<div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">Hello Team,</div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">This is the full LOG. The redacted IPs with ** are the VPN server (<span style="font-family:monospace,monospace">'102.1*9.2**.***'</span>) and Windows client (<span style="font-family:monospace,monospace">154.77.***.**</span>).</div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style=""><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[CFG] looking for peer configs matching 102.1*9.2**.***[%any]...154.77.***.**[192.168.43.156]</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[CFG] candidate "ikev2-vpn", match: 1/1/28 (me/other/ike)</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[CFG] selected peer config 'ikev2-vpn'</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[IKE] EAP-Identity request configured, but not supported</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[IKE] initiating EAP_MSCHAPV2 method (id 0x64)</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[IKE] peer supports MOBIKE</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[IKE] authentication of '102.1*9.2**.***' (myself) with RSA signature successful</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[IKE] sending end entity cert "CN=102.1*9.2**.***"</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/MSCHAPV2 ]</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[ENC] splitting IKE message with length of 1936 bytes into 2 fragments</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 charon: 11[ENC] generating IKE_AUTH response 1 [ EF(1/2) ]</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 charon: 11[ENC] generating IKE_AUTH response 1 [ EF(2/2) ]</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 charon: 11[NET] sending packet: from 102.1*9.2**.***[4500] to 154.77.***.**[4500] (1236 bytes)</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 charon: 11[NET] sending packet: from 102.1*9.2**.***[4500] to 154.77.***.**[4500] (772 bytes)</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:01 VM-e2b7 kernel: [ 2543.189073] [UFW BLOCK] IN=ens3 OUT= MAC=06:97:9c:00:00:8f:00:1d:b5:c0:a7:c0:08:00 SRC=154.77.***.** DST=102.1*9.2**.*** LEN=52 TOS=0x10 PREC=0x20 TTL=116 ID=27223 DF PROTO=TCP SPT=54229 DPT=443 WINDOW=17520 RES=0x00 SYN URGP=0</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:04 VM-e2b7 kernel: [ 2546.194639] [UFW BLOCK] IN=ens3 OUT= MAC=06:97:9c:00:00:8f:00:1d:b5:c0:a7:c0:08:00 SRC=154.77.***.** DST=102.1*9.2**.*** LEN=52 TOS=0x10 PREC=0x20 TTL=116 ID=27227 DF PROTO=TCP SPT=54229 DPT=443 WINDOW=17520 RES=0x00 SYN URGP=0</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:10 VM-e2b7 kernel: [ 2552.209139] [UFW BLOCK] IN=ens3 OUT= MAC=06:97:9c:00:00:8f:00:1d:b5:c0:a7:c0:08:00 SRC=154.77.***.** DST=102.1*9.2**.*** LEN=52 TOS=0x10 PREC=0x20 TTL=116 ID=27234 DF PROTO=TCP SPT=54229 DPT=443 WINDOW=17520 RES=0x00 SYN URGP=0</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:12 VM-e2b7 kernel: [ 2553.847176] [UFW BLOCK] IN=ens3 OUT= MAC=06:97:9c:00:00:8f:00:1d:b5:c0:a7:c0:08:00 SRC=191.96.110.25 DST=102.1*9.2**.*** LEN=44 TOS=0x00 PREC=0x00 TTL=248 ID=54321 PROTO=TCP SPT=50543 DPT=990 WINDOW=65535 RES=0x00 SYN URGP=0</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:22 VM-e2b7 kernel: [ 2564.254984] [UFW BLOCK] IN=ens3 OUT= MAC=06:97:9c:00:00:8f:00:1d:b5:c0:a7:c0:08:00 SRC=154.77.***.** DST=102.1*9.2**.