[strongSwan] strongswan with mikrotik
zux
zux at pie-dabas.net
Tue Jul 27 10:34:51 CEST 2010
Hello,
I'm new to strongswan and ipsec and I'm having problems with configuring
strongswan to work with mikrotik router, the strange thing is that
mikrotik is able to initiate the connection and everything works then,
but strongswan can not initiate the connection. The problem is, that if
the strongswan box is rebooted, the connection is not reestablished
until I reset it from the mikrotik side. The configuration on the
mikrotik is the same as other, that work well between other mikrotik
boxes. Besides, I have changed the lifetime on mikrotik from 1 day to
one hour, and then if i reboot strongswan, the connection is established
after that hour. (or less, if the connection was up for some time)
I'm sorry if this problem has nothing to do with strongswan, but maybe
someone can give some useful tips.
The error on Mikrotik, when strongswan tries to connect is this:
Recieved ISAKMP packet from <strongswan IP>, phase 1, Identity Protection
responding phase 1, starting mode Identity Protection (local <mikrotik
IP>:500)(remote <strongswan IP>)
no acceptable proposal found (remote unknown)
failed to process packet
This is the mikrotik configuration:
Ipsec Policy:
Src. Address: 192.168.1.0/24
Dst. Address: 192.168.156.0/24
Action: encrypt
Level: require
IPsec Protocols: esp
Tunnel = yes
SA Src. Address: <mikrotik IP>
SA Dst. Address: <strongswan IP>
Proposal: pleskava
Manual SA: None
IPsec Peer:
Address: <strongswan IP>
Port: 500
Secret: <password>
Exchange Mode: main
Send initial Contact = yes
Proposal Check: obey
Hash Algoritm: sha
Encrypt Algorithm: 3des
DH Group: modp1024
Generate policy = yes
Lifetime: 1d 00:00:00
Ipsec Proposal:
Name: pleskava
Auth. Algorithms: md5
Encr. Algorithms: 3des
Lifetime: 01:00:00
PFS Goup: none
and this ir strongswan configuration:
root at kristaps:~# cat /etc/ipsec.conf
# ipsec.conf - strongSwan IPsec configuration file
# basic configuration
config setup
interfaces="ipsec0=eth0"
klipsdebug=none
plutodebug=all
uniqueids=yes
conn %default
keyingtries=0
authby=rsasig
conn riga
left=<stronswan IP>
leftsubnet=192.168.156.0/24
right=<mikrotik IP>
rightsubnet=192.168.1.0/24
keyexchange=ike
authby=secret
auth=esp
ike=3des-md5-modp1024
esp=3des-md5-modp1024
pfs=no
type=tunnel
auto=start
root at kristaps:~# cat /etc/ipsec.secrets
<strongswan IP> <mikrotik IP> : PSK "password"
More information about the Users
mailing list