[strongSwan] How to configure Strongswan4.6.4/5.x with "IPSec Hybrid authentication with RSA" support
TrippyBoy.com
trippyboy at trippyboy.com
Wed Jun 20 07:29:40 CEST 2012
Hello Martin,
Thank you very much for your help with the configuration.
I have successfully made my Strongswan support "Hybrid + RSA". Thank
you for that.
The configuration I used for my Hybrid authentication is as bellow.
---- config start ----
config setup
conn %default
keyexchange=ikev1
forceencaps=yes
left=192.168.246.210
rightsourceip=192.168.246.230/24
# added from
"http://www2.strongswan.org/uml/testresults5rc/ikev1/xauth-id-rsa-hybrid/moon.ipsec.conf"
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn hybridrsasig
forceencaps=no
leftcert=serverCert.pem
leftid="C=JP, O=Strongswan, CN=linux.hoge.jp"
leftauth=pubkey
right=%any
rightauth=xauth
auto=add
----- config end -----
Now I have different problem. I put the part of charon.log bellow.
Actually I'm trying to connect my VPN with Android Ice Cream
Sandwich(ICS) 4.0.3, a future phone.
The log looks like Android ICS is not receiving right packet from my
VPN server and Android is asking
the VPN server to resend the packet "received retransmit of request
with ID 0, retransmitting response".
----- log start -----
Jun 20 14:04:50 10[CFG] looking for HybridInitRSA peer configs
matching 192.168.246.210...192.168.248.101[192.168.248.101]
Jun 20 14:04:50 10[CFG] selected peer config "hybridrsasig"
Jun 20 14:04:50 10[IKE] authentication of 'C=JP, O=Strongswan,
CN=linux.fj-ngmt.jp' (myself) successful
Jun 20 14:04:50 10[ENC] generating ID_PROT response 0 [ ID SIG ]
Jun 20 14:04:50 10[NET] sending packet: from 192.168.246.210[4500] to
192.168.248.101[4500]
Jun 20 14:04:50 10[ENC] generating TRANSACTION request 107931129 [ HASH CP ]
Jun 20 14:04:50 10[NET] sending packet: from 192.168.246.210[4500] to
192.168.248.101[4500]
Jun 20 14:04:53 11[NET] received packet: from 192.168.248.101[4500] to
192.168.246.210[4500]
Jun 20 14:04:53 11[IKE] received retransmit of request with ID 0,
retransmitting response
Jun 20 14:04:53 11[NET] sending packet: from 192.168.246.210[4500] to
192.168.248.101[4500]
Jun 20 14:04:54 12[IKE] sending retransmit 1 of request message ID
107931129, seq 1
Jun 20 14:04:54 12[NET] sending packet: from 192.168.246.210[4500] to
192.168.248.101[4500]
Jun 20 14:05:01 13[IKE] sending retransmit 2 of request message ID
107931129, seq 1
Jun 20 14:05:01 13[NET] sending packet: from 192.168.246.210[4500] to
192.168.248.101[4500]
Jun 20 14:05:02 14[NET] received packet: from 192.168.248.101[4500] to
192.168.246.210[4500]
Jun 20 14:05:02 14[IKE] received retransmit of request with ID 0,
retransmitting response
Jun 20 14:05:02 14[NET] sending packet: from 192.168.246.210[4500] to
192.168.248.101[4500]
Jun 20 14:05:11 07[NET] received packet: from 192.168.248.101[4500] to
192.168.246.210[4500]
Jun 20 14:05:11 07[IKE] received retransmit of request with ID 0,
retransmitting response
Jun 20 14:05:11 07[NET] sending packet: from 192.168.246.210[4500] to
192.168.248.101[4500]
Jun 20 14:05:14 06[NET] received packet: from 192.168.248.101[4500] to
192.168.246.210[4500]
Jun 20 14:05:14 06[IKE] received retransmit of request with ID 0,
retransmitting response
Jun 20 14:05:14 06[NET] sending packet: from 192.168.246.210[4500] to
192.168.248.101[4500]
Jun 20 14:05:14 08[IKE] sending retransmit 3 of request message ID
107931129, seq 1
Jun 20 14:05:14 08[NET] sending packet: from 192.168.246.210[4500] to
192.168.248.101[4500]
Jun 20 14:05:17 09[NET] received packet: from 192.168.248.101[4500] to
192.168.246.210[4500]
Jun 20 14:05:17 09[IKE] received retransmit of request with ID 0,
retransmitting response
Jun 20 14:05:17 09[NET] sending packet: from 192.168.246.210[4500] to
192.168.248.101[4500]
Jun 20 14:05:20 10[JOB] deleting half open IKE_SA after timeout
----- log end -----
I captured the packet comes and goes through port 500 and 4500 from
the client 192.168.246.101
---- tcpdump start ----
# tcpdump -v port 500 or port 4500 and host 192.168.248.101
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size