*** LEN=44 TOS=0x10 PREC=0x20 TTL=113 ID=53967 PROTO=TCP SPT=54230 DPT=1723 WINDOW=32120 RES=0x00 SYN URGP=0</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:24 VM-e2b7 kernel: [ 2566.134188] [UFW BLOCK] IN=ens3 OUT= MAC=06:97:9c:00:00:8f:00:1d:b5:c0:a7:c0:08:00 SRC=154.77.***.** DST=102.1*9.2**.*** LEN=44 TOS=0x10 PREC=0x20 TTL=112 ID=53967 PROTO=TCP SPT=54230 DPT=1723 WINDOW=32120 RES=0x00 SYN URGP=0</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:24 VM-e2b7 kernel: [ 2566.425334] [UFW BLOCK] IN=ens3 OUT= MAC=06:97:9c:00:00:8f:00:1d:b5:c0:a7:c0:08:00 SRC=37.157.72.207 DST=102.1*9.2**.*** LEN=40 TOS=0x08 PREC=0x40 TTL=43 ID=10093 PROTO=TCP SPT=34401 DPT=8080 WINDOW=20539 RES=0x00 SYN URGP=0</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:30 VM-e2b7 charon: 14[JOB] deleting half open IKE_SA with 154.77.***.** after timeout</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:10:40 VM-e2b7 kernel: [ 2582.134308] [UFW BLOCK] IN=ens3 OUT= MAC=06:97:9c:00:00:8f:00:1d:b5:c0:a7:c0:08:00 SRC=154.77.***.** DST=102.1*9.2**.*** LEN=44 TOS=0x10 PREC=0x20 TTL=112 ID=53967 PROTO=TCP SPT=54230 DPT=1723 WINDOW=32120 RES=0x00 SYN URGP=0</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:11:08 VM-e2b7 kernel: [ 2610.346853] [UFW BLOCK] IN=ens3 OUT= MAC=06:97:9c:00:00:8f:00:1d:b5:c0:a7:c0:08:00 SRC=154.77.***.** DST=102.1*9.2**.*** LEN=136 TOS=0x10 PREC=0x20 TTL=116 ID=27300 PROTO=UDP SPT=1701 DPT=1701 LEN=116</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:12:13 VM-e2b7 kernel: [ 2674.792576] [UFW BLOCK] IN=ens3 OUT= MAC=06:97:9c:00:00:8f:00:1d:b5:c0:a7:c0:08:00 SRC=173.212.236.49 DST=102.1*9.2**.*** LEN=40 TOS=0x08 PREC=0x40 TTL=239 ID=12005 PROTO=TCP SPT=50816 DPT=50802 WINDOW=1024 RES=0x00 SYN URGP=0</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:13:28 VM-e2b7 charon: 13[CFG] proposing traffic selectors for us:</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:13:28 VM-e2b7 charon: 13[CFG] <a href="http://0.0.0.0/0">0.0.0.0/0</a></font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:13:28 VM-e2b7 charon: 13[CFG] proposing traffic selectors for other:</font></div><div class="gmail_default" style=""><font face="monospace, monospace">Feb 19 02:13:28 VM-e2b7 charon: 13[CFG] dynamic</font></div><div style="font-family:tahoma,sans-serif"><br></div><div style="font-family:tahoma,sans-serif">Thanks a lot for your assistance.</div><div style="font-family:tahoma,sans-serif"><br></div><div style="font-family:tahoma,sans-serif"><br></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Feb 19, 2019 at 1:03 PM Kostya Vasilyev <<a href="mailto:kman@fastmail.com">kman@fastmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Tue, Feb 19, 2019, at 12:50 PM, IL Ka wrote:<br>
> > But it could also be the client trying to fetch the CA certificate's CRL.<br>
> I now think you are right.<br>
> <br>
> Client tries to fetch whole cert chain and fails to do so.<br>
> It explains both: packet with DST=443 and client timeout.<br>
<br>
The missing EAP-identity support could also be an issue - there can be two problems at once not one.<br>
<br>
But this sequence -<br>
<br>
connection almost up, server sends packet to client, UFW blocks packet from client to server port 443<br>
<br>
- has occurred twice, in *two* of Moses' logs.<br>
<br>
Feb 19:<br>
<br>
Feb 19 02:10:01 VM-e2b7 charon: 11[NET] sending packet: from 102.1*9.2**.***[4500] to 154.77.***.**[4500] (772 bytes)<br>
Feb 19 02:10:01 VM-e2b7 kernel: [ 2543.189073] [UFW BLOCK] IN=ens3 OUT= MAC=06:97:9c:00:00:8f:00:1d:b5:c0:a7:c0:08:00 SRC=154.77.***.** DST=102.1*9.2**.*** LEN=52 TOS=0x10 PREC=0x20 TTL=116 ID=27223 DF PROTO=TCP SPT=54229 DPT=443 WINDOW=17520 RES=0x00 SYN URGP=0<br>
