<div dir="ltr">Hi <span style="font-size:14px">Tobias,</span><div><span style="font-size:14px"><br></span></div><div><span style="font-size:14px">Finally looks like it's configuration problem on remote peer. I can receive multiple proposals on remote peer now. </span></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div>Thank you so much for your help. Below is my testing ipsec.conf for reference, and remote peer is able to see 3des-sha1 proposal for both phase 1 and phase 2.</div><div><br></div><div><font face="monospace, monospace" size="1"><br></font></div><div><div><font face="monospace, monospace" size="1">~ # cat /etc/ipsec.conf</font></div><div><font face="monospace, monospace" size="1">config setup</font></div><div><font face="monospace, monospace" size="1"> uniqueids=yes</font></div><div><font face="monospace, monospace" size="1"> charondebug=""</font></div><div><font face="monospace, monospace" size="1"><br></font></div><div><font face="monospace, monospace" size="1">conn IPSEC1</font></div><div><font face="monospace, monospace" size="1"> type=tunnel</font></div><div><font face="monospace, monospace" size="1"> authby=secret</font></div><div><font face="monospace, monospace" size="1"> aggressive=no</font></div><div><font face="monospace, monospace" size="1"> left=10.90.45.1</font></div><div><font face="monospace, monospace" size="1"> ike=aes256-sha1-modp1024,3des-sha1-modp1024!</font></div><div><font face="monospace, monospace" size="1"> esp=aes128-sha2_256-modp1024,3des-sha1-modp1024!</font></div><div><font face="monospace, monospace" size="1"> forceencaps=no</font></div><div><font face="monospace, monospace" size="1"> keyexchange=ikev1</font></div><div><font face="monospace, monospace" size="1"> lifetime=28800s</font></div><div><font face="monospace, monospace" size="1"> ikelifetime=3600s</font></div><div><font face="monospace, monospace" size="1"> dpddelay=10</font></div><div><font face="monospace, monospace" size="1"> dpdtimeout=30</font></div><div><font face="monospace, monospace" size="1"> dpdaction=restart</font></div><div><font face="monospace, monospace" size="1"> rekey=yes</font></div><div><font face="monospace, monospace" size="1"> keyingtries=%forever</font></div><div><font face="monospace, monospace" size="1"> right=10.90.46.1</font></div><div><font face="monospace, monospace" size="1"><br></font></div><div><font face="monospace, monospace" size="1">conn IPSEC1-1x1</font></div><div><font face="monospace, monospace" size="1"> leftsubnet=<a href="http://192.168.1.0/24">192.168.1.0/24</a></font></div><div><font face="monospace, monospace" size="1"> rightsubnet=<a href="http://192.168.2.0/24">192.168.2.0/24</a></font></div><div><font face="monospace, monospace" size="1"> also=IPSEC1</font></div><div><font face="monospace, monospace" size="1"> auto=start</font></div><div><font face="monospace, monospace" size="1"><br></font></div><div><font face="monospace, monospace" size="1">conn IPSEC1-1x2</font></div><div><font face="monospace, monospace" size="1"> leftsubnet=<a href="http://192.168.1.0/24">192.168.1.0/24</a></font></div><div><font face="monospace, monospace" size="1"> rightsubnet=<a href="http://172.16.2.0/24">172.16.2.0/24</a></font></div><div><font face="monospace, monospace" size="1"> also=IPSEC1</font></div><div><font face="monospace, monospace" size="1"> auto=start</font></div><div><font face="monospace, monospace" size="1"><br></font></div><div><font face="monospace, monospace" size="1">conn IPSEC1-2x1</font></div><div><font face="monospace, monospace" size="1"> leftsubnet=<a href="http://172.16.1.0/24">172.16.1.0/24</a></font></div><div><font