCM is an authenticated encryption algorithm<br>
no hash algorithm is needed in the esp statement:<br>
<br>
esp=aes256gcm12-modp1536<br>
<br>
Regards<br>
<br>
Andreas<div><div><br>
<br>
On 21.06.2016 16:27, sandeep dubey wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi, s<br>
<br>
I am new to strongswan world and have successfully setup a tunnel<br>
between two AWS's VPC, But i have to make some changes in config to<br>
comply with security requirement which is not working even after<br>
multiple tries. I went through old bug for intel-eni which was fixed but<br>
couldn't find any way to check and confirm if i have that fix or not.<br>
<br>
Bug ref. - <a href="http://wiki.strongswan.org/issues/341" rel="noreferrer" target="_blank">http://wiki.strongswan.org/issues/341</a><br>
Fix ref. - <a href="https://marc.info/?l=linux-crypto-vger&m=139388786131685&w=2" rel="noreferrer" target="_blank">https://marc.info/?l=linux-crypto-vger&m=139388786131685&w=2</a><br>
<br>
The only difference in my working config and not working config is as<br>
below -<br>
<br>
Working with -<br>
ike=aes128-sha1-modp1024<br>
esp=aes128-sha1-modp1024<br>
<br>
Not working with -<br>
ike=aes256gcm12-sha256-modp1536<br>
esp=aes256gcm12-sha256-modp1536<br>
<br>
<br>
I am using ikev2 on EC2 instance with kernel 3.13.0-85-generic<br>
#129-Ubuntu SMP.<br>
<br>
Can someone help me ?<br>
<br>
--<br>
Regards,<br>
Sandeep<br>
</blockquote>
<br></div></div>
======================================================================<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a><br>
strongSwan - the Open Source VPN Solution! <a href="http://www.strongswan.org" rel="noreferrer" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
===========================================================[ITA-HSR]==<br>
<br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div data-smartmail="gmail_signature"><div dir="ltr">Regards,<div>Sandeep</div></div></div>
</div>
<br></div></div>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br></blockquote></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div data-smartmail="gmail_signature"><div dir="ltr">Regards,<div>Sandeep</div></div></div>
</div>
</blockquote></div>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Regards,<div>Sandeep</div></div></div>
</div>