<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div> </div>
<div>I am running Strongswan Linux strongSwan U5.4.0/K2.6.32-358.el6.i686. I am trying to create a tunnel from a Cisco ASA 5520 8.4(7). I am trying to create a tunnel with the transform set ESP-NULL and ESP-NONE, essentially I am going for pure performance and do not want any encryption or integrity. The data I am sending is end-to-end encrypted anyway. If the ASA supported GRE I would be using GRE for this purpose. I can get the tunnel to come up so long as I chose an integrity algorithim. Even performing the integrity imposes a signifigant performance hit over baseline with my limiting factor being the ASA.</div>
<div> </div>
<div>My config and log dumps are as follows:</div>
<div> </div>
<div>ASA:</div>
<div>----<br/>
crypto ipsec ikev1 transform-set ESP-NULL-SHA esp-null esp-sha-hmac<br/>
crypto ipsec ikev1 transform-set ESP-NULL-NONE esp-null esp-none<br/>
crypto ipsec security-association lifetime kilobytes 999999999<br/>
crypto map outside_map 1 match address outside_1_cryptomap<br/>
crypto map outside_map 1 set peer 10.1.9.119<br/>
crypto map outside_map 1 set ikev1 transform-set ESP-NULL-NONE<br/>
crypto map outside_map interface outside<br/>
crypto ikev1 enable outside<br/>
crypto ikev1 policy 10<br/>
authentication pre-share<br/>
encryption aes-256<br/>
hash sha<br/>
group 2<br/>
lifetime 86400<br/>
----</div>
<div> </div>
<div>The above tunnel does not come up. The tunnel with the following does come up:</div>
<div> </div>
<div>---<br/>
crypto map outside_map 1 set ikev1 transform-set ESP-NULL-SHA<br/>
---</div>
<div> </div>
<div>My Strongswan config is as follows:</div>
<div>-----<br/>
conn thetun<br/>
keyexchange=ikev1<br/>
aggressive=no<br/>
authby=secret<br/>
left=10.1.9.119<br/>
leftsubnet=0.0.0.0/0<br/>
right=10.1.9.50<br/>
rightsubnet=192.168.2.0/24<br/>
auto=add<br/>
ike=aes256-sha1-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024!<br/>
esp=null<br/>
-----</div>
<div> </div>
<div>The above tunnel does not come up. When I use the following (in conjunction with ESP-NULL-SHA on the ASA it does come up):</div>
<div> </div>
<div>--<br/>
esp=null-sha<br/>
--</div>
<div> </div>
<div>What's odd is that a strongswan to strongswan setup comes up just fine with "esp=null".</div>
<div> </div>
<div>Here are my log dumps:</div>
<div> </div>
<div>Strongswan, with NULL-NONE:</div>
<div>----<br/>
Jan 6 14:32:27 16[NET] <1> received packet: from 10.1.9.50[500] to 10.1.9.119[500] (172 bytes)<br/>
Jan 6 14:32:27 16[ENC] <1> parsed ID_PROT request 0 [ SA V V V V ]<br/>
Jan 6 14:32:27 16[IKE] <1> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID<br/>
Jan 6 14:32:27 16[IKE] <1> received draft-ietf-ipsec-nat-t-ike-03 vendor ID<br/>
Jan 6 14:32:27 16[IKE] <1> received NAT-T (RFC 3947) vendor ID<br/>
Jan 6 14:32:27 16[IKE] <1> received FRAGMENTATION vendor ID<br/>
Jan 6 14:32:27 16[IKE] <1> 10.1.9.50 is initiating a Main Mode IKE_SA<br/>
Jan 6 14:32:27 16[ENC] <1> generating ID_PROT response 0 [ SA V V V ]<br/>
Jan 6 14:32:27 16[NET] <1> sending packet: from 10.1.9.119[500] to 10.1.9.50[500] (140 bytes)<br/>
