[strongSwan] Problem getting tunnel up

Otto Bretz otto.bretz at gmail.com
Tue Mar 4 14:26:31 CET 2014


Hello,

I’m having problems getting a tunnel going to a client with a cisco router. This is my first time using strongSwan so I’m probably missing something obvious. I’m running debian wheezy on google compute engine. I’ve verified that I can talk to another machine on the net with UDP on port 500. The people running the cisco router says that they see no connection attempt from my external ip (192.158.A.B).

Any help is much appreciated.

cheers,
Otto

ipsec.conf:
config setup
  charonstart=no
  plutostart=yes
  plutodebug=control
  plutostderrlog=/var/log/pluto.log

conn myconn
  authby=psk
  auto=add
  dpdaction=hold
  esp=aes192-sha1!
  forceencaps=yes
  ike=aes256-sha1-modp1024!
  keyexchange=ikev1
  mobike=no
  type=tunnel
  pfs=yes
  pfsgroup=modp1024
  left=192.158.A.B
  leftid=192.158.A.B
  leftsubnet=10.240.0.0/16
  leftauth=psk
  leftikeport=4500
  right=194.17.X.Y
  rightsubnet=192.168.1.0/24
  rightauth=psk
  rightikeport=4500

ipsec.secrets:
192.158.A.B 194.17.X.Y : PSK “mekmitasdigoat"

ipsec statusall:
000 Status of IKEv1 pluto daemon (strongSwan 4.5.2):
000 interface lo/lo 127.0.0.1:500
000 interface eth0/eth0 10.240.12.197:500
000 interface eth0:0/eth0:0 192.158.A.B:500
000 %myid = '%any'
000 loaded plugins: test-vectors curl ldap aes des sha1 sha2 md5 random x509 pkcs1 pgp dnskey pem openssl gmp hmac xauth attr kernel-netlink resolve 
000 debug options: control
000 
000 "myconn": 10.240.0.0/16===192.158.A.B[192.158.A.B]…194.17.X.Y[194.17.X.Y]===192.168.1.0/24; unrouted; eroute owner: #0
000 "myconn":   ike_life: 10800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3
000 "myconn":   dpd_action: hold; dpd_delay: 30s; dpd_timeout: 150s;
000 "myconn":   policy: PSK+ENCRYPT+TUNNEL+PFS+UP; prio: 16,24; interface: eth0:0; 
000 "myconn":   newest ISAKMP SA: #0; newest IPsec SA: #0; 
000