Feb 19 02:10:30 VM-e2b7 charon: 14[JOB] deleting half open IKE_SA with 154.77.***.** after timeout<br>
<br>
Feb 15:<br>
<br>
Feb 15 20:13:11 VM-e2b7eaee-4c52-4455-8364-c1977c8afa6a charon: 08[NET] sending packet: from 102.1*9.2*9.** [500] to 154.76.***.1*1 [500] (36 bytes)<br>
Feb 15 20:13:12 VM-e2b7eaee-4c52-4455-8364-c1977c8afa6a kernel: [ 1898.916216] [UFW BLOCK] IN=ens3 OUT= MAC=06:97:9c:00:00:8f:00:1d:b5:c0:a7:c0:08:00 SRC=154.76.122.161 DST=102.129.249.173 LEN=52 TOS=0x10 PREC=0x20 TTL=115 ID=24830 DF PROTO=TCP SPT=57716 DPT=443 WINDOW=17520 RES=0x00 SYN URGP=0<br>
<br>
Unfortunately this log is cut off short, there is no "deleting half open connection" here.<br>
<br>
But the server sending a UDP packet followed immediately by UFW BLOCK is.<br>
<br>
Moses - I would also consider getting things to work using the basic PSK auth method and only then switching to certs and EAP.<br>
<br>
It just might be easier to solve problems one at a time.<br>
<br>
-- K<br>
<br>
> <br>
> Whole chain must be installed on Win10 to sovle it<br>
> <br>
[<a href="http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" rel="noreferrer" target="_blank">http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail</a>]<br>
> Без вирусов. <a href="http://www.avg.com" rel="noreferrer" target="_blank">www.avg.com</a>[<a href="http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" rel="noreferrer" target="_blank">http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail</a>]<br>
[<a href="https://www.fastmail.com/mail/compose?u=c414417f#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" rel="noreferrer" target="_blank">https://www.fastmail.com/mail/compose?u=c414417f#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2</a>]<br>
> <br>
> On Tue, Feb 19, 2019 at 12:40 PM Kostya Vasilyev <<a href="mailto:kman@fastmail.com" target="_blank">kman@fastmail.com</a>> wrote:<br>
>> <br>
>> On Tue, Feb 19, 2019, at 12:34 PM, IL Ka wrote:<br>
>> > <br>
>> > On Tue, Feb 19, 2019 at 8:48 AM Kostya Vasilyev <<a href="mailto:kman@fastmail.com" target="_blank">kman@fastmail.com</a>> wrote:<br>
>> >> Looks like the connection is "almost there" but gets blocked by your firewall (UFW)<br>
>> >> <br>
>> >> Very end of your log:<br>
>> >> <br>
>> >> Feb 19 02:10:01 VM-e2b7 charon: 11[NET] sending packet: from 102.1*9.2**.***[4500] to 154.77.***.**[4500] (772 bytes)<br>
>> >> Feb 19 02:10:01 VM-e2b7 kernel: [ 2543.189073] [UFW BLOCK] IN=ens3 OUT= MAC=06:97:9c:00:00:8f:00:1d:b5:c0:a7:c0:08:00 SRC=154.77.***.** DST=102.1*9.2**.*** LEN=52 TOS=0x10 PREC=0x20 TTL=116 ID=27223 DF PROTO=TCP SPT=54229 DPT=443 WINDOW=17520 RES=0x00 SYN URGP=0<br>
>> >> Feb 19 02:10:30 VM-e2b7 charon: 14[JOB] deleting half open IKE_SA with 154.77.***.** after timeout<br>
>> > <br>
>> > <br>
>> > DPT=443 looks like OpenVPN or HTTPS. <br>
>> > IKE uses UDP/500 (or UDP/4500 in case of NAT).<br>
>> > <br>
>> > I am not sure this message is somehow connected to problem.<br>
>> > <br>
>> <br>
>> Could be unrelated - good find on the EAP-Identity<br>
>> <br>
>> But it could also be the client trying to fetch the CA certificate's CRL.<br>
>> <br>
>> Moses can you check if your CA cert has a CRL?<br>
>> <br>
>> openssl -text -noout -in your_CA_cert<br>
>> <br>
>> Is there a CRL? Is it an https:// link?<br>
>> <br>
>> X509v3 CRL Distribution Points:<br>
>> <br>
>> Full Name:<br>
>> URI:https://......<br>
>> <br>
>> -- K<br>
</blockquote></div>