<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi colleagues,<div class=""><br class=""></div><div class="">is there anybody has experience connecting Cisco ASA with Strongswan using PSK?</div><div class=""><br class=""></div><div class="">I have the following configuration on SS side:</div><div class=""><br class=""></div><div class=""><div class="">ikev2-psk {</div></div><div class=""><div class=""> version = 2</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>[ . . . ]</div><div class=""> local {</div><div class=""> auth = pubkey</div><div class=""> certs = fullchain.pem</div><div class=""> id = myid</div><div class=""> }</div><div class=""> remote {</div><div class=""> auth = psk</div><div class=""> id = %any</div><div class=""> }</div><div class=""> children {</div><div class=""> psk-child {</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>[ . . . ]</div><div class=""> }</div><div class=""> }</div><div class="">}</div><div class=""><br class=""></div><div class=""><div class="">secrets {</div><div class=""> ike-1 {</div><div class=""> id = ciscoasa</div><div class=""> secret = q1w2e3</div><div class=""> }</div><div class="">}</div></div><div class=""><br class=""></div><div class="">and while I use on ASA 'crypto isakmp identity hostname’ (hostname is “ciscoasa"), this connection can be authenticated by SS:</div><div class=""><br class=""></div><div class=""><div class="">charon-systemd[1566]: looking for peer configs matching local[%any]...remote[ciscoasa]</div><div class="">charon-systemd[1566]: selected peer config 'ikev2-eap-mschapv2'</div><div class="">charon-systemd[1566]: authentication of 'ciscoasa' with pre-shared key successful</div><div class="">charon-systemd[1566]: constraint check failed: EAP identity '%any' required</div><div class="">charon-systemd[1566]: selected peer config 'ikev2-eap-mschapv2' unacceptable: non-matching authentication done</div><div class="">charon-systemd[1566]: switching to peer config 'ikev2-psk'</div><div class="">charon-systemd[1566]: IKE_SA ikev2-psk[45] established between local[fqdn]...remote[ciscoasa]</div></div><div class=""><br class=""></div><div class="">but as soon as I switch to 'crypto isakmp identity key-id ciscoasa’, SS says there are no matching keys:</div><div class=""><br class=""></div><div class=""><div class="">charon-systemd[1566]: looking for peer configs matching local[%any]...remote[ciscoasa]</div><div class="">charon-systemd[1566]: selected peer config 'ikev2-eap-mschapv2'</div><div class="">charon-systemd[1566]: no shared key found for '%any' - 'ciscoasa'</div><div class="">charon-systemd[1566]: generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]</div></div><div class=""><br class=""></div><div class="">Which of the following choices is my case? -</div><div class="">1) Cisco ASA sends key-id in the wrong way</div><div class="">2) SS treat received key-id in the wrong way</div><div class="">3) I’m missing something</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Thank you.</div><div class=""><br class=""></div><div class="">
<div><br class="">-- <br class="">Volodymyr Litovka<br class=""> "Vision without Execution is Hallucination." -- Thomas Edison</div>
</div>
<br class=""></div></body></html>