<div dir="ltr">Hi Andreas,<div><br></div><div>Glad, that "<span style="font-size:12.8px"> ipsec start --nofork" helped. </span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">I see that the charon crashed with the following error: </span></div><div><span style="font-size:12.8px"><br></span></div><div>
<p class="gmail-p1"><b>/usr/libexec/ipsec/charon: symbol lookup error: /usr/lib/ipsec/plugins/libstrongswan-openssl.so: undefined symbol: EC_POINT_is_on_curve</b></p>
<p class="gmail-p1"><b>charon has died -- restart scheduled (5sec)</b></p><p class="gmail-p1">Even though openssl is shown as part of the loaded configs, this error seems to get hit. Is there anything that I am possibly missing whike compiling?</p><p class="gmail-p1">-Lakshmi</p></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Aug 2, 2016 at 3:26 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Lakshmi,<br>
<br>
there must be a more detailed log somewhere. Just try<br>
<br>
grep charon /var/log/*<br>
<br>
and see if you get any hits in a log file (usually either<br>
daemon.log, syslog or messages).<br>
<br>
Alternatively just start the daemon in the foreground so that<br>
you get the complete log on in the console window:<br>
<br>
ipsec start --nofork<br>
<br>
I suspect that the problem is not with the DH group but<br>
with the selection of the PSK which is needed for Main Mode 3.<br>
<br>
Regards<br>
<br>
Andreas<br>
<span class=""><br>
On 02.08.2016 11:45, Lakshmi Prasanna wrote:<br>
> bash-4.2# ipsec up 9.11.53.11-9.11.120.120-0-1812<br>
><br>
> initiating Main Mode IKE_SA 9.11.53.11-9.11.120.120-0-1812[1] to<br>
> 9.11.120.120<br>
><br>
> generating ID_PROT request 0 [ SA V V V V ]<br>
><br>
> sending packet: from 9.11.53.11[500] to 9.11.120.120[500] (156 bytes)<br>
><br>
> received packet: from 9.11.120.120[500] to 9.11.53.11[500] (136 bytes)<br>
><br>
> parsed ID_PROT response 0 [ SA V V V ]<br>
><br>
> received strongSwan vendor ID<br>
><br>
> received XAuth vendor ID<br>
><br>
> received DPD vendor ID<br>
><br>
> generating ID_PROT request 0 [ KE No ]<br>
><br>
> sending packet: from 9.11.53.11[500] to 9.11.120.120[500] (132 bytes)<br>
><br>
> received packet: from 9.11.120.120[500] to 9.11.53.11[500] (116 bytes)<br>
><br>
> parsed ID_PROT response 0 [ KE No ]<br>
><br>
> There is no more logs beyond this and my wireshark capture stops at MM2.<br>
><br>
> - Lakshmi<br>
><br>
><br>
> On Tue, Aug 2, 2016 at 3:12 PM, Andreas Steffen<br>
</span>> <<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a> <mailto:<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a>>><br>
<span class="">> wrote:<br>
><br>
> Well then without a log to diagnose I cannot help you further.<br>
><br>
> Andreas<br>
><br>
> On 02.08.2016 11:38, Lakshmi Prasanna wrote:<br>
> > Hi Andreas,<br>
> ><br>
> > Thanks for the quick reply. I do see that the openssl plugin is loaded.<br>
> ><br>
> > * loaded plugins: charon aes des rc2 sha1 sha2 md5 random nonce x509<br>
> > revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey<br>
> > pem _openssl_ fips-prf xcbc cmac hmac attr kernel-netlink resolve<br>
> > socket-default stroke updown xauth-generic*<br>
> ><br>
> > Do you think there is something else that I might need to check?<br>
> ><br>
> > Thanks,<br>
> ><br>
> > Lakshmi<br>
> ><br>
> ><br>
> > On Tue, Aug 2, 2016 at 2:56 PM, Andreas Steffen<br>
> > <<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
> <mailto:<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a>><br>
</span>> <mailto:<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
<div class="HOEnZb"><div class="h5">> <mailto:<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a>>>><br>
> > wrote:<br>
> ><br>
> > Hi Lakshmi,<br>
> ><br>
> > ECP256 requires the openssl plugin which is not compiled by<br>
> default.<br>
> > Make sure that the openssl plugin is present and has been loaded<br>
> > by the charon daemon. The ipsec statusall command returns a<br>
> list of<br>
> > all loaded plugins.<br>
> ><br>
> > BTW - the pfs parameter has been deprecated. Please use the esp<br>
> > parameter as you have correctly done.g<br>
> ><br>
> > Regards<br>
> ><br>
> > Andreas<br>
> ><br>
> > On 02.08.2016 08:48, Lakshmi Prasanna wrote:<br>
> > > Hello,<br>
> > ><br>
> > > While trying to test strongswan with IKE DH group-19, the<br>
> negotiation<br>
> > > somehow doesn't go past main mode 2. There is however no log to<br>
> > describe<br>
> > > the error that prevents the negotiation.<br>
> > ><br>
> > > Could someone post some insight? My configs looks like this:<br>
> > ><br>
> > > keyexchange=ikev1<br>
> > ><br>
> > > type=transport<br>
> > ><br>
> > > ikelifetime=480m<br>
> > ><br>
> > > ike=aes256-sha256-ecp256!<br>
> > ><br>
> > > esp=aes256-sha256!<br>
> > ><br>
> > > left=9.11.120.120<br>
> > ><br>
> > > leftprotoport=17/1812<br>
> > ><br>
> > > right=9.11.53.11<br>
> > ><br>
> > > rightprotoport=17/0-1812<br>
> > ><br>
> > > pfs=no<br>
> > ><br>
> > > authby=psk<br>
> > ><br>
> > > auto=add<br>
> > ><br>
> > ><br>
> > > Thanks,<br>
> > ><br>
> > > Lakshmi<br>
> > ><br>
</div></div><div class="HOEnZb"><div class="h5">======================================================================<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
strongSwan - the Open Source VPN Solution! <a href="http://www.strongswan.org" rel="noreferrer" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
===========================================================[ITA-HSR]==<br>
<br>
</div></div></blockquote></div><br></div>