pluto.log:
Starting IKEv1 pluto daemon (strongSwan 4.5.2) THREADS SMARTCARD VENDORID
listening on interfaces:
  eth0
    10.240.12.197
    192.158.A.B
loaded plugins: test-vectors curl ldap aes des sha1 sha2 md5 random x509 pkcs1 pgp dnskey pem openssl gmp hmac xauth attr kernel-netlink resolve 
| inserting event EVENT_REINIT_SECRET, timeout in 3600 seconds
  including NAT-Traversal patch (Version 0.6c) [disabled]
| pkcs11 module '/usr/lib/opensc-pkcs11.so' loading...
failed to load pkcs11 module '/usr/lib/opensc-pkcs11.so'
loading ca certificates from '/etc/ipsec.d/cacerts'
loading aa certificates from '/etc/ipsec.d/aacerts'
loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
Changing to directory '/etc/ipsec.d/crls'
loading attribute certificates from '/etc/ipsec.d/acerts'
spawning 4 worker threads
| inserting event EVENT_LOG_DAILY, timeout in 48567 seconds
| next event EVENT_REINIT_SECRET in 3600 seconds
| 
| *received whack message
listening for IKE messages
| found lo with address 127.0.0.1
| found eth0 with address 10.240.12.197
| found eth0:0 with address 192.158.A.B
adding interface eth0:0/eth0:0 192.158.A.B:500
adding interface eth0/eth0 10.240.12.197:500
adding interface lo/lo 127.0.0.1:500
loading secrets from "/etc/ipsec.secrets"
  loaded PSK secret for 192.158.A.B 194.17.X.Y 
| next event EVENT_REINIT_SECRET in 3600 seconds
| 
| *received whack message
| from whack: got --esp=aes192-sha1!;modp1024
| esp proposal: AES_CBC_192/HMAC_SHA1, ; pfsgroup=MODP_1024; strict
| from whack: got --ike=aes256-sha1-modp1024!
| ike proposal: AES_CBC_256/HMAC_SHA1/MODP_1024, strict
added connection description "myconn"
| 10.240.0.0/16===192.158.A.B[192.158.A.B]…194.17.X.Y[194.17.X.Y]===192.168.1.0/24
| ike_life: 10800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3; policy: PSK+ENCRYPT+TUNNEL+PFS
| next event EVENT_REINIT_SECRET in 3600 seconds
| 
| *received whack message
| creating state object #1 at 0x7f9db83236a0
| ICOOKIE:  25 17 5f 2b  9c c3 ee da
| RCOOKIE:  00 00 00 00  00 00 00 00
| peer:  c2 11 27 72
| state hash entry 25
| inserting event EVENT_SO_DISCARD, timeout in 0 seconds for #1
| Queuing pending Quick Mode with 194.17.X.Y "myconn"
"myconn" #1: initiating Main Mode
| ike proposal: AES_CBC_256/HMAC_SHA1/MODP_1024, strict
| inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #1
| next event EVENT_RETRANSMIT in 10 seconds for #1
| 
| *time to handle event
| event after this is EVENT_REINIT_SECRET in 3572 seconds
| handling event EVENT_RETRANSMIT for 194.17.X.Y "myconn" #1
| inserting event EVENT_RETRANSMIT, timeout in 20 seconds for #1
| next event EVENT_RETRANSMIT in 20 seconds for #1
| 
| *time to handle event
| event after this is EVENT_REINIT_SECRET in 3552 seconds
| handling event EVENT_RETRANSMIT for 194.17.X.Y "myconn" #1
| inserting event EVENT_RETRANSMIT, timeout in 40 seconds for #1
| next event EVENT_RETRANSMIT in 40 seconds for #1
| 
| *time to handle event
| event after this is EVENT_REINIT_SECRET in 3512 seconds
| handling event EVENT_RETRANSMIT for 194.17.X.Y "myconn" #1
"myconn" #1: max number of retransmissions (2) reached STATE_MAIN_I1.  No response (or no acceptable response) to our first IKE message
"myconn" #1: starting keying attempt 2 of at most 3, but releasing whack
| creating state object #2 at 0x7f9db8324760
| ICOOKIE:  a2 ea 87 15  7c 25 01 21
| RCOOKIE:  00 00 00 00  00 00 00 00
| peer:  c2 11 27 72
| state hash entry 7
| inserting event EVENT_SO_DISCARD, timeout in 0 seconds for #2
"myconn" #2: initiating Main Mode to replace #1
| ike proposal: AES_CBC_256/HMAC_SHA1/MODP_1024, strict
| inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #2
| ICOOKIE:  25 17 5f 2b  9c c3 ee da
| RCOOKIE:  00 00 00 00  00 00 00 00
| peer:  c2 11 27 72
| state hash entry 25
| next event EVENT_RETRANSMIT in 10 seconds for #2
| 
| *time to handle event
| event after this is EVENT_REINIT_SECRET in 3502 seconds
| handling event EVENT_RETRANSMIT for 194.17.X.Y "myconn" #2
| inserting event EVENT_RETRANSMIT, timeout in 20 seconds for #2
| next event EVENT_RETRANSMIT in 20 seconds for #2
| 
| *time to handle event
| event after this is EVENT_REINIT_SECRET in 3482 seconds
| handling event EVENT_RETRANSMIT for 194.17.X.Y "myconn" #2
| inserting event EVENT_RETRANSMIT, timeout in 40 seconds for #2
| next event EVENT_RETRANSMIT in 40 seconds for #2
| 
| *time to handle event
| event after this is EVENT_REINIT_SECRET in 3442 seconds
| handling event EVENT_RETRANSMIT for 194.17.X.Y "myconn" #2
"myconn" #2: max number of retransmissions (2) reached STATE_MAIN_I1.  No response (or no acceptable response) to our first IKE message
"myconn" #2: starting keying attempt 3 of at most 3
| creating state object #3 at 0x7f9db83236a0
| ICOOKIE:  df 88 f6 30  a3 f5 72 1a
| RCOOKIE:  00 00 00 00  00 00 00 00
| peer:  c2 11 27 72
| state hash entry 5
| inserting event EVENT_SO_DISCARD, timeout in 0 seconds for #3
"myconn" #3: initiating Main Mode to replace #2
| ike proposal: AES_CBC_256/HMAC_SHA1/MODP_1024, strict
| inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #3
| ICOOKIE:  a2 ea 87 15  7c 25 01 21
| RCOOKIE:  00 00 00 00  00 00 00 00
| peer:  c2 11 27 72
| state hash entry 7
| next event EVENT_RETRANSMIT in 10 seconds for #3
| 
| *time to handle event
| event after this is EVENT_REINIT_SECRET in 3432 seconds
| handling event EVENT_RETRANSMIT for 194.17.X.Y "myconn" #3
| inserting event EVENT_RETRANSMIT, timeout in 20 seconds for #3
| next event EVENT_RETRANSMIT in 20 seconds for #3
| 
| *time to handle event
| event after this is EVENT_REINIT_SECRET in 3412 seconds
| handling event EVENT_RETRANSMIT for 194.17.X.Y "myconn" #3
| inserting event EVENT_RETRANSMIT, timeout in 40 seconds for #3
| next event EVENT_RETRANSMIT in 40 seconds for #3
| 
| *time to handle event
| event after this is EVENT_REINIT_SECRET in 3372 seconds
| handling event EVENT_RETRANSMIT for 194.17.X.Y "myconn" #3
"myconn" #3: max number of retransmissions (2) reached STATE_MAIN_I1.  No response (or no acceptable response) to our first IKE message
| ICOOKIE:  df 88 f6 30  a3 f5 72 1a
| RCOOKIE:  00 00 00 00  00 00 00 00
| peer:  c2 11 27 72
| state hash entry 5
| next event EVENT_REINIT_SECRET in 3372 seconds
| 
| *time to handle event
| event after this is EVENT_LOG_DAILY in 44967 seconds
| event EVENT_REINIT_SECRET handled
| inserting event EVENT_REINIT_SECRET, timeout in 3600 seconds
| next event EVENT_REINIT_SECRET in 3600 seconds


More information about the Users mailing list