<div dir="ltr">Adding one more note to this for anyone in the future - even with certificates on both machines, Windows defaults to IKEv1 - I imagine this is for legacy support out of the box. If you want to change it over to IKEv2 in Windows (which subsequently stops the invalid header logs on the Linux machine), use the Set-NetIPsecRule command, using parameters
-IPsecRuleName "{<name>}" and -KeyModule IKEv2. I changed the version to 2 on the StrongSwan configuration and restarted the service. Worked the first time. Thanks all!
</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, May 20, 2022 at 11:52 AM Tyler Phillippe <<a href="mailto:tylerphillippe@gmail.com">tylerphillippe@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Thanks all for the assistance; I got it figured out. PSK is only IKEv1, so I had to change the Linux config version to 1. After that, I could see different errors with 'swanctl --log' stating the proposals didn't match. Windows doesn't support Diffie-Hellman on ESP proposals, so I just had to remove that from the Linux config:</div><div><br></div><div>connections {<br> linuxHost {<br> local_addrs = (Linux machine)<br> remote_addrs = (Windows machine)<br> proposals = aes128-sha256-modp2048<br> local {<br> auth = psk<br> }<br> remote {<br> auth = psk<br> }<br> children {<br> linuxHost {<br> esp_proposals = aes128-sha256<br> mode = transport<br> }<br> }<br> version = 1<br> reauth_time = 10800<br> }<br>}<br><br>secrets {<br> ike {<br> secret = 123abc<br> }<br>}</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, May 20, 2022 at 10:20 AM G J <<a href="mailto:bls3427@outlook.com" target="_blank">bls3427@outlook.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div>
<p class="MsoNormal">Here’s what I use for my system. Both Win10 and Win11 are able to connect to it just fine. I’m using certs rather than psk, but you should be able to work past that. Also, you might want to have a look at
<a href="https://github.com/gitbls/pistrong/blob/master/CertInstall.md" target="_blank">https://github.com/gitbls/pistrong/blob/master/CertInstall.md</a>. Although it discusses installing Certs on Win10, some of the settings are appropriate regardless whether it’s cert or
psk.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> windows-pubkey-ikev2 {<u></u><u></u></p>
<p class="MsoNormal"> version = 2<u></u><u></u></p>
<p class="MsoNormal"> proposals = aes256-sha1-modp1024,aes192-sha256-modp3072,default<u></u><u></u></p>
<p class="MsoNormal"> rekey_time = 0s<u></u><u></u></p>
<p class="MsoNormal"> pools = primary-pool-ipv4<u></u><u></u></p>
<p class="MsoNormal"> fragmentation = yes<u></u><u></u></p>
<p class="MsoNormal"> dpd_delay = 30s<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> local-1 {<u></u><u></u></p>
<p class="MsoNormal"> auth = pubkey<u></u><u></u></p>
<p class="MsoNormal"> cacerts = strongSwanCACert.pem<u></u><u></u></p>
<p class="MsoNormal"> certs = windows-strongSwanVPNCert.pem<u></u><u></u></p>
<p class="MsoNormal"> id = <a href="http://windows.mydom.com" target="_blank">windows.mydom.com</a><u></u><u></u></p>
<p class="MsoNormal"> }<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> remote-1 {<u></u><u></u></p>
<p class="MsoNormal"> id = %any<u></u><u></u></p>
<p class="MsoNormal"> }<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> children {<u></u><u></u></p>
<p class="MsoNormal"> net-windows {<u></u><u></u></p>
<p class="MsoNormal"> local_ts = <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><u></u><u></u></p>
<p class="MsoNormal"> rekey_time = 0s<u></u><u></u></p>
<p class="MsoNormal"> dpd_action = clear<u></u><u></u></p>
<p class="MsoNormal"> esp_proposals = aes256-sha1-modp1024,aes192-sha256-modp3072,default<u></u><u></u></p>
<p class="MsoNormal"> }<u></u><u></u></p>
<p class="MsoNormal"> }<u></u><u></u></p>
<p class="MsoNormal"> }<u></u><u></u></p>
<p class="MsoNormal">}<u></u><u></u></p>
<p class="MsoNormal"> pools {<u></u><u></u></p>
<p class="MsoNormal"> primary-pool-ipv4 {<u></u><u></u></p>
<p class="MsoNormal"> addrs = <a href="http://10.92.10.0/24" target="_blank">10.92.10.0/24</a><u></u><u></u></p>
<p class="MsoNormal"> dns = 192.168.92.3<u></u><u></u></p>
<p class="MsoNormal"> }<u></u><u></u></p>
<p class="MsoNormal">}<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-color:rgb(225,225,225) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0in 0in">
