[strongSwan] Ikev2 on initiator side and ikev1 on responder side
ashish mahalka
amahalka at gmail.com
Thu Mar 11 09:36:42 CET 2010
Hello Andreas,
I am seeing some strange behaviour while establishing security association.
10.10.10.3 ======================== 10.10.10.5
(Initiator) (Responder)
(keyexchange=ikev2)
(keyexchange=ikev1)
In the ipsec.conf file for Initiator, keyexchange is specified as
ikev2 whereas for the Responder it is specified as ikev1. But still i
am able to establish a ikev2 association between the two peers.
I am using strongswan version 4.3.4. Can you please help me in
solving this issue.
Below are the ipsec.conf file and output of "ipsec statusall" for
both the peers.
< INITIATOR>
config setup
strictcrlpolicy=no
nat_traversal=no
plutostart=yes
plutodebug=all
charonstart=yes
charondebug="dmn 3, mgr 3, ike 3, chd 3, job 3, cfg 3, knl 3, net 3,enc 3"
conn conn3
type=tunnel
leftsubnet=10.10.10.0/24
rightsubnet=10.10.10.0/24
auto=start
left=10.10.10.3
right=10.10.10.5
rightid="C=IN, ST=KAR, O=WIPRO, OU=NSN, CN=wipro.com,
E=sdu at wipro.com"
leftcert=BTS_CERT_FILE.pem
keyexchange=ikev2
pfs=no
ike=aes128-sha1-modp1024!
esp=aes128-sha1!
ikelifetime=86400s
authby=pubkey
keylife=86400
keyingtries=%forever
dpdaction=clear
mobike=no
dpddelay=10
dpdtimeout=120
rekeyfuzz=0%
rekeymargin=17280
leftprotoport=17/200
rightprotoport=17/200
<RESPONDER>
config setup
strictcrlpolicy=no
nat_traversal=no
plutostart=yes
plutodebug=all
charonstart=yes
charondebug="dmn 3, mgr 3, ike 3, chd 3, job 3, cfg 3, knl 3, net 3,
enc 3"
conn conn1
type=tunnel
leftsubnet=10.10.10.0/24
rightsubnet=10.10.10.0/24
auto=add
left=10.10.10.5
right=10.10.10.3
leftcert=BTS_CERT_FILE.pem
rightid="C=IN, ST=KAR, O=WIPRO, OU=NSN, CN=wipro.com,
E=sdu at wipro.com"
keyexchange=ikev1
ike=aes128-sha1-modp1024!
pfs=no
ikelifetime=86400s
esp=aes128-sha1!
authby=pubkey
keyingtries=%forever
dpdaction=clear
mobike=no
dpddelay=10
dpdtimeout=120
keylife=86400
rekeyfuzz=0%
rekeymargin=17280
leftprotoport=17/200
rightprotoport=17/200
<INITIATOR>
[root at localhost etc]# ipsec statusall
000 Status of IKEv1 pluto daemon (strongSwan 4.3.4):
000 interface lo/lo ::1:500
000 interface lo/lo 127.0.0.1:500
000 interface eth0/eth0 10.10.10.3:500
000 interface eth1/eth1 10.125.45.76:500
000 %myid = (none)
000 loaded plugins: aes des sha1 sha2 md5 random pubkey hmac gmp
000 debug options:
raw+crypt+parsing+emitting+control+lifecycle+klips+dns+natt+oppo+control
more
000
Status of IKEv2 charon daemon (strongSwan 4.3.4):
uptime: 26 seconds, since Mar 11 11:30:17 2010
worker threads: 9 idle of 16, job queue load: 0, scheduled events: 5
loaded plugins: aes des sha1 sha2 md5 fips-prf random x509 pubkey xcbc
hmac gmp kernel-netlink stroke updown attr resolv-conf
Listening IP addresses:
10.10.10.3
10.125.45.76
Connections:
conn3: 10.10.10.3...10.10.10.5, dpddelay=10s
conn3: local: [C=IN, ST=KAR, O=WIPRO, OU=NSN, CN=wipro.com,
E=sdu at wipro.com] uses public key authentication
conn3: cert: "C=IN, ST=KAR, O=WIPRO, OU=NSN, CN=wipro.com,
E=sdu at wipro.com"
conn3: remote: [C=IN, ST=KAR, O=WIPRO, OU=NSN, CN=wipro.com,
E=sdu at wipro.com] uses any authentication
conn3: child: 10.10.10.0/24[udp/src] ===
10.10.10.0/24[udp/src] , dpdaction=clear
Security Associations:
conn3[1]: ESTABLISHED 18 seconds ago, 10.10.10.3[C=IN, ST=KAR,
