<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Thanks for the help and happy new year.<div class=""><br class=""></div><div class="">IIUC, ipsec.conf is used by starter, but I execute charon directly and then use swanctl to load swanctl.conf. So I’m not sure if ipsec.conf is relevant here. The secret is specified in swanctl.conf already, I’m also not sure if ipsec.secret is consulted since it’s also only used by starter.</div><div class=""><br class=""></div><div class="">Regards</div><div class="">Glen<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 3 Jan 2018, at 10:23 AM, Quaker <<a href="mailto:bigboyq@gmail.com" class="">bigboyq@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">1. peer config is related to ipsec.conf<div class="">2. As your log, AUTH_FAILED might also caused by ipsec.conf, when finished ipsec.conf, you should config ipsec.secret also</div><div class=""><br class=""></div></div><div class="gmail_extra"><br clear="all" class=""><div class=""><div class="gmail_signature" data-smartmail="gmail_signature">Regards<br class="">Quaker</div></div>
<br class=""><div class="gmail_quote">On Tue, Jan 2, 2018 at 7:00 PM, <span dir="ltr" class=""><<a href="mailto:users-request@lists.strongswan.org" target="_blank" class="">users-request@lists.strongswan.org</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send Users mailing list submissions to<br class="">
<a href="mailto:users@lists.strongswan.org" class="">users@lists.strongswan.org</a><br class="">
<br class="">
To subscribe or unsubscribe via the World Wide Web, visit<br class="">
<a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank" class="">https://lists.strongswan.org/<wbr class="">mailman/listinfo/users</a><br class="">
or, via email, send a message with subject or body 'help' to<br class="">
<a href="mailto:users-request@lists.strongswan.org" class="">users-request@lists.<wbr class="">strongswan.org</a><br class="">
<br class="">
You can reach the person managing the list at<br class="">
<a href="mailto:users-owner@lists.strongswan.org" class="">users-owner@lists.strongswan.<wbr class="">org</a><br class="">
<br class="">
When replying, please edit your Subject line so it is more specific<br class="">
than "Re: Contents of Users digest..."<br class="">
<br class="">
<br class="">
Today's Topics:<br class="">
<br class="">
1. Help needed for a basic swanctl config (Glen Huang)<br class="">
<br class="">
<br class="">
------------------------------<wbr class="">------------------------------<wbr class="">----------<br class="">
<br class="">
Message: 1<br class="">
Date: Tue, 2 Jan 2018 18:54:27 +0800<br class="">
From: Glen Huang <<a href="mailto:heyhgl@gmail.com" class="">heyhgl@gmail.com</a>><br class="">
To: <a href="mailto:users@lists.strongswan.org" class="">users@lists.strongswan.org</a><br class="">
Subject: [strongSwan] Help needed for a basic swanctl config<br class="">
Message-ID: <<a href="mailto:BC3FDE8E-B7AB-48EC-8C56-320F42C71661@gmail.com" class="">BC3FDE8E-B7AB-48EC-8C56-<wbr class="">320F42C71661@gmail.com</a>><br class="">
Content-Type: text/plain; charset=utf-8<br class="">
<br class="">
Hi,<br class="">
<br class="">
I’m trying to set up an IKEv2 VPN server using swanctl for iOS clients.<br class="">
<br class="">
I have this very simple config:<br class="">
<br class="">
connections {<br class="">
ios {<br class="">
version = 2<br class="">
pools = ios_pool<br class="">
remote {<br class="">
id = foobar<br class="">
auth = psk<br class="">
}<br class="">
}<br class="">
}<br class="">
<br class="">
pools {<br class="">
ios_pool {<br class="">
addrs = <a href="http://192.168.37.0/24" rel="noreferrer" target="_blank" class="">192.168.37.0/24</a><br class="">
dns = 8.8.8.8<br class="">
}<br class="">
}<br class="">
<br class="">
secrets {<br class="">
ike-ios {<br class="">
secret = abc<br class="">
}<br class="">
}<br class="">
<br class="">
But when connect from an iOS client using the following connection settings:<br class="">
<br class="">
Remote ID: foobar<br class="">
Local ID: [empty]<br class="">
Authentication Settings: None<br class="">
Shared Secret: abc<br class="">
<br class="">
It fails to connect, and the log shows it fails at an pretty early stage:<br class="">
<br class="">
12[NET] received packet: from 2.2.2.2[500] to 1.1.1.1[500] (604 bytes)<br class="">
12[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]<br class="">
12[IKE] 2.2.2.2 is initiating an IKE_SA<br class="">
12[IKE] remote host is behind NAT<br class="">
12[IKE] sending cert request for "C=com, O=myvpn, CN=VPN CA"<br class="">
12[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(MULT_AUTH) ]<br class="">
12[NET] sending packet: from 1.1.1.1[500] to 2.2.2.2[500] (473 bytes)<br class="">
15[NET] received packet: from 2.2.2.2[500] to 1.1.1.1[500] (604 bytes)<br class="">
15[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]<br class="">
15[IKE] received retransmit of request with ID 0, retransmitting response<br class="">
15[NET] sending packet: from 1.1.1.1[500] to 2.2.2.2[500] (473 bytes)<br class="">
05[NET] received packet: from 2.2.2.2[4500] to 1.1.1.1[4500] (544 bytes)<br class="">
05[ENC] unknown attribute type (25)<br class="">
05[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) N(MOBIKE_SUP) IDr AUTH CPRQ(ADDR DHCP DNS MASK ADDR6 DHCP6 DNS6 (25)) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ]<br class="">
05[CFG] looking for peer configs matching 1.1.1.1[foobar]...2.2.2.2[192.<wbr class="">168.1.251]<br class="">
05[CFG] no matching peer config found<br class="">
05[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding<br class="">
05[IKE] peer supports MOBIKE<br class="">
05[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br class="">
05[NET] sending packet: from 1.1.1.1[4500] to 2.2.2.2[4500] (80 bytes)<br class="">
<br class="">
I’m trying to have a firm grasp of strongswan (I have some basic understanding of ikev2 & IPsec), so a few questions:<br class="">
<br class="">
1. What constitutes a "peer config” in swanctl.conf?<br class="">
2. The AUTH_FAILED message is caused by a secret mismatch or unable to find a connection setting or something else?<br class="">
3. How do I find out in the logs the kind of auth request sent by the client? The iOS Client client provides quite a few authentication settings, and I’d like to learn how charon sees them in order to provide the corresponding settings in swanctl.conf<br class="">
<br class="">
Thanks in advance.<br class="">
<br class="">
<br class="">
End of Users Digest, Vol 96, Issue 2<br class="">
******************************<wbr class="">******<br class="">
</blockquote></div><br class=""></div>
</div></blockquote></div><br class=""></div></body></html>