<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi there,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">A short update. Most of the below remains true.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I now have permission to test from a Laptop running Ubuntu which is tethered to my phone.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Some additional information from $ sudo ike-scan -v -M -m -1 -y 1 -A 50.45.0.51<o:p></o:p></p>
<p class="MsoNormal">DEBUG : pkt len=356 bytes, bandwidth=56000 bps, int=54857 us<o:p></o:p></p>
<p class="MsoNormal">Startng ike-scan 1.9.4 with 1 hosts (<a href="http://www.nta-monitor.com/tools/ike-scan">http://www.nta-monitor.com/tools/ike-scan</a>)<o:p></o:p></p>
<p class="MsoNormal">--- Pass 1 of 3 completed<o:p></o:p></p>
<p class="MsoNormal">--- Pass 2 of 3 completed<o:p></o:p></p>
<p class="MsoNormal">--- Pass 3 of 3 completed<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Ending ike-scan 1.9.4: 1 hosts scanned in 2.451 seconds (0.41 hosts/sec). 0 returned handshake; 0 returned notify<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The VPN provider is a Fortigate.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-GB">--<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-GB">Stephen Feyrer</span></b><b><span style="color:#1F497D;mso-fareast-language:EN-GB"><o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:#A6A6A6;mso-fareast-language:EN-GB">DevOps Engineer</span><span style="color:#1F497D;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:#A6A6A6;mso-fareast-language:EN-GB">Greensill Capital<o:p></o:p></span></p>
<p class="MsoNormal"><a href="mailto:stephen.feyrer@greensill.com"><span style="font-size:9.0pt;mso-fareast-language:EN-GB">stephen.feyrer@greensill.com</span></a><span style="color:#1F497D;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><a href="http://www.greensill.com"><span style="font-size:9.0pt;mso-fareast-language:EN-GB">http://www.greensill.com</span></a><span style="font-size:9.0pt;color:#A6A6A6;mso-fareast-language:EN-GB">
<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="mso-fareast-language:EN-GB">From:</span></b><span lang="EN-US" style="mso-fareast-language:EN-GB"> Stephen Feyrer
<br>
<b>Sent:</b> 08 August 2019 17:17<br>
<b>To:</b> users@lists.strongswan.org<br>
<b>Subject:</b> peer not responding<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi there,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My situation is an odd one. I have on my desktop a Linux Virtual Machine (Debian) running in virtual box which I need to setup a IPSec/l2tp VPN client thus to be able to provide guidance to external users to set up their connections.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In virtualbox I have set rules to forward the ports 50, 51, 500 and 4500 to the VM.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have an officeVPN.conf file which looks like:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">conn officeVPN<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> aggressive=yes<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> type=tunnel <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> authby=psk <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> keyexchange=ikev1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> left=%defaultroute <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> leftprotoport=udp/l2tp <o:p>
</o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> right= 50.45.0.51<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> rightprotoport=udp/l2tp <o:p>
</o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> auto=add<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">An officeVPN.secrets that looks like:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">: PSK "StrongKey-Honest!"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">An /etc/strongswan.conf that has the following line:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">i_dont_care_about_security_and_use_aggressive_mode_psk=yes<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Then the ipsec up officeVPN command is run:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"># ipsec up officeVPN<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">Initiating Aggressive Mode IKE_SA officeVPN[1] to 50.54.0.51<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">Generating AGGRESSIVE request 0 [ SA KE No ID V V V V V ]<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.45.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 1 of request message ID 0, seq 1
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.45.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 2 of request message ID 0, seq 1
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.45.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 3 of request message ID 0, seq 1
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.45.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 4 of request message ID 0, seq 1
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.45.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 5 of request message ID 0, seq 1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">giving up after 5 retransmits<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">peer not responding, trying again (2/3)
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">Initiating Aggressive Mode IKE_SA officeVPN[1] to 50.54.0.51<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">Generating AGGRESSIVE request 0 [ SA KE No ID V V V V V ]<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.45.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 1 of request message ID 0, seq 1
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.45.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 2 of request message ID 0, seq 1