Jan 6 14:32:27 14[NET] <1> received packet: from 10.1.9.50[500] to 10.1.9.119[500] (304 bytes)<br/>
Jan 6 14:32:27 14[ENC] <1> parsed ID_PROT request 0 [ KE No V V V V NAT-D NAT-D ]<br/>
Jan 6 14:32:27 14[IKE] <1> received Cisco Unity vendor ID<br/>
Jan 6 14:32:27 14[IKE] <1> received XAuth vendor ID<br/>
Jan 6 14:32:27 14[ENC] <1> received unknown vendor ID: 17:a9:c0:b2:e9:f7:2e:e0:34:25:8c:f6:5e:a5:58:28<br/>
Jan 6 14:32:27 14[ENC] <1> received unknown vendor ID: 1f:07:f7:0e:aa:65:14:d3:b0:fa:96:54:2a:50:01:00<br/>
Jan 6 14:32:27 14[ENC] <1> generating ID_PROT response 0 [ KE No NAT-D NAT-D ]<br/>
Jan 6 14:32:27 14[NET] <1> sending packet: from 10.1.9.119[500] to 10.1.9.50[500] (244 bytes)<br/>
Jan 6 14:32:27 12[NET] <1> received packet: from 10.1.9.50[500] to 10.1.9.119[500] (92 bytes)<br/>
Jan 6 14:32:27 12[ENC] <1> parsed ID_PROT request 0 [ ID HASH V ]<br/>
Jan 6 14:32:27 12[IKE] <1> received DPD vendor ID<br/>
Jan 6 14:32:27 12[CFG] <1> looking for pre-shared key peer configs matching 10.1.9.119...10.1.9.50[10.1.9.50]<br/>
Jan 6 14:32:27 12[CFG] <1> selected peer config "thetun"<br/>
Jan 6 14:32:27 12[IKE] <thetun|1> IKE_SA thetun[1] established between 10.1.9.119[10.1.9.119]...10.1.9.50[10.1.9.50]<br/>
Jan 6 14:32:27 12[IKE] <thetun|1> scheduling reauthentication in 3241s<br/>
Jan 6 14:32:27 12[IKE] <thetun|1> maximum IKE_SA lifetime 3421s<br/>
Jan 6 14:32:27 12[ENC] <thetun|1> generating ID_PROT response 0 [ ID HASH ]<br/>
Jan 6 14:32:27 12[NET] <thetun|1> sending packet: from 10.1.9.119[500] to 10.1.9.50[500] (76 bytes)<br/>
Jan 6 14:32:27 10[NET] <thetun|1> received packet: from 10.1.9.50[500] to 10.1.9.119[500] (204 bytes)<br/>
Jan 6 14:32:27 10[ENC] <thetun|1> parsed QUICK_MODE request 576741339 [ HASH SA No ID ID N(INITIAL_CONTACT) ]<br/>
Jan 6 14:32:27 10[IKE] <thetun|1> received 28800s lifetime, configured 1200s<br/>
Jan 6 14:32:27 10[IKE] <thetun|1> received 999999999000 lifebytes, configured 0<br/>
Jan 6 14:32:27 10[ENC] <thetun|1> generating QUICK_MODE response 576741339 [ HASH SA No ID ID ]<br/>
Jan 6 14:32:27 10[NET] <thetun|1> sending packet: from 10.1.9.119[500] to 10.1.9.50[500] (188 bytes)<br/>
Jan 6 14:32:27 09[NET] <thetun|1> received packet: from 10.1.9.50[500] to 10.1.9.119[500] (76 bytes)<br/>
Jan 6 14:32:27 09[ENC] <thetun|1> parsed INFORMATIONAL_V1 request 3090240294 [ HASH D ]<br/>
Jan 6 14:32:27 09[IKE] <thetun|1> received DELETE for ESP CHILD_SA with SPI 891a112a<br/>
Jan 6 14:32:27 09[IKE] <thetun|1> CHILD_SA not found, ignored<br/>
Jan 6 14:32:27 16[NET] <thetun|1> received packet: from 10.1.9.50[500] to 10.1.9.119[500] (92 bytes)<br/>
Jan 6 14:32:27 16[ENC] <thetun|1> parsed INFORMATIONAL_V1 request 3728127385 [ HASH D ]<br/>
Jan 6 14:32:27 16[IKE] <thetun|1> received DELETE for IKE_SA thetun[1]<br/>
Jan 6 14:32:27 16[IKE] <thetun|1> deleting IKE_SA thetun[1] between 10.1.9.119[10.1.9.119]...10.1.9.50[10.1.9.50]</div>
<div>---</div>
<div> </div>
<div>Strongswan, with NULL-SHA:</div>
<div> </div>
<div>---<br/>
Jan 6 14:35:15 01[NET] <1> received packet: from 10.1.9.50[500] to 10.1.9.119[500] (172 bytes)<br/>
Jan 6 14:35:15 01[ENC] <1> parsed ID_PROT request 0 [ SA V V V V ]<br/>
