[strongSwan] NAT + RoadWarrior: cannot create IPsec SA, ISAKMP ok

Andreas Steffen andreas.steffen at strongswan.org
Sun Feb 13 08:43:37 CET 2011


Hello,

because of the NAT situation you must define

rightsubnet=10.10.124.14/32

on the VPN hub or if you have several clients with addresses in
the 10.10.0.0/16 network

rightsubnetwithin=10.10.0.0/16

The third and best alternative would be for the VPN hub
to assign a virtual IP address to each RA client:

On the VPN hub

rightsourceip=10.0.3.0/24 # choose any pool you like

and on the RA client

leftsourceip=%config

Regards

Andreas

On 02/13/2011 08:28 AM, Richard Chan wrote:
> Hello,
> 
> I am testing out the Remote access (RA) +PSK  configuration. It is
> working if the
> two devices are routed. But the if RA is behind NAT, IKE Phase I
> succeeds, Phase II fails.
> 
> From auth.log below, I can see that IKE Phase I succeeds, but then I
> cannot create the Phase II
> SA. Any suggestions?
> 
> moon (the VPN hub)
> 
> ipsec.secrets
> 
> 192.168.123.12 %any : PSK "secret"
> 
> ipsec.conf
> 
> conn hub
> left=192.168.123.12
> leftsubnet=172.25.12.0/24 <http://172.25.12.0/24>
> right=%any
> authby=secret
> auto=add
> 
> carol (the RA client, behind NAT)
> 
> ipsec.secrets
> 
> 10.10.124.14 192.168.123.12 : PSK "secret"
> 
> ipsec.conf
> 
> conn rw
> left=%defaultroute
> right=192.168.123.12
> rightsubnet=172.25.12.0/24 <http://172.25.12.0/24>
> authby=secret
> auto=add
> 
> 
> auth.log on moon:
> 
> Feb 13 15:18:33 vm01 pluto[6774]: | *received 268 bytes from
> 192.168.123.1:1031 <http://192.168.123.1:1031> on eth0
> Feb 13 15:18:33 vm01 pluto[6774]: packet from 192.168.123.1:1031
> <http://192.168.123.1:1031>: received Vendor ID payload [strongSwan]
> Feb 13 15:18:33 vm01 pluto[6774]: packet from 192.168.123.1:1031
> <http://192.168.123.1:1031>: received Vendor ID payload [XAUTH]
> Feb 13 15:18:33 vm01 pluto[6774]: packet from 192.168.123.1:1031
> <http://192.168.123.1:1031>: received Vendor ID payload [Dead Peer
> Detection]
> Feb 13 15:18:33 vm01 pluto[6774]: packet from 192.168.123.1:1031
> <http://192.168.123.1:1031>: received Vendor ID payload [RFC 3947]
> Feb 13 15:18:33 vm01 pluto[6774]: packet from 192.168.123.1:1031
> <http://192.168.123.1:1031>: ignoring Vendor ID payload
> [draft-ietf-ipsec-nat-t-ike-03]
> Feb 13 15:18:33 vm01 pluto[6774]: packet from 192.168.123.1:1031
> <http://192.168.123.1:1031>: ignoring Vendor ID payload
> [draft-ietf-ipsec-nat-t-ike-02]
> Feb 13 15:18:33 vm01 pluto[6774]: packet from 192.168.123.1:1031
> <http://192.168.123.1:1031>: ignoring Vendor ID payload
> [draft-ietf-ipsec-nat-t-ike-02_n]
> Feb 13 15:18:33 vm01 pluto[6774]: packet from 192.168.123.1:1031
> <http://192.168.123.1:1031>: ignoring Vendor ID payload
> [draft-ietf-ipsec-nat-t-ike-00]
> Feb 13 15:18:33 vm01 pluto[6774]: | preparse_isakmp_policy: peer
> requests PSK authentication
> Feb 13 15:18:33 vm01 pluto[6774]: | instantiated "hub" for 192.168.123.1
> Feb 13 15:18:33 vm01 pluto[6774]: | creating state object #1 at
> 0x7fe4f2b2db20
> Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE:  41 51 f8 ff  2a 0a 4a 34
> Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE:  5f 41 53 47  1b fa 54 d7
> Feb 13 15:18:33 vm01 pluto[6774]: | peer:  c0 a8 7b 01
> Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25
> Feb 13 15:18:33 vm01 pluto[6774]: | inserting event EVENT_SO_DISCARD,
> timeout in 0 seconds for #1
> Feb 13 15:18:33 vm01 pluto[6774]: "hub"[1] 192.168.123.1:1031
> <http://192.168.123.1:1031> #1: responding to Main Mode from unknown
> peer 192.168.123.1:1031 <http://192.168.123.1:1031>
> Feb 13 15:18:33 vm01 pluto[6774]: | inserting event EVENT_RETRANSMIT,
> timeout in 10 seconds for #1
> Feb 13 15:18:33 vm01 pluto[6774]: | next event EVENT_RETRANSMIT in 10
> seconds for #1
> Feb 13 15:18:33 vm01 pluto[6774]: | 
> Feb 13 15:18:33 vm01 pluto[6774]: | *received 356 bytes from
> 192.168.123.1:1031 <http://192.168.123.1:1031> on eth0
> Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE:  41 51 f8 ff  2a 0a 4a 34
> Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE:  5f 41 53 47  1b fa 54 d7
> Feb 13 15:18:33 vm01 pluto[6774]: | peer:  c0 a8 7b 01
> Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25
> Feb 13 15:18:33 vm01 pluto[6774]: | state object #1 found, in STATE_MAIN_R1
> Feb 13 15:18:33 vm01 pluto[6774]: "hub"[1] 192.168.123.1:1031
> <http://192.168.123.1:1031> #1: NAT-Traversal: Result using RFC 3947:
> peer is NATed
> Feb 13 15:18:33 vm01 pluto[6774]: | inserting event
> EVENT_NAT_T_KEEPALIVE, timeout in 20 seconds
> Feb 13 15:18:33 vm01 pluto[6774]: | inserting event EVENT_RETRANSMIT,
> timeout in 10 seconds for #1
> Feb 13 15:18:33 vm01 pluto[6774]: | next event EVENT_RETRANSMIT in 10
> seconds for #1
> Feb 13 15:18:33 vm01 pluto[6774]: | 
> Feb 13 15:18:33 vm01 pluto[6774]: | *received 76 bytes from
> 192.168.123.1:4500 <http://192.168.123.1:4500> on eth0
> Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE:  41 51 f8 ff  2a 0a 4a 34
> Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE:  5f 41 53 47  1b fa 54 d7
> Feb 13 15:18:33 vm01 pluto[6774]: | peer:  c0 a8 7b 01
> Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25
> Feb 13 15:18:33 vm01 pluto[6774]: | state object #1 found, in STATE_MAIN_R2
> Feb 13 15:18:33 vm01 pluto[6774]: "hub"[1] 192.168.123.1:1031
> <http://192.168.123.1:1031> #1: Peer ID is ID_IPV4_ADDR: '10.10.124.14'
> Feb 13 15:18:33 vm01 pluto[6774]: | peer CA:      %none
> Feb 13 15:18:33 vm01 pluto[6774]: | offered CA:   %none
> Feb 13 15:18:33 vm01 pluto[6774]: | switched from "hub" to "hub"
> Feb 13 15:18:33 vm01 pluto[6774]: | instantiated "hub" for 192.168.123.1
> Feb 13 15:18:33 vm01 pluto[6774]: "hub"[2] 192.168.123.1:1031
> <http://192.168.123.1:1031> #1: deleting connection "hub" instance with
> peer 192.168.123.1 {isakmp=#0/ipsec=#0}
> Feb 13 15:18:33 vm01 pluto[6774]: | NAT-T: new mapping
> 192.168.123.1:1031/4500 <http://192.168.123.1:1031/4500>)
> Feb 13 15:18:33 vm01 pluto[6774]: | inserting event EVENT_SA_REPLACE,
> timeout in 10530 seconds for #1
> Feb 13 15:18:33 vm01 pluto[6774]: "hub"[2] 192.168.123.1:4500
> <http://192.168.123.1:4500> #1: sent MR3, ISAKMP SA established
> Feb 13 15:18:33 vm01 pluto[6774]: | next event EVENT_NAT_T_KEEPALIVE in
> 20 seconds
> Feb 13 15:18:33 vm01 pluto[6774]: | 
> Feb 13 15:18:33 vm01 pluto[6774]: | *received 444 bytes from
> 192.168.123.1:4500 <http://192.168.123.1:4500> on eth0
> Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE:  41 51 f8 ff  2a 0a 4a 34
> Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE:  5f 41 53 47  1b fa 54 d7
> Feb 13 15:18:33 vm01 pluto[6774]: | peer:  c0 a8 7b 01
> Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25
> Feb 13 15:18:33 vm01 pluto[6774]: | state object not found
> Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE:  41 51 f8 ff  2a 0a 4a 34
> Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE:  5f 41 53 47  1b fa 54 d7
> Feb 13 15:18:33 vm01 pluto[6774]: | peer:  c0 a8 7b 01
> Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25
> Feb 13 15:18:33 vm01 pluto[6774]: | state object #1 found, in STATE_MAIN_R3
> Feb 13 15:18:33 vm01 pluto[6774]: | peer client is 10.10.124.14
> Feb 13 15:18:33 vm01 pluto[6774]: | peer client protocol/port is 0/0
> Feb 13 15:18:33 vm01 pluto[6774]: | our client is subnet 172.25.12.0/24
> <http://172.25.12.0/24>
> Feb 13 15:18:33 vm01 pluto[6774]: | our client protocol/port is 0/0
> Feb 13 15:18:33 vm01 pluto[6774]: "hub"[2] 192.168.123.1:4500
> <http://192.168.123.1:4500> #1: cannot respond to IPsec SA request
> because no connection is known for
> 172.25.12.0/24===192.168.123.12:4500[192.168.123.12]...192.168.123.1:4500[10.10.124.14]===10.10.124.14/32
> <http://172.25.12.0/24===192.168.123.12:4500[192.168.123.12]...192.168.123.1:4500[10.10.124.14]===10.10.124.14/32>
> 
> 
> 
> _______________________________________________
> Users mailing list
> Users at lists.strongswan.org
> https://lists.strongswan.org/mailman/listinfo/users


-- 
======================================================================
Andreas Steffen                         andreas.steffen at strongswan.org
strongSwan - the Linux VPN Solution!                www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[ITA-HSR]==




More information about the Users mailing list