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.45.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 3 of request message ID 0, seq 1
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.45.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 4 of request message ID 0, seq 1
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.45.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 5 of request message ID 0, seq 1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">giving up after 5 retransmits<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">peer not responding, trying again (3/3)
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">Initiating Aggressive Mode IKE_SA officeVPN[1] to 50.54.0.51<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">Generating AGGRESSIVE request 0 [ SA KE No ID V V V V V ]<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.45.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 1 of request message ID 0, seq 1
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.45.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 2 of request message ID 0, seq 1
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.45.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 3 of request message ID 0, seq 1
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.5.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 4 of request message ID 0, seq 1
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending packet: from a.b.c.d [500] to 50.45.0.51[500] (320 bytes)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">sending retransmit 5 of request message ID 0, seq 1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">giving up after 5 retransmits<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">establishing IKE_SA failed, peer not responding<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">establishing connection ‘officeVPN’ failed.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">From the logs I get lines like:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">Starting strongSwan 5.7.2 IPsec [starter]…<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">Starting IKE charon daemon (strongSwan 5.7.2, Linux 4.19.0-5-amd64, x86-64)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">loading ca certificates from ‘/etc/ipsec.d/cacerts’<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">loading aa certificates from ‘/etc/ipsec.d/aacerts’<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">loading ocsp signer certificates from ‘/etc/ipsec.d/ocspcerts’<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">loading attribute certificates from ‘/etc/ipsec.d/acerts’<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">loading crls from ‘/etc/ipsec.d/crls’<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">loading secrets from ‘/etc/ipsec.d/officeVPN.sercrets’<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> loading IKE secret for officeVPN 50.45.0.51<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">loaded plugins: charon aesni aes rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation…<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">dropped capabilities, running as uid 0, gid 0<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">spawning 16 worker threads<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">charon (1499) started after 20 ms<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">received stroke: add connection ‘officeVPN’<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">added configuration ‘officeVPN’<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">received stroke: initiate ‘officeVPN’<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Where a.b.c.d is the local IP of the host and 50.54.0.51 is the VPN server.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Nothing that I have tried has had a positive effect. Thank you for your patience. I may be going about this wholly the wrong way, so any suggestions would be gratefully received.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-GB">--<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-GB">Stephen Feyrer</span></b><b><span style="color:#1F497D;mso-fareast-language:EN-GB"><o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:#A6A6A6;mso-fareast-language:EN-GB">DevOps Engineer</span><span style="color:#1F497D;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:#A6A6A6;mso-fareast-language:EN-GB">Greensill Capital<o:p></o:p></span></p>
<p class="MsoNormal"><a href="mailto:stephen.feyrer@greensill.com"><span style="font-size:9.0pt;mso-fareast-language:EN-GB">stephen.feyrer@greensill.com</span></a><span style="color:#1F497D;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><a href="http://www.greensill.com"><span style="font-size:9.0pt;mso-fareast-language:EN-GB">http://www.greensill.com</span></a><span style="font-size:9.0pt;color:#A6A6A6;mso-fareast-language:EN-GB">
<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p style="font-size:6pt; font-family: 'Cambria','times roman',serif;">This message is for the designated recipient only and may contain privileged, proprietary or otherwise confidential information. If you have received this in error, please contact the sender
immediately and delete the original. Any other use of this e-mail by you is prohibited. If we collect and use your personal data we will use it in accordance with our
<a href="http://www.greensill.com/privacy/">privacy policy</a>. Greensill Capital (UK) Limited. Registered in England and Wales. Registered Number: 8126173. Registered Office: One Southampton Street, Covent Garden, London, WC2R 0LR, United Kingdom. Greensill
Capital Pty Limited. Australian Company Number: 154 088 132. Registered Office: 62 –66 Woondooma Street, Bundaberg, Queensland 4670, Australia.</p>
<br>
</body>
</html>