<div dir="ltr">Hi<div><br></div><div>It seems the IKE-proposal (3des-sha256-modp1024) that you are sending from the Strongswan (1.1.1.1) to the remote peer (2.2.2.2) DOES NOT MATCH WHAT IS CONFIGURED ON THE <a href="http://2.2.2.2/PEER">2.2.2.2/PEER</a></div><div><br></div><div>So confirm that the ike proposal sent by Strongswan (as initiator of the tunnel) is matched by the same algorithm-combination configuration on the Peer/2,2,2,2....else it will obviously be a no proposal chosen</div><div><br></div><div>Alternatively you could also try configuring on the strongswan-peer(1.1.1.1) as below without the exclamation-mark in IKE-proposal (this will result in strongswan adding its own pre-defined set of proposals to the configured proposal of 3des-sha256-modp1024)...and see what's happening now</div><div><br></div><div>Note: Keep the exclamation mark for esp as it is....</div><div><br></div><div>ike=3des-sha256-modp1024</div><div>esp=3des-sha256!</div><div><br></div><div><br></div><div>best regards</div><div>Rajiv</div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 12, 2022 at 3:18 PM Adam Cécile <<a href="mailto:acecile@le-vert.net">acecile@le-vert.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello,<br>
<br>
Thanks for the reply, sadly this is not working :/<br>
<br>
parsed INFORMATIONAL_V1 request 0 [ N(NO_PROP)<br>
<br>
Regards, Adam.<br>
<br>
On 1/5/22 8:15 PM, Noel Kuntze wrote:<br>
> Hello Adam,<br>
><br>
> I propose the following config:<br>
><br>
> ike=3des-sha2_256-modp1024!<br>
> esp=3des-sha2_256!<br>
><br>
> No DH group in ESP because ...<br>
><br>
> local crypto endpt.: 1.1.1.1, remote crypto endpt.: 2.2.2.2<br>
> plaintext mtu 1446, path mtu 1500, ip mtu 1500, ip mtu idb <br>
> GigabitEthernet0/0/1<br>
> current outbound spi: 0x2CA0EB8F(748743567)<br>
> PFS (Y/N): N, DH group: none<br>
><br>
><br>
> The IKE and ESP proposals are probably nearly identical as I assumed <br>
> when writing the ones above.<br>
> But to be sure you'd need to check these things.<br>
><br>
> Kind regards<br>
> Noel<br>
><br>
><br>
> Am 05.01.22 um 13:57 schrieb Adam Cécile:<br>
>> On 1/5/22 1:21 PM, Adam Cécile wrote:<br>
>>> On 1/5/22 11:12 AM, Adam Cécile wrote:<br>
>>>> Hello,<br>
>>>><br>
>>>><br>
>>>> I'm replacing a Cisco endpoint with Strongswan sadly all I tried <br>
>>>> ended up in NO_PROPOSAL_CHOSEN...<br>
>>>><br>
>>>> The relevant Cisco bits (which is connecting with peer just fine) <br>
>>>> is: crypto ipsec transform-set TunnelName esp-3des esp-sha256-hmac<br>
>>>><br>
>>>><br>
>>>> Can someone help me converting this into Strongswan ike/esp config <br>
>>>> options (and I also would be very interested in understanding how <br>
>>>> to do such conversion...)<br>
>>>><br>
>>>><br>
>>>> Thanks in advance,<br>
>>>><br>
>>>> Best regards, Adam.<br>
>>>><br>
>>> Here is the detail of the connection being established on the Cisco <br>
>>> which is aimed to be replaced:<br>
>>><br>
>>> interface: GigabitEthernet0/0/1<br>
>>> Crypto map tag: MapName, local addr 1.1.1.1<br>
>>><br>
>>> protected vrf: (none)<br>
>>> local ident (addr/mask/prot/port): (<a href="http://10.0.0.0/255.255.255.0/0/0" rel="noreferrer" target="_blank">10.0.0.0/255.255.255.0/0/0</a>)<br>