<p class="MsoNormal"><b>From:</b> Users <<a href="mailto:users-bounces@lists.strongswan.org" target="_blank">users-bounces@lists.strongswan.org</a>> <b>On Behalf Of
</b>Tyler Phillippe<br>
<b>Sent:</b> Friday, May 20, 2022 6:51 AM<br>
<b>To:</b> IL Ka <<a href="mailto:kazakevichilya@gmail.com" target="_blank">kazakevichilya@gmail.com</a>><br>
<b>Cc:</b> <a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a><br>
<b>Subject:</b> Re: [strongSwan] Strongswan Host-to-Host Connection Linux to Windows<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Here are the Linux logs - connecting to a Win10 21H2 machine right now for testing, will migrate over to Server 2019/2022 eventually. Thanks!<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">09[NET] received packet: from Windows[500] to Linux[500] (256 bytes)<br>
09[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V ]<br>
09[IKE] no IKE config found for Linux...Windows, sending NO_PROPOSAL_CHOSEN<br>
09[ENC] generating INFORMATIONAL_V1 request 2032397121 [ N(NO_PROP) ]<br>
09[NET] sending packet: from Linux[500] to Windows[500] (40 bytes)<br>
05[NET] received packet: from Windows[500] to Linux[500] (256 bytes)<br>
05[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V ]<br>
05[IKE] no IKE config found for Linux...Windows, sending NO_PROPOSAL_CHOSEN<br>
05[ENC] generating INFORMATIONAL_V1 request 1617066194 [ N(NO_PROP) ]<br>
05[NET] sending packet: from Linux[500] to Windows[500] (40 bytes)<br>
11[NET] received packet: from Windows[500] to Linux[500] (256 bytes)<br>
11[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V ]<br>
11[IKE] no IKE config found for Linux...Windows, sending NO_PROPOSAL_CHOSEN<br>
11[ENC] generating INFORMATIONAL_V1 request 728440835 [ N(NO_PROP) ]<br>
11[NET] sending packet: from Linux[500] to Windows[500] (40 bytes)<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Fri, May 20, 2022 at 9:43 AM IL Ka <<a href="mailto:kazakevichilya@gmail.com" target="_blank">kazakevichilya@gmail.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-color:currentcolor currentcolor currentcolor rgb(204,204,204);border-style:none none none solid;border-width:medium medium medium 1pt;padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">What about Linux logs? <u></u><u></u></p>
<div>
<p class="MsoNormal">Run ``swanctl --log`` on Linux and reinitiate connection. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Which version of Windows btw? <u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Fri, May 20, 2022 at 4:16 PM Tyler Phillippe <<a href="mailto:tylerphillippe@gmail.com" target="_blank">tylerphillippe@gmail.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-color:currentcolor currentcolor currentcolor rgb(204,204,204);border-style:none none none solid;border-width:medium medium medium 1pt;padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal">Hello all! I am attempting to connect a Linux machine to Windows via Strongswan in a host-to-host configuration. I tested with Windows to Windows using the built-in firewall and it connected instantly. I changed the default Windows integrity
and encryption ciphers and I think I changed them in the Linux Strongswan configuration. However, I am not getting any connection between the hosts and I can't find any logs on the Windows machine to help me narrow down what the issue is. It definitely does
not work, since the SSH session on the Linux machine fails out. Below is the swanctl.conf file on my Linux machine. And, I know it's not the most secure method - I'm just trying to get it to initially connect with a PSK since that's the simplest for now. Windows
doesn't support modp3072 unfortunately, so I had to manually set the Linux config below to modp2048. The Windows firewall is set to use AES-CBC 128, SHA-256, MODP2048 for key exchange and ESP AES-CBC 128, SHA-256 for data protection. What am I doing wrong?
Thanks everyone!!<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">connections {<br>
linuxHost {<br>
local_addrs = (Linux machine)<br>
remote_addrs = (Windows machine)<br>
proposals = aes128-sha256-modp2048<br>
local {<br>
auth = psk<br>
}<br>
remote {<br>
auth = psk<br>
}<br>
children {<br>
linuxHost {<br>
esp_proposals = aes128-sha256-modp2048<br>
mode = transport<br>
}<br>
}<br>
version = 2<br>
reauth_time = 10800<br>
}<br>
}<br>
<br>
secrets {<br>
ike {<br>
secret = <psk><br>
}<br>
}<u></u><u></u></p>
</div>
</div>
</blockquote>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote></div>
</blockquote></div>