[strongSwan] [Strongswan5.0.1]Strongswan is not sending phase2 Identification payload in Ikev1 for IPv6, which leads to negotiation failure

SaRaVanAn saravanan.nagarajan87 at gmail.com
Tue Dec 18 07:26:00 CET 2012


Hi,
   We are trying to establish a site to site tunnel with strongswan5.0.1 in
Ikev1 for IPv6.
We are facing 2 issues from Strongswan side

Issue1
========
Transport Mode

In response to quick mode message of IKev1, strongswan is sending a quick
mode message
with no identification payload, which results in negotiation failure for
transport mode
I have attached packet dump (IKEV1_TRANSPORT_MODE_IPv6) for your reference.

Key details (Cookie and Encryption)
____________

65B22AA74142F433
09A1EB7E70881F42C648C9EA20880F7A224DE5FFE8060D58

Issue2
=======
Tunnel mode

Router1 is sending Quick mode message with identification data as
2007:1234::4/ffff:ffff:ffff:ffff::,
but in response to quick mode, strongswan is changing identification data
as 2007:1234::4/2007:1234::ffff:ffff:ffff:ffff, which results in
negotiation failure(ID mistmatch).
I have attached packet dump (IKEV1_TUNNEL_MODE_IPv6) for your reference

Key details (Cookie and Encryption)
____________
4ce3dbb94261df40
7B2D446BD93087DC1F17DC6C400AE5AD87436EDB61B840E3

Topology
=========
Router1 ================= Router2( Strongswan).
2007:1234::4              2007:1234::5

Please correct me if there is any problem in my configuration.

Configuration
_____________
ipsec.conf
=============

config setup
          charondebug="ike 4, mgr 4, chd 4, net 4"
          strictcrlpolicy=no

conn %default
        ikelifetime=4h
        lifetime = 5h
        margintime = 2m
        rekeyfuzz = 100%
        keyingtries=1
conn fqdn_vr
    auth=esp
    type=tunnel
    keyexchange=ikev1
    ike=aes128-aes256-sha1-modp1536-modp2048,3des-sha1-md5-modp1536
    esp=aes128-aes256-sha1-modp1536-modp2048,3des-sha1-md5-modp1536
    left=2001:1234::5
    leftid=cross at cass.com
    leftsubnet=2007:1234::5/64
    right=2001:1234::4
    rightsubnet=2007:1234::4/64
    rightid=dut at cass.com
    authby=secret
    auto=add

ipsec.secrets
==============
cross at cass.com dut at cass.com : PSK "rahuldravid"

Transport Mode
=============

    auth=esp
    type=transport
    keyexchange=ikev1
    ike=aes128-aes256-sha1-modp1536-modp2048,3des-sha1-md5-modp1536
    esp=aes128-aes256-sha1-modp1536-modp2048,3des-sha1-md5-modp1536
    left=2001:1234::5
    leftid=cross at cass.com
    right=2001:1234::4
    rightid=dut at cass.com
    authby=secret
    auto=add

Please help me on this, I need experts input.

Regards,
Saravanan N
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20121217/5b48bbc0/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: IKEV1_TRANSPORT_MODE_IPv6.pcap
Type: application/octet-stream
Size: 9947 bytes
Desc: not available
URL: <http://lists.strongswan.org/pipermail/users/attachments/20121217/5b48bbc0/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: IKEV1_TUNNEL_MODE_IPv6.pcap
Type: application/octet-stream
Size: 4376 bytes
Desc: not available
URL: <http://lists.strongswan.org/pipermail/users/attachments/20121217/5b48bbc0/attachment-0001.obj>


More information about the Users mailing list