<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hello everyone,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">as written in the subject, we have some problem to enable the parallelization described in the wiki:
<a href="https://wiki.strongswan.org/projects/strongswan/wiki/Pcrypt">https://wiki.strongswan.org/projects/strongswan/wiki/Pcrypt</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Our setup:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">One Ubuntu 16.04.3 LTS in Germany, one Ubuntu 16.04.3 LTS in Spain. Both are used to route certain hosts on every side via this line. The line itself is a dedicated 1Gbit Layer 2 connection. For security reasons, we like
to encrypt all traffic between those servers, using Strongswan.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I installed the Strongswan packet provided by Ubuntu. Tunnel is running fine, max throughput so far was around 800Mbit. To use the full capacity of the line, we wanted to use the pcrypt feature.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I tried tcrypt and crconf. Crconf isn’t working at all, but tcrypt works. Unfortunately my output is different compared to the wiki:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">root@iblsrv:# modprobe tcrypt alg="pcrypt(rfc4106(gcm(aes-aesni)))" type=3<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">modprobe: ERROR: could not insert 'tcrypt': Unknown symbol in module, or unknown parameter (see dmesg)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">but dmesg only shows the following error: "tcrypt: one or more tests failed!"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">module is loaded though:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">root@iblsrv:# lsmod | grep pcrypt<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">pcrypt<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I noticed there is no aes-ni plugin in the Ubuntu version of the packet:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Status of IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-96-generic, x86_64):<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> uptime: 5 days, since Oct 12 11:42:24 2017<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> malloc: sbrk 2543616, mmap 0, used 392416, free 2151200<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 4<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink
resolve socket-default connmark stroke updown<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Nevertheless, “cat “ lists a new entry at the very top, but it has a lower priority than some other entries (highest value in the list: 4000). Therefore it isn’t used:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">root@iblsrv: # cat /proc/crypto<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">name : rfc4106(gcm(aes-aesni))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">driver : pcrypt(pcrypt(rfc4106(gcm_base(ctr(aes-aesni),ghash-clmulni))))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">module : pcrypt<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">priority : 550<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">refcnt : 1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">selftest : passed<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">internal : no<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">type : aead<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">async : yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">blocksize : 1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">ivsize : 8<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">maxauthsize : 16<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">geniv : <none><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">There are no errors from Charon in syslog.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">My ipsec.conf from one side:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">config setup<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> charondebug="4"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> uniqueids=yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> strictcrlpolicy=no<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">conn host-to-host<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> ikelifetime=60m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> keylife=20m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> rekeymargin=3m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> keyingtries=1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> dpdaction=restart<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">conn trap-any<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> also=host-to-host<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> right=192.168.250.230<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> leftsubnet=0.0.0.0/0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> rightsubnet=172.22.1.28/32, 172.22.1.36/32<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> type=tunnel<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> authby=secret<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> auto=route<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> mark=42<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">ipsec statusall:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Status of IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-96-generic, x86_64):<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> uptime: 5 days, since Oct 12 11:42:24 2017<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> malloc: sbrk 2543616, mmap 0, used 392240, free 2151376<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 4<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink
resolve socket-default connmark stroke updown<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Listening IP addresses:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> 192.168.250.234<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> 192.168.250.229<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Connections:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any: %any...192.168.250.230 IKEv1/2, dpddelay=30s<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any: local: uses pre-shared key authentication<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any: remote: [192.168.250.230] uses pre-shared key authentication<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any: child: 0.0.0.0/0 === 172.22.1.28/32 172.22.1.36/32 TUNNEL, dpdaction=restart<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Routed Connections:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any{1}: ROUTED, TUNNEL, reqid 1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any{1}: 0.0.0.0/0 === 172.22.1.28/32 172.22.1.36/32<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Security Associations (1 up, 0 connecting):<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any[240]: ESTABLISHED 6 minutes ago, 192.168.250.229[192.168.250.229]...192.168.250.230[192.168.250.230]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any[240]: IKEv2 SPIs: 9bcf3c62125c333d_i* 51ac15c32eac7ea6_r, pre-shared key reauthentication in 46 minutes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any[240]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any{751}: INSTALLED, TUNNEL, reqid 1, ESP SPIs: cc9137a9_i c913b9b8_o<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any{751}: AES_CBC_128/HMAC_SHA1_96, 0 bytes_i (0 pkts, 9s ago), 0 bytes_o, rekeying in 8 minutes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any{751}: 10.200.1.50/32 10.200.1.70/32 === 172.22.1.28/32 172.22.1.36/32<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any{752}: INSTALLED, TUNNEL, reqid 1, ESP SPIs: cf0bce0d_i c4f1515b_o<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any{752}: AES_CBC_128/HMAC_SHA1_96, 36036 bytes_i (169 pkts, 2s ago), 41722 bytes_o (205 pkts, 2s ago), rekeying in 9 minutes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> trap-any{752}: 10.200.1.50/32 10.200.1.70/32 === 172.22.1.28/32 172.22.1.36/32<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Any hints to solve the issue are very much appreciated!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Cheers Manuel<o:p></o:p></span></p>
</div>
<p id="c1-id-7" style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><font id="c1-id-8" face="Arial"><strong id="c1-id-9"><font id="c1-id-10" style="FONT-SIZE: 11pt">Manuel Betz</font></strong><em id="c1-id-11"><font id="c1-id-12" style="FONT-SIZE: 10pt"><br id="c1-id-13">
Group IT Infrastructure - Network </font><br id="c1-id-14">
</em><font id="c1-id-15" style="FONT-SIZE: 11pt"><font id="c1-id-16" style="FONT-SIZE: 9pt">_______________________________________</font><br id="c1-id-17">
</font><font id="c1-id-18" style="FONT-SIZE: 9pt"><br id="c1-id-19">
<strong id="c1-id-67"><font id="c1-id-20" style="FONT-SIZE: 9pt"><font id="c1-id-21" color="#213e7f">GFT Technologies SE</font><br id="c1-id-22">
</font></strong><font id="c1-id-23" style="FONT-SIZE: 9pt"><font id="c1-id-24" style="FONT-SIZE: 9pt" color="#000000">Schelmenwasenstr. 34</font><br id="c1-id-25">
</font><font id="c1-id-26" style="FONT-SIZE: 9pt"><font id="c1-id-27" style="FONT-SIZE: 9pt"><font id="c1-id-28" style="FONT-SIZE: 9pt; TEXT-DECORATION: none; COLOR: black" color="black"><font id="c1-id-29" style="FONT-SIZE: 9pt"><font id="c1-id-30" style="FONT-SIZE: 9pt; TEXT-DECORATION: none; COLOR: black" color="#000000">70567
Stuttgart, Deutschland<br id="c1-id-31">
<br id="c1-id-32">
T </font><font id="c1-id-33" style="FONT-SIZE: 9pt; TEXT-DECORATION: none; COLOR: black; MARGIN-LEFT: 15px">+49 711 62042-117<br id="c1-id-34">
</font><font id="c1-id-35" style="FONT-SIZE: 9pt; TEXT-DECORATION: none; COLOR: black">F
</font><font id="c1-id-36" style="FONT-SIZE: 9pt; TEXT-DECORATION: none; COLOR: black; MARGIN-LEFT: 15px">+49 711 62042-101</font><br id="c1-id-40">
Manuel.Betz@gft.com<br id="c1-id-41">
</font><a id="c1-id-42" href="http://www.gft.com"><font id="c1-id-43" style="FONT-SIZE: 9pt; TEXT-DECORATION: none" color="#000000"></a><a id="c1-id-44" style="TEXT-DECORATION: none; COLOR: black" href="http://www.gft.com/de">www.gft.com</a></font>/de<br id="c1-id-45">
<a id="c1-id-46" style="TEXT-DECORATION: none" href="http://blog.gft.com/de"><font id="c1-id-47" style="FONT-SIZE: 9pt" color="#000000">http://blog.gft.com/de</font></a><br id="c1-id-48">
<a id="c1-id-49" style="TEXT-DECORATION: none" href="http://www.twitter.com/gft_de"><font id="c1-id-50" style="FONT-SIZE: 9pt" color="#000000">www.twitter.com/gft_de</font></a><br id="c1-id-51">
<br id="c1-id-52">
</font></font></font></font></font><font id="c1-id-53" face="Arial"><font id="c1-id-54" style="FONT-SIZE: 14pt" color="#213e7f"><font id="c1-id-55" style="FONT-SIZE: 14pt"><font id="c1-id-56" style="FONT-SIZE: 12pt"><font id="c1-id-57" style="FONT-SIZE: 12pt"><font id="c1-id-58" style="TEXT-DECORATION: none; COLOR: black" color="#000000"><font id="c1-id-59" style="FONT-SIZE: 11pt"><font id="c1-id-60" style="FONT-SIZE: 8pt" color="#666666">Geschäftsführende
Direktoren: <br id="c1-id-61">
Marika Lulay (CEO), Dr. Jochen Ruetz (CFO)<br id="c1-id-62">
Vorsitzender des Verwaltungsrats: Ulrich Dietz<br id="c1-id-63">
Registergericht: Amtsgericht Stuttgart, HRB 753709<br id="c1-id-64">
Sitz der Gesellschaft: Stuttgart<br id="c1-id-65">
</font><font id="c1-id-66" style="FONT-SIZE: 9pt">_______________________________________</font></font></font></font></font></font></font></font></p>
</body>
</html>