<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Ok... I've spent a few nights setting it up the old way. <br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Now the new way does not work... :-(((</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Can you please maybe give me a hint as to why?</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>Old ipsec.conf:</b></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>conn myvpn<br>
</span>
<div> keyexchange=ikev1<br>
</div>
<div> left=%defaultroute<br>
</div>
<div> auto=add<br>
</div>
<div> authby=secret<br>
</div>
<div> type=transport<br>
</div>
<div> leftprotoport=17/1701<br>
</div>
<div> rightprotoport=17/1701<br>
</div>
<div> right=<remote-ip><br>
</div>
<div> rightsubnet=0.0.0.0/0<br>
</div>
<div> ike=3des-sha1-modp1536!<br>
</div>
<span> esp=3des-sha1!</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b><span>Old ipsec.secrets:</span></b></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span> : PSK "<key>"<br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>New swanctl.conf:</b><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>connections {<br>
</span>
<div> myvpn {<br>
</div>
<div> version = 1<br>
</div>
<div> remote_addrs = <remote-ip> <br>
</div>
<div> proposals = 3des-sha1-modp1536<br>
</div>
<div><br>
</div>
<div> local {<br>
</div>
<div> auth = psk<br>
</div>
<div> }<br>
</div>
<div> remote {<br>
</div>
<div> auth = psk<br>
</div>
<div> }<br>
</div>
<div><br>
</div>
<div> children {<br>
</div>
<div> myvpn {<br>
</div>
<div> mode = transport<br>
</div>
<div> esp_proposals = 3des-sha1<br>
</div>
<div> remote_ts = 0.0.0.0/0<br>
</div>
<div> }<br>
</div>
<div> }<br>
</div>
<div> }<br>
</div>
<div>}<br>
</div>
<div><br>
</div>
secrets {<br>
<div> ike {<br>
</div>
<div> secret = <key><br>
</div>
<div> }<br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>I get a virtually identical output until - see in red:</div>
<div><br>
</div>
<div><b>old - working</b></div>
<div>...<b><br>
</b></div>
<div><span>ipsec[1592]: 01[IKE] IKE_SA myvpn[1] established between <span><local-ip></span>[<local-ip>]...<span><remote-ip></span>[<span><span><remote-ip></span></span>]<br>
</span>
<div>ipsec[1592]: 01[IKE] scheduling <span style="color: rgb(200, 38, 19);">reauthentication</span> in 10104s<br>
</div>
<div>ipsec[1592]: 01[IKE] maximum IKE_SA lifetime 10644s<br>
</div>
<div>ipsec[1592]: 01[ENC] generating QUICK_MODE request 2607643999 [ HASH SA No ID ID NAT-OA NAT-OA ]<br>
</div>
</div>
<div><span>ipsec[1592]: 01[NET] sending packet: from <local-ip>[4500] to <remote-ip>[4500] (188 bytes)<br>
</span>
<div>ipsec[1592]: 06[NET] received packet: from <span><remote-ip></span>[4500] to
<span><local-ip></span>[4500] <span style="color: rgb(200, 38, 19);">(204 bytes)</span><br>
</div>
<div><span style="color: rgb(200, 38, 19);">ipsec[1592]: 06[ENC] parsed QUICK_MODE response 2607643999 [ HASH SA No ID ID N((24576)) NAT-OA NAT-OA ]</span><br>
</div>
<span style="color: rgb(200, 38, 19);">ipsec[1592]: 06[CFG] selected proposal: ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ</span><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><b>new - non-working</b></div>
<div><span>...<br>
</span></div>
<div><span>[IKE] IKE_SA myvpn[1] established between <span><span><local-ip></span>[<local-ip>]...<span><remote-ip></span>[<span><span><remote-ip></span></span>]</span></span><br>
</div>
<div><span>[IKE] scheduling </span><span style="color: rgb(200, 38, 19);">rekeying</span><span> in 14101s<br>
</span>
<div>[IKE] maximum IKE_SA lifetime 15541s<br>
</div>
<div>[ENC] generating QUICK_MODE request 2783263997 [ HASH SA No ID ID NAT-OA NAT-OA ]<br>
</div>
<div></div>
<span>01[NET] sending packet: from <local-ip>[4500] to <remote-ip>[4500] (188 bytes)<br>