>>> remote ident (addr/mask/prot/port): (<a href="http://10.1.0.0/255.255.255.0/0/0" rel="noreferrer" target="_blank">10.1.0.0/255.255.255.0/0/0</a>)<br>
>>> current_peer 2.2.2.2 port 500<br>
>>> PERMIT, flags={origin_is_acl,}<br>
>>> #pkts encaps: 247, #pkts encrypt: 247, #pkts digest: 247<br>
>>> #pkts decaps: 276, #pkts decrypt: 276, #pkts verify: 276<br>
>>> #pkts compressed: 0, #pkts decompressed: 0<br>
>>> #pkts not compressed: 0, #pkts compr. failed: 0<br>
>>> #pkts not decompressed: 0, #pkts decompress failed: 0<br>
>>> #send errors 0, #recv errors 0<br>
>>><br>
>>> local crypto endpt.: 1.1.1.1, remote crypto endpt.: 2.2.2.2<br>
>>> plaintext mtu 1446, path mtu 1500, ip mtu 1500, ip mtu idb <br>
>>> GigabitEthernet0/0/1<br>
>>> current outbound spi: 0x2CA0EB8F(748743567)<br>
>>> PFS (Y/N): N, DH group: none<br>
>>><br>
>>> inbound esp sas:<br>
>>> spi: 0xC2B47C97(3266608279)<br>
>>> transform: esp-3des esp-sha256-hmac ,<br>
>>> in use settings ={Tunnel, }<br>
>>> conn id: 2001, flow_id: ESG:1, sibling_flags <br>
>>> FFFFFFFF80000048, crypto map: MapName<br>
>>> sa timing: remaining key lifetime (k/sec): (4607846/2940)<br>
>>> IV size: 8 bytes<br>
>>> replay detection support: Y replay window size: 128<br>
>>> Status: ACTIVE(ACTIVE)<br>
>>><br>
>>> inbound ah sas:<br>
>>><br>
>>> inbound pcp sas:<br>
>>><br>
>>> outbound esp sas:<br>
>>> spi: 0x2CA0EB8F(748743567)<br>
>>> transform: esp-3des esp-sha256-hmac ,<br>
>>> in use settings ={Tunnel, }<br>
>>> conn id: 2002, flow_id: ESG:2, sibling_flags <br>
>>> FFFFFFFF80000048, crypto map: MapName<br>
>>> sa timing: remaining key lifetime (k/sec): (4607966/2940)<br>
>>> IV size: 8 bytes<br>
>>> replay detection support: Y replay window size: 128<br>
>>> Status: ACTIVE(ACTIVE)<br>
>>><br>
>>> outbound ah sas:<br>
>>><br>
>>> outbound pcp sas:<br>
>>><br>
>> I'm pretty sure I got the proper ike parameter: <br>
>> ike=3des-sha2_256-modp1024<br>
>><br>
>> After setting this one, I get some more logs from Strongswan:<br>
>><br>
>> Jan 5 12:55:05 vpn ipsec[765]: 13[IKE] <tunnel-name|96> initiating <br>
>> Main Mode IKE_SA tunnel-name[96] to 2.2.2.2<br>
>> Jan 5 12:55:05 vpn ipsec[765]: 13[ENC] <tunnel-name|96> generating <br>
>> ID_PROT request 0 [ SA V V V V V ]<br>
>> Jan 5 12:55:05 vpn ipsec[765]: 13[NET] <tunnel-name|96> sending <br>
>> packet: from 1.1.1.1[500] to 2.2.2.2[500] (236 bytes)<br>
>> Jan 5 12:55:05 vpn ipsec[765]: 12[NET] <tunnel-name|96> received <br>
>> packet: from 2.2.2.2[500] to 1.1.1.1[500] (96 bytes)<br>
>> Jan 5 12:55:05 vpn ipsec[765]: 12[ENC] <tunnel-name|96> parsed <br>
>> INFORMATIONAL_V1 request 0 [ N(NO_PROP) ]<br>
>> Jan 5 12:55:05 vpn ipsec[765]: 12[IKE] <tunnel-name|96> received <br>
>> NO_PROPOSAL_CHOSEN error notify<br>
>> Jan 5 12:55:09 vpn ipsec[765]: 16[IKE] <tunnel-name|98> initiating <br>
>> Main Mode IKE_SA tunnel-name[98] to 2.2.2.2<br>
>> Jan 5 12:55:09 vpn ipsec[765]: 16[ENC] <tunnel-name|98> generating <br>
>> ID_PROT request 0 [ SA V V V V V ]<br>
>> Jan 5 12:55:09 vpn ipsec[765]: 16[NET] <tunnel-name|98> sending <br>
>> packet: from 1.1.1.1[500] to 2.2.2.2[500] (236 bytes)<br>
>><br>
>> Can you confirm these logs mean ike setting is correct ? Any idea <br>
>> regarding esp ? No luck yet...<br>
>><br>
<br>
</blockquote></div>