[strongSwan] building groups in end-to-end scenario
Andreas Steffen
andreas.steffen at strongswan.org
Fri Sep 10 13:45:49 CEST 2010
Hello Johann,
your setup doesn't work because right=%any is for passive responders
only. As an initiator you must give the IP address of the peer you
want to reach explicitly in the right= statement.
Regards
Andreas
On 10.09.2010 12:25, johann badinger wrote:
> Hi,
> I googled a lot before sending this mail, but found no answer.
>
> My question is:
> how to configure charon for a group scenrio
>
> More details:
>
> for example:
> I have three hosts, host1 has IP adress 192.168.56.1, second one host2
> has IP adress 192.168.56.2 and the third has ip adress 192.168.56.3.
> They are all in the subnet 192.168.56.0/32.
>
> I want to establish a VPN between all hosts. The problem is that the
> hosts don't know the remote ip adresses. Only the subnet.
>
> Here my ipse.conf:
>
> host1
>
> config setup
> plutostart=no
> charondebug="knl 2, dmn 2, ike 2, net 2, cfg 2, job 2"
>
> conn %default
> ikelifetime=60m
> keyexchange=ikev2
>
>
> conn remote
> left=192.168.56.1
> leftcert=Host1-cert.pem
> right=%any
> rightsubnet=192.168.56.0/32
> auto=route
>
>
> host2
>
> config setup
> plutostart=no
> charondebug="knl 2, dmn 2, ike 2, net 2, cfg 2, job 2"
>
> conn %default
> ikelifetime=60m
> keyexchange=ikev2
>
>
> conn remote
> left=192.168.56.2
> leftcert=Host2-cert.pem
> right=%any
> rightsubnet=192.168.56.0/32
> auto=route
>
> the starter shows:
> Starting strongSwan 4.4.0 IPsec [starter]...
> 00[DMN] Starting IKEv2 charon daemon (strongSwan 4.4.0)
> 00[KNL] listening on interfaces:
> 00[KNL] eth0
> 00[KNL] eth1
> 00[KNL] 192.168.1.3
> 00[KNL] fe80::7ae4:ff:fe33:5bbb
> 00[KNL] vboxnet0
> 00[KNL] 192.168.56.1
> 00[KNL] fe80::800:27ff:fe00:0
> 00[CFG] loading ca certificates from '/usr/local/etc/ipsec.d/cacerts'
> 00[CFG] loaded ca certificate "C=DE, XX'
> 00[CFG] loading aa certificates from '/usr/local/etc/ipsec.d/aacerts'
> 00[CFG] loading ocsp signer certificates from
> '/usr/local/etc/ipsec.d/ocspcerts'
> 00[CFG] loading attribute certificates from '/usr/local/etc/ipsec.d/acerts'
> 00[CFG] loading crls from '/usr/local/etc/ipsec.d/crls'
> 00[CFG] loading secrets from '/usr/local/etc/ipsec.secrets'
> 00[CFG] loaded RSA private key from
> '/usr/local/etc/ipsec.d/private/Host3-key.pem'
> 00[DMN] loaded plugins: aes des sha1 sha2 md5 random x509 pubkey pkcs1
> pgp dnskey pem fips-prf xcbc hmac gmp attr kernel-netlink socket-raw
> stroke updown resolve
> 00[JOB] spawning 16 worker threads
> 01[JOB] started worker thread, ID: 1
> 04[JOB] started worker thread, ID: 4
> 05[JOB] started worker thread, ID: 5
> 14[JOB] started worker thread, ID: 14
> 14[JOB] no events, waiting
> 10[JOB] started worker thread, ID: 10
> 08[JOB] started worker thread, ID: 8
> 15[JOB] started worker thread, ID: 15
> 11[JOB] started worker thread, ID: 11
> 13[JOB] started worker thread, ID: 13
> 09[JOB] started worker thread, ID: 9
> 03[JOB] started worker thread, ID: 3
> 07[JOB] started worker thread, ID: 7
> 05[NET] waiting for data on raw sockets