face="monospace, monospace" size="1"> rightsubnet=<a href="http://192.168.2.0/24">192.168.2.0/24</a></font></div><div><font face="monospace, monospace" size="1"> also=IPSEC1</font></div><div><font face="monospace, monospace" size="1"> auto=start</font></div><div><font face="monospace, monospace" size="1"><br></font></div><div><font face="monospace, monospace" size="1">conn IPSEC1-2x2</font></div><div><font face="monospace, monospace" size="1"> leftsubnet=<a href="http://172.16.1.0/24">172.16.1.0/24</a></font></div><div><font face="monospace, monospace" size="1"> rightsubnet=<a href="http://172.16.2.0/24">172.16.2.0/24</a></font></div><div><font face="monospace, monospace" size="1"> also=IPSEC1</font></div><div><font face="monospace, monospace" size="1"> auto=start</font></div></div><div><br></div><div><br></div><div dir="ltr"><br>Best regards,<br>Steve<br><div>
</div></div><div dir="ltr"><br></div></div></div>
<br><div class="gmail_quote">2016-08-30 20:08 GMT+08:00 Tobias Brunner <span dir="ltr"><<a href="mailto:tobias@strongswan.org" target="_blank">tobias@strongswan.org</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Steve,<br>
<br>
> About Q1, for example, remote peer only accept *3des-sha1-modp1024*, and<br>
<span class="gmail-">> local Strongswan using the following "ike" config.<br>
><br>
</span>> a) ike=aes256-sha1-modp1024,*<wbr>3des-sha1-modp1024*,aes128-<wbr>sha2_256-modp1024<br>
> b) ike=aes256-sha1-modp1024,*<wbr>3des-sha1-modp1024*,aes128-<wbr>sha2_256-modp1024!<br>
<span class="gmail-">><br>
> Config (a) works well and phase 1 passed using 3des-sha1-modp1024<br>
> without problem.<br>
><br>
> Config (b) failed and Strongswan only propose aes256-sha1-modp1024 to<br>
> remote peer, and the 3des proposal is not sent at all. The only<br>
> difference compared to (a) is I have added "!" to restrict Strongswan to<br>
> accept the defined proposal.<br>
><br>
> So question 1 is, why config (b) fail?<br>
<br>
</span>I can't reproduce this. When I use a) I get the following on the responder:<br>
<br>
> received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/<wbr>PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_<wbr>HMAC_SHA1/MODP_1024, IKE:AES_CBC_128/HMAC_SHA2_256_<wbr>128/PRF_HMAC_SHA2_256/MODP_<wbr>1024, IKE:AES_CBC_128/HMAC_SHA2_256_<wbr>128/PRF_HMAC_SHA2_256/MODP_<wbr>3072<br>
<br>
When I use b) I get this:<br>
<br>
> received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/<wbr>PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_<wbr>HMAC_SHA1/MODP_1024, IKE:AES_CBC_128/HMAC_SHA2_256_<wbr>128/PRF_HMAC_SHA2_256/MODP_<wbr>1024<br>
<br>
So the only difference is that the fourth proposal (derived from the<br>
default proposal) is not sent. Check what your responder is doing and<br>
why it fails.<br>
<span class="gmail-"><br>
> For Q2, using the same example, remote peer only accept<br>
</span>> *3des-sha1-modp1024* for phase 2, and local Strongswan using:<br>
><br>
> a) esp=aes256-sha1-modp1024,*<wbr>3des-sha1-modp1024*<br>
> b) esp=aes256-sha1-modp1024,*<wbr>3des-sha1-modp1024*!<br>
<span class="gmail-">><br>
> No matter (a) or (b), with or without "!", Strongswan never propose the<br>
> second 3des proposal to remote peer, the behavior is different compared<br>
> to "ike". Is this a bug?<br>
<br>
</span>Again, I can't reproduce it. But since these proposals include a DH<br>
group adding ! doesn't make a difference (because the default ESP<br>
proposal does not contain any DH groups it will be ignored).<br>
<br>
Are you really using 5.5.0? Did you modify the source code in any way?<br>
<br>
Regards,<br>
Tobias<br>
<br>
</blockquote></div><br></div></div>