65535 bytes
14:04:50.245977 IP (tos 0x0, ttl 62, id 0, offset 0, flags [DF], proto
UDP (17), length 504)
192.168.248.101.isakmp > linux.hoge.jp.isakmp: isakmp 1.0 msgid
00000000: phase 1 I ident:
(sa: doi=ipsec situation=identity
(p: #1 protoid=isakmp transform=8
(t: #1 id=ike (type=lifetype value=sec)(type=lifeduration
value=7080)(type=enc value=aes)(type=keylen value=0100)(type=auth
value=fadd)(type=hash value=sha1)(type=group desc value=modp1024))
(t: #2 id=ike (type=lifetype value=sec)(type=lifeduration
value=7080)(type=enc value=aes)(type=keylen value=0100)(type=auth
value=fadd)(type=hash value=md5)(type=group desc value=modp1024))
(t: #3 id=ike (type=lifetype value=sec)(type=lifeduration
value=7080)(type=enc value=aes)(type=keylen value=0080)(type=auth
value=fadd)(type=hash value=sha1)(type=group desc value=modp1024))
(t: #4 id=ike (type=lifetype value=sec)(type=lifeduration
value=7080)(type=enc value=aes)(type=keylen value=0080)(type=auth
value=fadd)(type=hash value=md5)(type=group desc value=modp1024))
(t: #5 id=ike (type=lifetype value=sec)(type=lifeduration
value=7080)(type=enc value=3des)(type=auth value=fadd)(type=hash
value=sha1)(type=group desc value=modp1024))
(t: #6 id=ike (type=lifetype value=sec)(type=lifeduration
value=7080)(type=enc value=3des)(type=auth value=fadd)(type=hash
value=md5)(type=group desc value=modp1024))
(t: #7 id=ike (type=lifetype value=sec)(type=lifeduration
value=7080)(type=enc value=1des)(type=auth value=fadd)(type=hash
value=sha1)(type=group desc value=modp1024))
(t: #8 id=ike (type=lifetype value=sec)(type=lifeduration
value=7080)(type=enc value=1des)(type=auth value=fadd)(type=hash
value=md5)(type=group desc value=modp1024))))
(vid: len=16)
(vid: len=16)
(vid: len=16)
(vid: len=16)
(vid: len=8)
(vid: len=16)
(vid: len=20)
(vid: len=16)
14:04:50.249779 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 164)
linux.hoge.jp.isakmp > 192.168.248.101.isakmp: isakmp 1.0 msgid
00000000: phase 1 R ident:
(sa: doi=ipsec situation=identity
(p: #1 protoid=isakmp transform=1
(t: #1 id=ike (type=enc value=aes)(type=keylen
value=0100)(type=hash value=sha1)(type=group desc
value=modp1024)(type=auth value=fadd)(type=lifetype
value=sec)(type=lifeduration value=7080))))
(vid: len=8)
(vid: len=16)
(vid: len=16)
14:04:50.286274 IP (tos 0x0, ttl 62, id 0, offset 0, flags [DF], proto
UDP (17), length 256)
192.168.248.101.isakmp > linux.hoge.jp.isakmp: isakmp 1.0 msgid
00000000: phase 1 I ident:
(ke: key len=128)
(nonce: n len=16)
(pay20)
(pay20)
14:04:50.293756 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 272)
linux.hoge.jp.isakmp > 192.168.248.101.isakmp: isakmp 1.0 msgid
00000000: phase 1 R ident:
(ke: key len=128)
(nonce: n len=32)
(pay20)
(pay20)
14:04:50.325885 IP (tos 0x0, ttl 62, id 0, offset 0, flags [DF], proto
UDP (17), length 124)
192.168.248.101.ipsec-nat-t > linux.hoge.jp.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 00000000: phase 1 I ident[E]:
[encrypted id]
14:04:50.330134 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 396)
linux.hoge.jp.ipsec-nat-t > 192.168.248.101.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 00000000: phase 1 R ident[E]:
[encrypted id]
14:04:50.330339 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 108)
linux.hoge.jp.ipsec-nat-t > 192.168.248.101.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 066ee5f9: phase 2/others R #6[E]:
[encrypted hash]
14:04:53.339226 IP (tos 0x0, ttl 62, id 0, offset 0, flags [DF], proto
UDP (17), length 124)
192.168.248.101.ipsec-nat-t > linux.hoge.jp.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 00000000: phase 1 I ident[E]:
[encrypted id]
14:04:53.340049 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 396)
linux.hoge.jp.ipsec-nat-t > 192.168.248.101.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 00000000: phase 1 R ident[E]:
[encrypted id]
14:04:54.331725 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 108)
linux.hoge.jp.ipsec-nat-t > 192.168.248.101.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 066ee5f9: phase 2/others R #6[E]:
