<!DOCTYPE html>
<html>
<head>
<title></title>
<style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style>
</head>
<body><div>Based on this in an earlier message:<br></div>
<div><br></div>
<div>"you disabled log message for cfg, so you didn't see the details of the proposal negotiation"<br></div>
<div><br></div>
<div>... you may want to enable "cfg" logging under "charondebug"<br></div>
<div><br></div>
<div><a href="https://wiki.strongswan.org/projects/strongswan/wiki/ConfigSetupSection">https://wiki.strongswan.org/projects/strongswan/wiki/ConfigSetupSection</a><br></div>
<div><br></div>
<div>And then you should be able to see the actual proposal sent by the client (Windows) which should help troubleshoot.<br></div>
<div><br></div>
<div>-- K</div>
<div><br></div>
<div>On Wed, Feb 13, 2019, at 9:38 PM, MOSES KARIUKI wrote:<br></div>
<blockquote type="cite"><div dir="ltr"><div dir="ltr"><div style="font-family:tahoma, sans-serif;">Thanks Tobias for the quick response. I set this up, the Registry value and below configuration, but still the same error. <br></div>
<div style="font-family:tahoma, sans-serif;"><br></div>
<div><div><span class="font" style="font-family:tahoma, " sans-serif"">config setup</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> charondebug="ike 1, knl 1, cfg 0"</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> uniqueids=no</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""></span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif"">conn ikev2-vpn</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> auto=add</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> compress=no</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> type=tunnel</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> keyexchange=ikev2</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> fragmentation=yes</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> forceencaps=yes</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> dpdaction=clear</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> dpddelay=300s</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> rekey=no</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> left=%any</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> leftid=102.1*9.2*9.**</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> leftcert=server-cert.pem</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> leftsendcert=always</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> leftsubnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a></span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> right=%any</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> rightid=%any</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> rightauth=eap-mschapv2</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> rightsourceip=<a href="http://10.10.10.0/24">10.10.10.0/24</a></span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> rightdns=8.8.8.8,8.8.4.4</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> rightsendcert=never</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> eap_identity=%identity</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> ike=aes256-sha1-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024! </span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""> esp=aes256-sha256,aes256-sha1,3des-sha1!</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""></span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif"">Thanks a lot</span><br></div>
<div><span class="font" style="font-family:tahoma, " sans-serif""></span><br></div>
</div>
</div>
</div>
<div><br></div>
<div defang_data-gmailquote="yes"><div dir="ltr">On Wed, Feb 13, 2019 at 5:45 PM Tobias Brunner <<a href="mailto:tobias@strongswan.org">tobias@strongswan.org</a>> wrote:<br></div>
<blockquote defang_data-gmailquote="yes" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204, 204, 204);padding-left:1ex;"><div>Hi Moses,<br></div>
<div> <br></div>
<div> Configure an IKE proposal that's accepted by your peer (you disabled log<br></div>
<div> message for cfg, so you didn't see the details of the proposal<br></div>
<div> negotiation). Most likely the problem is that modp1024 is proposed, a<br></div>
<div> DH group strongSwan doesn't include in its default IKE proposal anymore.<br></div>
<div> So to use it, IKE proposals have to be configured explicitly. Also see<br></div>
<div> [1] for information on how to get Windows to use at least modp2048.<br></div>
<div> <br></div>
<div> Regards,<br></div>
<div> Tobias<br></div>
<div> <br></div>
<div> [1]<br></div>
<div> <a href="https://wiki.strongswan.org/projects/strongswan/wiki/WindowsClients#AES-256-CBC-and-MODP2048">https://wiki.strongswan.org/projects/strongswan/wiki/WindowsClients#AES-256-CBC-and-MODP2048</a><br></div>
</blockquote></div>
</blockquote><div><br></div>
</body>
</html>