Jan 6 14:35:15 01[IKE] <1> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID<br/>
Jan 6 14:35:15 01[IKE] <1> received draft-ietf-ipsec-nat-t-ike-03 vendor ID<br/>
Jan 6 14:35:15 01[IKE] <1> received NAT-T (RFC 3947) vendor ID<br/>
Jan 6 14:35:15 01[IKE] <1> received FRAGMENTATION vendor ID<br/>
Jan 6 14:35:15 01[IKE] <1> 10.1.9.50 is initiating a Main Mode IKE_SA<br/>
Jan 6 14:35:15 01[ENC] <1> generating ID_PROT response 0 [ SA V V V ]<br/>
Jan 6 14:35:15 01[NET] <1> sending packet: from 10.1.9.119[500] to 10.1.9.50[500] (140 bytes)<br/>
Jan 6 14:35:15 14[NET] <1> received packet: from 10.1.9.50[500] to 10.1.9.119[500] (304 bytes)<br/>
Jan 6 14:35:15 14[ENC] <1> parsed ID_PROT request 0 [ KE No V V V V NAT-D NAT-D ]<br/>
Jan 6 14:35:15 14[IKE] <1> received Cisco Unity vendor ID<br/>
Jan 6 14:35:15 14[IKE] <1> received XAuth vendor ID<br/>
Jan 6 14:35:15 14[ENC] <1> received unknown vendor ID: b4:eb:ee:e2:40:69:e2:02:6a:a3:54:71:7f:16:8f:35<br/>
Jan 6 14:35:15 14[ENC] <1> received unknown vendor ID: 1f:07:f7:0e:aa:65:14:d3:b0:fa:96:54:2a:50:01:00<br/>
Jan 6 14:35:15 14[ENC] <1> generating ID_PROT response 0 [ KE No NAT-D NAT-D ]<br/>
Jan 6 14:35:15 14[NET] <1> sending packet: from 10.1.9.119[500] to 10.1.9.50[500] (244 bytes)<br/>
Jan 6 14:35:15 12[NET] <1> received packet: from 10.1.9.50[500] to 10.1.9.119[500] (92 bytes)<br/>
Jan 6 14:35:15 12[ENC] <1> parsed ID_PROT request 0 [ ID HASH V ]<br/>
Jan 6 14:35:15 12[IKE] <1> received DPD vendor ID<br/>
Jan 6 14:35:15 12[CFG] <1> looking for pre-shared key peer configs matching 10.1.9.119...10.1.9.50[10.1.9.50]<br/>
Jan 6 14:35:15 12[CFG] <1> selected peer config "thetun"<br/>
Jan 6 14:35:15 12[IKE] <thetun|1> IKE_SA thetun[1] established between 10.1.9.119[10.1.9.119]...10.1.9.50[10.1.9.50]<br/>
Jan 6 14:35:15 12[IKE] <thetun|1> scheduling reauthentication in 3342s<br/>
Jan 6 14:35:15 12[IKE] <thetun|1> maximum IKE_SA lifetime 3522s<br/>
Jan 6 14:35:15 12[ENC] <thetun|1> generating ID_PROT response 0 [ ID HASH ]<br/>
Jan 6 14:35:15 12[NET] <thetun|1> sending packet: from 10.1.9.119[500] to 10.1.9.50[500] (76 bytes)<br/>
Jan 6 14:35:15 10[NET] <thetun|1> received packet: from 10.1.9.50[500] to 10.1.9.119[500] (204 bytes)<br/>
Jan 6 14:35:15 10[ENC] <thetun|1> parsed QUICK_MODE request 1268007489 [ HASH SA No ID ID N(INITIAL_CONTACT) ]<br/>
Jan 6 14:35:15 10[IKE] <thetun|1> received 28800s lifetime, configured 1200s<br/>
Jan 6 14:35:15 10[IKE] <thetun|1> received 999999999000 lifebytes, configured 0<br/>
Jan 6 14:35:15 10[ENC] <thetun|1> generating QUICK_MODE response 1268007489 [ HASH SA No ID ID ]<br/>
Jan 6 14:35:15 10[NET] <thetun|1> sending packet: from 10.1.9.119[500] to 10.1.9.50[500] (188 bytes)<br/>
Jan 6 14:35:15 09[NET] <thetun|1> received packet: from 10.1.9.50[500] to 10.1.9.119[500] (76 bytes)<br/>
Jan 6 14:35:15 09[ENC] <thetun|1> parsed QUICK_MODE request 1268007489 [ HASH ]<br/>
Jan 6 14:35:15 09[IKE] <thetun|1> CHILD_SA thetun{1} established with SPIs c0e9e639_i f99f86da_o and TS 0.0.0.0/0 === 192.168.2.0/24</div>
<div><br/>
STATUSALL shows:</div>
<div>Security Associations (1 up, 0 connecting):<br/>
