<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hello,</div><div><br></div><div>IPSec has several associations.</div><div>First one is master (IKE_SA) and it is estableshed in your case.</div><div>Then, it should create child (CHILD_SA)</div><div><a href="https://security.stackexchange.com/questions/86130/difference-between-ipsec-sa-and-child-sa?answertab=votes#tab-top">https://security.stackexchange.com/questions/86130/difference-between-ipsec-sa-and-child-sa?answertab=votes#tab-top</a><br></div><div><br></div><div>This step failed because sides did not come to agreement on proposals (algorithms or network config).</div><div><br></div>You may use "ipsec start --nofork --debug-all" to debug it.<br></div><div dir="ltr"><br></div><div>>NAT</div><div><br></div><div>StrongSwan does not do NAT. It does not do "routing" either.</div><div>Linux kernel does it. But it kernel uses policies to route traffic (see xfrm, ip-xfrm(8)). </div><div>StrongSwan uses this kernel API to configure this policies.</div><div><br></div><div><br></div></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jan 21, 2019 at 4:38 PM Kostya Vasilyev <<a href="mailto:kman@fastmail.com">kman@fastmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello,<br>
<br>
I'm trying to switch from Racoon to StrongSwan for an IPSEC GRE server on Linux.<br>
<br>
The client is a Mikrotik router with a static (fixed) IP address.<br>
<br>
The connection errors out like this on the StrongSwan side. I've enabled debug logging for cfg.<br>
<br>
charon[18267]: 13[IKE] IKE_SA mytunnel[2] established between 139.0.0.1[139.0.0.1]...89.0.0.1[89.0.0.1]<br>
charon[18267]: 13[IKE] IKE_SA mytunnel[2] established between 139.0.0.1[139.0.0.1]...89.0.0.1[89.0.0.1]<br>
<br>
( so far so good, right? )<br>
...<br>
<br>
charon[18147]: 05[NET] received packet: from 89.0.0.1[4500] to 139.0.0.1[4500] (668 bytes)<br>
charon[18147]: 05[ENC] parsed QUICK_MODE request 3175828953 [ HASH SA No KE ID ID NAT-OA NAT-OA ]<br>
charon[18147]: 05[CFG] looking for a child config for <a href="http://139.0.0.1/32%5Bgre%5D" rel="noreferrer" target="_blank">139.0.0.1/32[gre]</a> === <a href="http://89.0.0.1/32%5Bgre%5Dcharon%5B18147" rel="noreferrer" target="_blank">89.0.0.1/32[gre]<br>
charon[18147</a>]: 05[CFG] proposing traffic selectors for us:<br>
charon[18147]: 05[CFG] <a href="http://139.0.0.1/32" rel="noreferrer" target="_blank">139.0.0.1/32</a><br>
charon[18147]: 05[CFG] proposing traffic selectors for other:<br>
charon[18147]: 05[CFG] <a href="http://89.0.0.1/32" rel="noreferrer" target="_blank">89.0.0.1/32</a><br>
charon[18147]: 05[CFG] candidate "mytunnel" with prio 1+1<br>
charon[18147]: 05[CFG] found matching child config "mytunnel" with prio 2<br>
charon[18147]: 05[CFG] selecting traffic selectors for other:<br>
charon[18147]: 05[CFG] config: <a href="http://89.0.0.1/32" rel="noreferrer" target="_blank">89.0.0.1/32</a>, received: <a href="http://89.0.0.1/32%5Bgre%5D" rel="noreferrer" target="_blank">89.0.0.1/32[gre]</a> => match: <a href="http://89.0.0.1/32%5Bgre%5Dcharon%5B18147" rel="noreferrer" target="_blank">89.0.0.1/32[gre]<br>
charon[18147</a>]: 05[CFG] selecting traffic selectors for us:<br>
charon[18147]: 05[CFG] config: <a href="http://139.0.0.1/32" rel="noreferrer" target="_blank">139.0.0.1/32</a>, received: <a href="http://139.0.0.1/32%5Bgre%5D" rel="noreferrer" target="_blank">139.0.0.1/32[gre]</a> => match: <a href="http://139.0.0.1/32%5Bgre%5Dcharon%5B18147" rel="noreferrer" target="_blank">139.0.0.1/32[gre]<br>