[encrypted hash]
14:05:01.534131 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 108)
linux.hoge.jp.ipsec-nat-t > 192.168.248.101.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 066ee5f9: phase 2/others R #6[E]:
[encrypted hash]
14:05:02.357470 IP (tos 0x0, ttl 62, id 0, offset 0, flags [DF], proto
UDP (17), length 124)
192.168.248.101.ipsec-nat-t > linux.hoge.jp.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 00000000: phase 1 I ident[E]:
[encrypted id]
14:05:02.358219 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 396)
linux.hoge.jp.ipsec-nat-t > 192.168.248.101.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 00000000: phase 1 R ident[E]:
[encrypted id]
14:05:07.262699 IP (tos 0x0, ttl 62, id 0, offset 0, flags [DF], proto
UDP (17), length 29)
192.168.248.101.ipsec-nat-t > linux.hoge.jp.ipsec-nat-t:
isakmp-nat-keep-alive
14:05:11.360989 IP (tos 0x0, ttl 62, id 0, offset 0, flags [DF], proto
UDP (17), length 124)
192.168.248.101.ipsec-nat-t > linux.hoge.jp.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 00000000: phase 1 I ident[E]:
[encrypted id]
14:05:11.361964 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 396)
linux.hoge.jp.ipsec-nat-t > 192.168.248.101.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 00000000: phase 1 R ident[E]:
[encrypted id]
14:05:14.364938 IP (tos 0x0, ttl 62, id 0, offset 0, flags [DF], proto
UDP (17), length 124)
192.168.248.101.ipsec-nat-t > linux.hoge.jp.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 00000000: phase 1 I ident[E]:
[encrypted id]
14:05:14.365655 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 396)
linux.hoge.jp.ipsec-nat-t > 192.168.248.101.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 00000000: phase 1 R ident[E]:
[encrypted id]
14:05:14.496160 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 108)
linux.hoge.jp.ipsec-nat-t > 192.168.248.101.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 066ee5f9: phase 2/others R #6[E]:
[encrypted hash]
14:05:17.373363 IP (tos 0x0, ttl 62, id 0, offset 0, flags [DF], proto
UDP (17), length 124)
192.168.248.101.ipsec-nat-t > linux.hoge.jp.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 00000000: phase 1 I ident[E]:
[encrypted id]
14:05:17.374016 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 396)
linux.hoge.jp.ipsec-nat-t > 192.168.248.101.ipsec-nat-t:
NONESP-encap: isakmp 1.0 msgid 00000000: phase 1 R ident[E]:
[encrypted id]
^C
21 packets captured
21 packets received by filter
0 packets dropped by kernel
#
----- tcpdump end -----
The same client which is Android ICS 4.0.3 can connect to the same VPN
server with
XAUTH+RSA and XAUTH+PSK so I am not sure if this is been caused by my VPN server
or not.. Probably the future phone needs to be checked, like if it
receives packet from
my VPN server or not.
Regards
Yuki
2012/6/19 Martin Willi <martin at strongswan.org>:
>
>> rightcert=clientCert.pem
>> rightauth=xauth
>
> No need for a right cert, in Hybrid mode the client authenticates with
> XAuth only.
>
>> hybridrsasig: remote: [C=JP, O=Strongswan, CN=client] uses XAuth authentication: any
>
> Your configuration requires a remote identity "C=JP, O=Strongswan,
> CN=client", read from the certificate.
>
>> Jun 19 17:58:35 13[CFG] looking for HybridInitRSA peer configs
>> matching 192.168.246.210...192.168.248.101[192.168.248.101]
>
> But your client sends "192.168.248.101" as IKE identity. If you remove
> the rightcert option, you can define a rightid=192.168.248.101, or even
> rightid=%any.
>
>> I will give it a try with a client that used "Hybrid" authentication
>> without RSA and see if this works.
>
> Hybrid mode is only defined with DSS or RSA as responder authentication
> in [1]. We don't support DSS signatures, and no responder public key
> authentication at all would be very insecure.
>
> Regards
> Martin
>
> [1]http://tools.ietf.org/html/draft-ietf-ipsec-isakmp-hybrid-auth-05
>
--
TrippyBoy.com http://trippyboy.com/
More information about the Users
mailing list