thetun[1]: ESTABLISHED 112 seconds ago, 10.1.9.119[10.1.9.119]...10.1.9.50[10.1.9.50]<br/>
thetun[1]: IKEv1 SPIs: 412c49ff4068e202_i 8e14130f46bfeb9d_r*, pre-shared key reauthentication in 53 minutes<br/>
thetun[1]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br/>
thetun{1}: INSTALLED, TUNNEL, reqid 1, ESP SPIs: c0e9e639_i f99f86da_o<br/>
thetun{1}: NULL/HMAC_SHA1_96, 10124 bytes_i (121 pkts, 1s ago), 0 bytes_o, rekeying in 12 minutes<br/>
thetun{1}: 0.0.0.0/0 === 192.168.2.0/24</div>
<div>---</div>
<div> </div>
<div>ASA with NULL-NONE:</div>
<div> </div>
<div>---<br/>
ciscoasa(config)# Jan 06 16:17:41 [IKEv1]IP = 10.1.9.119, IKE Initiator: New Phase 1, Intf inside, IKE Peer 10.1.9.119 local Proxy Address 192.168.2.0, remote Proxy Address 0.0.0.0, Crypto map (outside_map)<br/>
Jan 06 16:17:41 [IKEv1]IP = 10.1.9.119, Connection landed on tunnel_group 10.1.9.119<br/>
Jan 06 16:17:41 [IKEv1]Group = 10.1.9.119, IP = 10.1.9.119, Automatic NAT Detection Status: Remote end is NOT behind a NAT device This end is NOT behind a NAT device<br/>
Jan 06 16:17:41 [IKEv1]IP = 10.1.9.119, Connection landed on tunnel_group 10.1.9.119<br/>
Jan 06 16:17:41 [IKEv1]Group = 10.1.9.119, IP = 10.1.9.119, PHASE 1 COMPLETED<br/>
Jan 06 16:17:41 [IKEv1]Group = 10.1.9.119, IP = 10.1.9.119, Generating secret keys: unknown encryption algorithm!<br/>
Jan 06 16:17:41 [IKEv1]Group = 10.1.9.119, IP = 10.1.9.119, Generating secret keys: unknown encryption algorithm!<br/>
Jan 06 16:17:41 [IKEv1]Group = 10.1.9.119, IP = 10.1.9.119, Security negotiation complete for LAN-to-LAN Group (10.1.9.119) Initiator, Inbound SPI = 0x068a607a, Outbound SPI = 0xc86c05d2<br/>
Jan 06 16:17:41 [IKEv1]Group = 10.1.9.119, IP = 10.1.9.119, QM FSM error (P2 struct &0x76f85318, mess id 0x3345b948)!<br/>
Jan 06 16:17:41 [IKEv1]Group = 10.1.9.119, IP = 10.1.9.119, Removing peer from correlator table failed, no match!<br/>
Jan 06 16:17:41 [IKEv1]Group = 10.1.9.119, IP = 10.1.9.119, Session is being torn down. Reason: Unknown</div>
<div>---</div>
<div> </div>
<div>ASA with NULL-SHA:</div>
<div> </div>
<div>----<br/>
ciscoasa(config)# Jan 06 16:19:44 [IKEv1]IP = 10.1.9.119, Connection landed on tunnel_group 10.1.9.119<br/>
Jan 06 16:19:44 [IKEv1]Group = 10.1.9.119, IP = 10.1.9.119, Automatic NAT Detection Status: Remote end is NOT behind a NAT device This end is NOT behind a NAT device<br/>
Jan 06 16:19:44 [IKEv1]IP = 10.1.9.119, Connection landed on tunnel_group 10.1.9.119<br/>
Jan 06 16:19:44 [IKEv1]Group = 10.1.9.119, IP = 10.1.9.119, PHASE 1 COMPLETED<br/>
Jan 06 16:19:44 [IKEv1]Group = 10.1.9.119, IP = 10.1.9.119, Generating secret keys: unknown encryption algorithm!<br/>
Jan 06 16:19:44 [IKEv1]Group = 10.1.9.119, IP = 10.1.9.119, Generating secret keys: unknown encryption algorithm!<br/>
Jan 06 16:19:44 [IKEv1]Group = 10.1.9.119, IP = 10.1.9.119, Security negotiation complete for LAN-to-LAN Group (10.1.9.119) Initiator, Inbound SPI = 0xae679c9a, Outbound SPI = 0xcef968c7<br/>
Jan 06 16:19:44 [IKEv1]Group = 10.1.9.119, IP = 10.1.9.119, PHASE 2 COMPLETED (msgid=ee427ffd)<br/>
---</div>
<div><br/>
</div></div></body></html>