<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif" dir="ltr">
<p></p>
<div>I had a problem enabling a Windows client to access strongSwan 5.5.1 on OpenSUSE 42.2. I was able get it working, but I'd like to understand why the workaround I identified was required. Appreciate your thoughts on this.</div>
<div><br>
</div>
<div>I first got iOS phone connecting to it, which was the primary driver for installing strongSwan. Next on the list was Windows 10-1703 (Latest).
</div>
<div><br>
</div>
<div>Updated ipsec.conf, created the certs and keys (script at end of message) and ipsec reload, copied the relvant bits to the Windows system and installed them via certmgr into the correct cert stores. When Windows tried to connect, it had a generic error.
strongSwan said:</div>
<div><br>
</div>
<div> Apr 12 19:27:09 host charon[5115]: 07[CFG] no IDr configured, fall back on IP address<br>
Apr 12 19:27:09 host charon[5115]: 07[IKE] no private key found for '192.168.x.x'<br>
Apr 12 19:27:09 host charon[5115]: 07[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]</div>
<div><br>
</div>
<div>This was true whether I tried from on the same LAN or from outside the firewall.</div>
<div>After a bit of head-scratching, added the server's internal IP address to the VPN host cert by adding "--san 192.168.x.x" (when creating vpnHostCert.pem)</div>
<div><br>
</div>
<div>ipsec pki --pub --in private/vpnHostKey.pem --type rsa | \<br>
ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem \<br>
--dn "C=CH, O=strongSwan, CN=host.domain.xxx" --san host.domain.xxx --san 192.168.x.x \<br>
--flag serverAuth --flag ikeIntermediate --outform pem > certs/vpnHostCert.pem</div>
<div>That fixed the problem, which is great, but based on everything I read, I shouldn't have needed to do that. The relevant log output now is:</div>
<div> Apr 12 19:31:23 host charon[5528]: 15[CFG] no IDr configured, fall back on IP address<br>
Apr 12 19:31:23 host charon[5528]: 15[IKE] authentication of '192.168.x.x' (myself) with RSA signature successful<br>
Apr 12 19:31:23 host charon[5528]: 15[IKE] IKE_SA IPSec-IKEV2[1] established between 192.168.x.x[192.168.x.x]...192.168.x.9[C=CH, O=strongSwan, CN=myemail@domain.xxx]</div>
<div><br>
</div>
<div><span style="font-family: "Lucida Console",Monaco,monospace;"></span>What other alternatives are there to make this work without adding the IP address? (aka the correct way)</div>
<div>Thanks</div>
<div>Network: Internet <---> Router (ports 500 and 4500 forwarded) <---> Linux system (192.168.x.x)</div>
<div>ipsec.conf<br>
----------<br>
config setup<br>
strictcrlpolicy=no<br>
uniqueids=no<br>
# nat_traversal=yes</div>
<div>conn %default<br>
dpdaction=clear<br>
dpddelay=35s<br>
dpdtimeout=200s<br>
fragmentation=yes<br>
rekey=no<br>
left=%any<br>
left=%defaultroute<br>
leftsubnet=0.0.0.0/0<br>
right=%any<br>
rightdns=192.168.x.x,8.8.8.8<br>
rightsourceip=10.92.10.1/24</div>
<div>conn iOS-IKEV2<br>
keyexchange=ikev2<br>
auto=add<br>
mobike=yes<br>
eap_identity=%any<br>
leftauth=psk<br>
leftid=xxx.domain.ipsec.server<br>
leftfirewall=yes<br>
rightauth=eap-mschapv2<br>
rightid=xxxt.domain.ipsec.client</div>
<div><br>
conn IPSec-IKEV2<br>
keyexchange=ikev2<br>
auto=add</div>
<div>conn IPSec-IKEV2-EAP<br>
also=IPSec-IKEV2<br>
ike=aes256-sha1-modp1024!<br>
esp=aes256-sha1!<br>
mobike=yes<br>
leftauth=pubkey<br>
leftcert=vpnHostCert.pem<br>
leftid=host.domain.xxx<br>
rightauth=eap-mschapv2<br>
rightsendcert=never<br>
eap_identity=%any</div>
<div><br>
Key and Cert creation<br>
-------------<br>
#!/bin/bash<br>
# Create CA<br>
# This is based on https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-your-own-vpn/<br>
#<br>
ipsec pki --gen --type rsa --size 4096 --outform pem > private/strongswanKey.pem<br>
chmod 600 private/strongswanKey.pem<br>
# Create self-signed root CA Cert<br>
ipsec pki --self --ca --lifetime 3650 --in private/strongswanKey.pem --type rsa \<br>
--dn "C=CH, O=strongSwan, CN=strongSwan Root CA" --outform pem > cacerts/strongswanCert.pem<br>
ipsec pki --print --in cacerts/strongswanCert.pem<br>
# Create VPN Host Key<br>
ipsec pki --gen --type rsa --size 2048 --outform pem > private/vpnHostKey.pem<br>
chmod 600 private/vpnHostKey.pem<br>
# Create VPN Host Cert<br>
ipsec pki --pub --in private/vpnHostKey.pem --type rsa | \<br>
ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem \<br>
--dn "C=CH, O=strongSwan, CN=host.domain.xxx" --san host.domain.xxx --san 192.168.x.x \<br>
--flag serverAuth --flag ikeIntermediate --outform pem > certs/vpnHostCert.pem<br>
ipsec pki --print --in certs/vpnHostCert.pem<br>
# Creat Client Key<br>
ipsec pki --gen --type rsa --size 2048 --outform pem > private/windowsKey.pem<br>
chmod 600 private/windowsKey.pem<br>
# Create Client Cert<br>
ipsec pki --pub --in private/windowsKey.pem --type rsa | \<br>
ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem \<br>
--dn "C=CH, O=strongSwan, CN=myemail@domain.xxx" --san myemail@domain.xxx --outform pem > certs/winhostCert.pem<br>
#<br>
# Export Client Cert as a PKCS#12 file<br>
#<br>
openssl pkcs12 -export -inkey private/windowsKey.pem \<br>
-in certs/windowsCert.pem -name "windows VPN Certificate" \<br>
-certfile cacerts/strongswanCert.pem \<br>
-caname "strongSwan Root CA" \<br>
-out windows.p12</div>
<div><br>
</div>
<br>
<p></p>
</div>
</body>
</html>