</span>
<div>06[NET] received packet: from <span><remote-ip></span>[4500] to <span><local-ip></span>[4500]
<span style="color: rgb(200, 38, 19)">(84 bytes)</span></div>
<div><span style="color: rgb(200, 38, 19);">[ENC] parsed INFORMATIONAL_V1 request 394177358 [ HASH D ]</span><br>
</div>
<div><span style="color: rgb(200, 38, 19);">[IKE] received DELETE for IKE_SA myvpn[1]</span><br>
</div>
<div><span style="color: rgb(200, 38, 19);">[IKE] deleting IKE_SA myvpn[1] between
<span><span><span><local-ip></span>[<local-ip>]</span></span>...<span><span><span><remote-ip></span>[<span><span><remote-ip></span></span>]</span></span></span><br>
</div>
<div><span style="color: rgb(200, 38, 19);">initiate failed: establishing CHILD_SA 'myvpn' failed</span><br>
</div>
<span></span><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Something wrong with <key>? If I use the wrong key on purpose, I get the same result: immediate failure. Quotes / no quotes don't make a difference<br>
</div>
<div><br>
</div>
<span></span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> Andreas Steffen <andreas.steffen@strongswan.org><br>
<b>Sent:</b> Monday, 8 July 2019 17:19<br>
<b>To:</b> A P; users@lists.strongswan.org<br>
<b>Subject:</b> Re: [strongSwan] Strongswan 5.8 broke my setup</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">Hi,<br>
<br>
since strongSwan 5.8 is a major version we made the following changes<br>
to the naming of the strongSwan systemd service files:<br>
<br>
systemctl start strongswan now starts the charon-systemd daemon which<br>
communicates via the vici interface e.g. using the swanctl command<br>
line tool<br>
<br>
systemctl start strongswan-swanctl is now an alias for<br>
systemctl start strongswan<br>
<br>
The old behaviour with the starter process spawning the charon daemon<br>
which in turn communicates via the whack interface can be retained<br>
just by executing<br>
<br>
systemctl start strongswan-starter<br>
<br>
Sorry for the inconvenience but vici and swanctl.conf has been our<br>
preferred way of managing strongSwan for the last few years and this<br>
is a further step to make it our default. Nevertheless we are still<br>
committed to support the old whack and ipsec.conf interface.<br>
<br>
Best regards<br>
<br>
Andreas<br>
<br>
On 07.07.19 17:50, A P wrote:<br>
> I used to do:<br>
> <br>
> systemctl restart strongswan<br>
> systemctl restart xl2tpd<br>
> ipsec up myvpn<br>
> <br>
> <br>
> Now the last step produces nothing!<br>
> <br>
> <br>
> The difference in the logs:<br>
> <br>
> - new log (broken setup) has these, which old (working) does not have:<br>
> swanctl[29887]: no files found matching '/etc/swanctl/conf.d/*.conf'<br>
> swanctl[29887]: no authorities found, 0 unloaded<br>
> swanctl[29887]: no pools found, 0 unloaded<br>
> swanctl[29887]: no connections found, 0 unloaded<br>
> <br>
> - old log (working) has these, which new one (broken) never has:<br>
> ipsec[1592]: charon (1601) started after 20 ms<br>
> ipsec_starter[1592]: charon (1601) started after 20 ms<br>
> charon[1601]: 07[CFG] received stroke: add connection 'myvpn'<br>
> charon[1601]: 07[CFG] added configuration 'myvpn'<br>
> <br>
> <br>
> Why did you have to break things?<br>
======================================================================<br>
Andreas Steffen andreas.steffen@strongswan.org<br>
strongSwan - the Open Source VPN Solution! <a href="http://www.strongswan.org">
www.strongswan.org</a><br>
Institute for Networked Solutions<br>
HSR University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
===========================================================[INS-HSR]==<br>
<br>
</div>
</span></font></div>
</div>
</body>
</html>