charon[18147</a>]: 05[IKE] no matching CHILD_SA config found for <a href="http://89.0.0.1/32%5Bgre%5D" rel="noreferrer" target="_blank">89.0.0.1/32[gre]</a> === <a href="http://139.0.0.1/32%5Bgre%5Dcharon%5B18147" rel="noreferrer" target="_blank">139.0.0.1/32[gre]<br>
charon[18147</a>]: 05[ENC] generating INFORMATIONAL_V1 request 3282603997 [ HASH N(INVAL_ID) ]<br>
<br>
( the "no matching CHILD_SA" error )<br>
<br>
The server (Linux) is 139.0.0.1, the client (Mikrotik) is 89.0.0.1.<br>
<br>
I found the following email message about same error, but there it was a typo (192.168. vs. 192.186.) in config files.<br>
<br>
<a href="https://lists.strongswan.org/pipermail/users/2014-May/006155.html" rel="noreferrer" target="_blank">https://lists.strongswan.org/pipermail/users/2014-May/006155.html</a><br>
<br>
Not the case for me, I've checked and rechecked my configs for typos already.<br>
<br>
My ipsec.config:<br>
<br>
conn mytunnel<br>
right=89.0.0.1<br>
left=139.0.0.1<br>
authby=secret<br>
# use auto=start when done testing the tunnel<br>
auto=start<br>
<br>
And ipsec.secrets:<br>
<br>
89.0.0.1 139.0.0.1 : PSK "..."<br>
<br>
The server's interfaces:<br>
<br>
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000<br>
inet <a href="http://139.0.0.1/24" rel="noreferrer" target="_blank">139.0.0.1/24</a> brd 139..... scope global eth0<br>
<br>
<br>
14: tun1@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1426 qdisc noqueue state UNKNOWN group default qlen 1000<br>
link/gre 139.0.0.1 peer 89.0.0.1<br>
inet 10.0.0.1 peer <a href="http://10.0.0.2/32" rel="noreferrer" target="_blank">10.0.0.2/32</a> scope global tun1<br>
valid_lft forever preferred_lft forever<br>
<br>
The tun1 is created at boot time using a script, Racoon needed this, not sure if StrongSwan does.<br>
<br>
ip link add tun1 type gre local 139.0.0.1 remote 89.0.0.1 ttl 255<br>
ip link set tun1 mtu 1426<br>
ip link set tun1 up<br>
ip addr add <a href="http://10.0.0.1/24" rel="noreferrer" target="_blank">10.0.0.1/24</a> peer 10.0.0.2 dev tun1<br>
<br>
I also have rules for NAT over the GRE connection but right now with StrongSwan can't get that far.<br>
<br>
iptables -A FORWARD -i eth0 -d <a href="http://10.0.0.0/24" rel="noreferrer" target="_blank">10.0.0.0/24</a> -m state --state ESTABLISHED,RELATED -j ACCEPT<br>
iptables -A FORWARD -s <a href="http://10.0.0.0/24" rel="noreferrer" target="_blank">10.0.0.0/24</a> -o eth0 -j ACCEPT<br>
iptables -t nat -A POSTROUTING -s <a href="http://10.0.0.0/24" rel="noreferrer" target="_blank">10.0.0.0/24</a> -o eth0 -j MASQUERADE<br>
<br>
For comparison here is my working Racoon config:<br>
<br>
remote 89.0.0.1 {<br>
exchange_mode main;<br>
initial_contact on;<br>
<br>
dpd_delay 20;<br>
dpd_retry 2;<br>
dpd_maxfail 2;<br>
rekey on;<br>
verify_identifier off;<br>
my_identifier address 139.0.0.1;<br>
peers_identifier address 89.0.0.1;<br>
lifetime time 24 hours;<br>
proposal {<br>
encryption_algorithm aes;<br>
hash_algorithm sha1;<br>
authentication_method pre_shared_key;<br>
dh_group modp1024;<br>
}<br>
}<br>
<br>
Any idea why StrongSwan ends up with "no matching CHILD_SA config" error?<br>
<br>
Also about NAT - with Racoon I had it configured "externally" to Racoon, in scripts that run at system boot. Does StrongSwan operate differently (Does it expect NAT configuration to be set up the same way, externally, or can it do that for me? If so, where can I find an example please?)<br>
<br>
-- <br>
Kostya Vasilyev<br>
<a href="mailto:kman@fastmail.com" target="_blank">kman@fastmail.com</a><br>
</blockquote></div>