> 02[JOB] started worker thread, ID: 2
> 06[JOB] started worker thread, ID: 6
> 16[JOB] started worker thread, ID: 16
> 12[JOB] started worker thread, ID: 12
> charon (3820) started after 20 ms
> 01[CFG] received stroke: add connection 'Host2'
> 01[CFG] conn Host2
> 01[CFG] left=192.168.56.1
> 01[CFG] leftsubnet=(null)
> 01[CFG] leftsourceip=(null)
> 01[CFG] leftauth=(null)
> 01[CFG] leftauth2=(null)
> 01[CFG] leftid=(null)
> 01[CFG] leftid2=(null)
> 01[CFG] leftcert=Host1-cert.pem
> 01[CFG] leftcert2=(null)
> 01[CFG] leftca=(null)
> 01[CFG] leftca2=(null)
> 01[CFG] leftgroups=(null)
> 01[CFG] leftupdown=(null)
> 01[CFG] right=%any
> 01[CFG] rightsubnet=192.168.56.0/32
> 01[CFG] rightsourceip=(null)
> 01[CFG] rightauth=(null)
> 01[CFG] rightauth2=(null)
> 01[CFG] rightid=(null)
> 01[CFG] rightid2=(null)
> 01[CFG] rightcert=(null)
> 01[CFG] rightcert2=(null)
> 01[CFG] rightca=(null)
> 01[CFG] rightca2=(null)
> 01[CFG] rightgroups=(null)
> 01[CFG] rightupdown=(null)
> 01[CFG] eap_identity=(null)
> 01[CFG] ike=aes128-sha1-modp2048,3des-sha1-modp1536
> 01[CFG] esp=aes128-sha1,3des-sha1
> 01[CFG] mediation=no
> 01[CFG] mediated_by=(null)
> 01[CFG] me_peerid=(null)
> 01[KNL] getting interface name for %any
> 01[KNL] %any is not a local address
> 01[KNL] getting interface name for 192.168.56.1
> 01[KNL] 192.168.56.1 is on interface vboxnet0
> 01[CFG] loaded certificate "XXX'
> 01[CFG] id '192.168.56.1' not confirmed by certificate, defaulting to
> 'XXX'
> 01[CFG] added configuration 'Host2'
> 01[CFG] received stroke: route 'Host2'
> 01[CFG] proposing traffic selectors for us:
> 01[CFG] 192.168.56.1/32 (derived from dynamic)
> 01[CFG] proposing traffic selectors for other:
> 01[CFG] 192.168.56.0/32 (derived from 192.168.56.0/32)
> 01[KNL] adding policy 192.168.56.1/32 === 192.168.56.0/32 out
> 01[KNL] adding policy 192.168.56.0/32 === 192.168.56.1/32 in
> 01[KNL] adding policy 192.168.56.0/32 === 192.168.56.1/32 fwd
> 01[KNL] getting a local address in traffic selector 192.168.56.1/32
> 01[KNL] using host 192.168.56.1
> 01[KNL] getting address to reach %any
> 01[KNL] getting interface name for 192.168.56.1
> 01[KNL] 192.168.56.1 is on interface vboxnet0
> 01[KNL] getting iface index for vboxnet0
> 01[KNL] received netlink error: No such process (3)
> 01[KNL] unable to install source route for 192.168.56.1
> configuration 'remote' routed
>
> when i ping the remote host it happens nothing. Have someone an other
> proposal for this scenario or what i do wrong?
>
> If I delete the rightsubnet parameter the starter shows after pinging
> the remote host:
> 02[KNL] received a XFRM_MSG_ACQUIRE
> 02[KNL] XFRMA_TMPL
> 02[KNL] creating acquire job for policy 192.168.56.1/32[udp/35794] ===
> 192.168.56.2/32[udp/1025] with reqid {1}
> 13[IKE] unable to initiate to %any
> 13[IKE] IKE_SA Host2[1] state change: CREATED => DESTROYING
======================================================================
Andreas Steffen andreas.steffen at strongswan.org
strongSwan - the Linux VPN Solution! www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[ITA-HSR]==
More information about the Users
mailing list