O=WIPRO, OU=NSN, CN=wipro.com, E=sdu at wipro.com]...10.10.10.5[C=IN,
ST=KAR, O=WIPRO, OU=NSN, CN=wipro.com, E=sdu at wipro.com]
conn3[1]: IKE SPIs: 2e4789200ae32830_i* e619a6965df7a48a_r,
public key reauthentication in 14 hours
conn3[1]: IKE proposal:
AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
conn3{1}: INSTALLED, TUNNEL, ESP SPIs: c095cca0_i cfc46b81_o
conn3{1}: AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o,
rekeying in 19 hours
conn3{1}: 10.10.10.0/24[udp/src] === 10.10.10.0/24[udp/src]
<RESPONDER>
[root at ipsec01-axc etc]# ipsec statusall
000 Status of IKEv1 pluto daemon (strongSwan 4.3.4):
000 interface lo/lo ::1:500
000 interface lo/lo 127.0.0.1:500
000 interface eth0/eth0 10.120.165.230:500
000 interface eth1/eth1 10.10.10.5:500
000 %myid = (none)
000 loaded plugins: aes des sha1 sha2 md5 random pubkey hmac gmp
000 debug options:
raw+crypt+parsing+emitting+control+lifecycle+klips+dns+natt+oppo+control
more
000
000 "conn1": 10.10.10.0/24===10.10.10.5[C=IN, ST=KAR, O=WIPRO, OU=NSN,
CN=wipro.com, E=sdu at wipro.com]:17/200...10.10.10.3[C=IN, ST=KAR,
O=WIPRO, OU=NSN, CN=wipro.com, E=sdu at wipro.com]:17/200===10.10.10.0/24;
unrouted; eroute owner: #0
000 "conn1": CAs: 'C=IN, ST=KAR, L=BAN, O=WIPRO, OU=NSN, CN=wipro.com,
E=sdu at wipro.com'...'%any'
000 "conn1": ike_life: 86400s; ipsec_life: 86400s; rekey_margin:
17280s; rekey_fuzz: 0%; keyingtries: 0
000 "conn1": dpd_action: clear; dpd_delay: 10s; dpd_timeout: 120s;
000 "conn1": policy: PUBKEY+ENCRYPT+TUNNEL; prio: 24,24; interface:
eth1;
000 "conn1": newest ISAKMP SA: #0; newest IPsec SA: #0;
000
Status of IKEv2 charon daemon (strongSwan 4.3.4):
uptime: 93 seconds, since Mar 11 11:23:59 2010
worker threads: 9 idle of 16, job queue load: 0, scheduled events: 3
loaded plugins: aes des sha1 sha2 md5 fips-prf random x509 pubkey xcbc
hmac gmp kernel-netlink stroke updown attr resolv-conf
Listening IP addresses:
10.120.165.230
10.10.10.5
Connections:
Security Associations:
conn1[1]: ESTABLISHED 86 seconds ago, 10.10.10.5[C=IN, ST=KAR,
O=WIPRO, OU=NSN, CN=wipro.com, E=sdu at wipro.com]...10.10.10.3[C=IN,
ST=KAR, O=WIPRO, OU=NSN, CN=wipro.com, E=sdu at wipro.com]
conn1[1]: IKE SPIs: 2e4789200ae32830_i e619a6965df7a48a_r*,
public key reauthentication in 19 hours
conn1[1]: IKE proposal:
AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
conn1{1}: INSTALLED, TUNNEL, ESP SPIs: cfc46b81_i c095cca0_o
conn1{1}: AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o,
rekeying in 19 hours
conn1{1}: 10.10.10.0/24[udp/src] === 10.10.10.0/24[udp/src]
Thanks in advance,
Regards,
Ashish.
Please do not print this email unless it is absolutely necessary.
The information contained in this electronic message and any
attachments to this message are intended for the exclusive use of the
addressee(s) and may contain proprietary, confidential or privileged
information. If you are not the intended recipient, you should not
disseminate, distribute or copy this e-mail. Please notify the sender
immediately and destroy all copies of this message and any
attachments.
WARNING: Computer viruses can be transmitted via email. The recipient
should check this email and any attachments for the presence of
viruses. The company accepts no liability for any damage caused by any
virus transmitted by this email.
www.wipro.com
More information about the Users
mailing list