<div dir="ltr">Hello,<div><br></div><div>I'm trying to connect a Strongswan Client hosted on Amazon EC2 public (not VPC) to a Cisco device over ikev1.</div><div>Since we are hosted on EC2, we have the EC2 gateway NAT in front of our instance.</div><div><br></div><div><br></div><div><div>I have done a Virtuabox simulation setup using 4 Linux VM and Strongswan, ie<br></div><div>Linux1 /my EC2 <------> Linux 2 / 1:1 NAT <-----------> Linux 3 / Cisco VPN <----------> Linux 4 / remote server to access.</div><div>Using this, I have validated my "Linux1/EC2" is should be to communicate over IPSec with NAT-T over a 1:1 NAT. It works... with Strongswan as server.</div></div><div><br></div><div>However, it does not work with the Cisco VPN device we're trying to connect to</div><div><br></div><div>the Strongswan clients keeps rekeying phase 1 (ie ipsec status all keps looping between CONNECTING/ESTABLISHED continuously)</div><div><br></div><div><br></div><div>Adding modeconfig=push as suggested by the documentation makes the Security Association stable, however the connections get stuck trying to negociate phase 2, in tasks queued: QUICK_MODE</div><div>I can see with tcpdump that NAT-T packets are sent, I see the first response from the Cisco device over NAT-T but nothing more.</div><div>
<p class="gmail-p1"><span class="gmail-s1">16:56:28.391047 IP ip-10-104-164-139.eu-west-1.compute.internal.isakmp > vpn_cisco_gateway.isakmp: isakmp: phase 1 I ident<br></span>16:56:28.470397 IP vpn_cisco_gateway.isakmp > ip-10-104-164-139.eu-west-1.compute.internal.isakmp: isakmp: phase 1 R ident<br>16:56:28.485469 IP ip-10-104-164-139.eu-west-1.compute.internal.isakmp > vpn_cisco_gateway.isakmp: isakmp: phase 1 I ident<br>16:56:28.566259 IP vpn_cisco_gateway.isakmp > ip-10-104-164-139.eu-west-1.compute.internal.isakmp: isakmp: phase 1 R ident<br>16:56:28.648297 IP ip-10-104-164-139.eu-west-1.compute.internal.ipsec-nat-t > vpn_cisco_gateway.ipsec-nat-t: NONESP-encap: isakmp: phase 1 I ident[E]<br>16:56:28.731272 IP vpn_cisco_gateway.ipsec-nat-t > ip-10-104-164-139.eu-west-1.compute.internal.ipsec-nat-t: NONESP-encap: isakmp: phase 1 R ident[E]<br>16:56:52.596800 IP ip-10-104-164-139.eu-west-1.compute.internal.ipsec-nat-t > vpn_cisco_gateway.ipsec-nat-t: isakmp-nat-keep-alive</p></div><div>and nothing more exept keepalives</div><div><br></div><div><br></div><div>Any help or suggestion to help how to troubleshoot further the issue are welcome.</div><div>regards</div><div>J.G</div><div><br></div><div><br></div><div>the local and remote configurations are, with context:</div><div><a href="http://123.123.22.22">123.123.22.22</a>: using some public ip address for the internal network, on purpose to avoid collision with VPN provider</div><div><div>PUBLIC_EC2_IP_ADDRESS is our public EC2 elastic IP address.<br></div><div>VPN_GATEWAY_PUBLIC_IP the public IP address of the remote VPN Cisco device</div><div>VPN_GATEWAY_INTERNAL_IP internal IP address of the remote VPN Cisco device</div><div>SERVER_IP_BEHIND_VPN_GATEWAY is the address of remote server&service we want to access from our EC2 instance over the IPSEC Tunnel<br></div><div>VPN_REMOTE_NETWORK the remote network & mask that includes the two previous hosts<br></div><div>OUR_VPN_PROVIDER_GATEWAY is the next hop gateway for the Cisco VPN to reach the internet</div></div><div><br></div><div><br></div><div><div>config setup</div><div> charondebug="knl 3, ike 4,esp 4,cfg 4, mgr 4, net4"</div><div><br></div><div>conn %default</div><div> ikelifetime=60m</div><div> keylife=20m</div><div> rekeymargin=3m</div><div> keyingtries=1</div><div> keyexchange=ikev1</div><div> authby=secret</div><div><br></div><div>conn test</div><div> left=%any</div><div> leftsourceip=123.123.22.22</div><div> leftid=PUBLIC_EC2_IP_ADDRESS </div><div> leftfirewall=yes</div><div> right=VPN_GATEWAY_PUBLIC_IP </div><div> rightid=VPN_GATEWAY_PUBLIC_IP </div><div> rightsubnet=VPN_REMOTE_NETWORK / 27</div><div> auto=add</div></div><div> modeconfig=push #or disable</div><div> ike=3des-md5-modp1024!<br> esp=aes-sha1!</div><div><span style="font-size:12.8px"><br></span></div><div>the Cisco device configuration is :</div><div><br></div><div><div><br></div><div>crypto keyring keyring_customer</div><div> pre-shared-key address PUBLIC_EC2_IP_ADDRESS key THE_SECRET_PSK</div><div>!</div><div>crypto isakmp profile profile_customer</div><div> vrf vrf_customer</div><div> keyring keyring_customer</div><div> match identity address PUBLIC_EC2_IP_ADDRESS 255.255.255.255</div><div>!</div><div>crypto map cmallserv1 130 ipsec-isakmp</div><div> description customer_vpn</div><div> set peer PUBLIC_EC2_IP_ADDRESS</div><div>set transform-set ts-esp-aes256-esp-sha-hmac</div><div> set isakmp-profile profile_customer</div><div> match address access_list_customer</div><div>!</div><div>ip route PUBLIC_EC2_IP_ADDRESS 255.255.255.255 TenGigabitEthernet0/1/0.1300 OUR_VPN_PROVIDER_GATEWAY</div><div>ip route vrf vrf_customer 123.123.22.22 255.255.255.255 TenGigabitEthernet0/1/0.1300 OUR_VPN_PROVIDER_GATEWAY global</div><div>!</div><div>ip access-list extended access_list_customer</div><div>permit ip host VPN_GATEWAY_INTERNAL_IP host 123.123.22.22</div><div><br></div><div>permit ip host SERVER_IP_BEHIND_VPN_GATEWAY host 123.123.22.22</div><div>!</div><div>router bgp 6000</div><div> scope vrf icssmsc:vrf_customer</div><div> address-family ipv4</div><div> redistribute static</div><div>!</div><div>end</div></div></div>