[strongSwan] Antw: Re: Dynamic IP Gateway
bjoern wahl
bjoern.wahl at hospital-borken.de
Wed Nov 26 11:31:56 CET 2014
Hello!
Thanks again for the quick respond, but i do not get it working.
Anybody an example configuration I can copy ?
Found some expamles with Certs and both sides dynamic IP or
solutions with dyndns but nothing with psk ikev2 and only one side
dyn IP.
Thanks !
Björn
>>> bjoern wahl 26.11.14 9.51 Uhr >>>
Hello!
Thanks for the really fast restond, i really need to get it working.
But, well, i didn`t.
Here some more infos:
The externel client with dynIP:
===========================================================
# cat /etc/strongswan/ipsec.secrets
# /etc/ipsec.secrets - strongSwan IPsec secrets file
#
IP_ADDR_OF_GATEWAY_AS_IT_IS_ALSO_RIGHTID : PSK "SECRET"
=================================
# cat /etc/strongswan/ipsec.conf
# ipsec.conf - strongSwan IPsec configuration file
# basic configuration
config setup
conn DYNIPCLIENTNAME
keyexchange=ikev1
closeaction=restart
compress=no
authby=secret
leftid=DYNIPCLIENTNAME
leftsubnet=192.168.0.1/24
rightid=IP_ADDR_OF_GATEWAY_AS_IT_IS_ALSO_RIGHTID
right=IP_ADDR_OF_GATEWAY_AS_IT_IS_ALSO_RIGHTID
rightsubnet=aa.bb.cc.dd/e
ike=aes256-sha-modp1024
esp=aes256-sha1
auto=start
===========================================================
The central GW with the fix IP
===========================================================
# cat /usr/local/etc/ipsec.secrets
DYNIPCLIENTNAME : PSK "SECRET"
=================================
# cat /usr/local/etc/ipsec.conf
conn DYNIPCLIENTNAME
keyexchange=ikev1
closeaction=restart
compress=no
authby=secret
leftid=IP_ADDR_OF_GATEWAY_AS_IT_IS_ALSO_RIGHTID
left=IP_ADDR_OF_GATEWAY_AS_IT_IS_ALSO_RIGHTID
leftsubnet=aa.bb.cc.dd/e
rightid=DYNIPCLIENTNAME
right=%any
rightsubnet=192.168.0.1/24
ike=aes256-sha-modp1024
esp=aes256-sha1
auto=add
==========================================================
Messages on the Raspberry tells me:
==========================================================
...
Jan 1 02:39:25 CLIENTNAME strongswan: 09[ENC] could not decrypt
payloads
Jan 1 02:39:25 CLIENTNAME strongswan: 09[IKE] message parsing failed
Jan 1 02:39:25 CLIENTNAME strongswan: 09[IKE] ignore malformed
INFORMATIONAL request
Jan 1 02:39:25 CLIENTNAME strongswan: 09[IKE] INFORMATIONAL_V1 request
with message ID 1390073963 processing failed
Jan 1 02:39:25 CLIENTNAME strongswan: 12[IKE] sending retransmit 1 of
request message ID 0, seq 3
Jan 1 02:39:25 CLIENTNAME strongswan: 12[NET] sending packet: from
DYN-IP[500] to STATIC-IP[500] (76 bytes)
Jan 1 02:39:25 CLIENTNAME strongswan: 13[NET] received packet: from
STATIC-IP[500] to DYN-IP[500] (76 bytes)
Jan 1 02:39:26 CLIENTNAME strongswan: 13[ENC] invalid HASH_V1 payload
length, decryption failed?
Jan 1 02:39:26 CLIENTNAME strongswan: 13[ENC] could not decrypt
payloads
Jan 1 02:39:26 CLIENTNAME strongswan: 13[IKE] message parsing failed
Jan 1 02:39:26 CLIENTNAME strongswan: 13[IKE] ignore malformed
INFORMATIONAL request
Jan 1 02:39:26 CLIENTNAME strongswan: 13[IKE] INFORMATIONAL_V1 request
with message ID 4086520482 processing failed
Jan 1 02:39:26 CLIENTNAME strongswan: 00[DMN] signal of type SIGINT
received. Shutting down
Jan 1 02:39:26 CLIENTNAME strongswan: 00[IKE] destroying IKE_SA in
state CONNECTING without notification
Jan 1 02:39:26 CLIENTNAME systemd: Stopped strongSwan IPsec.
Jan 1 02:39:26 CLIENTNAME strongswan: charon stopped after 200 ms
Jan 1 02:39:26 CLIENTNAME strongswan: ipsec starter stopped
.....
One more info:
When I user the dynamic ip of the gateway, the connection comes up, it
must be some configuration issue.
And the strongswan version on the client with dyn ip is:
==========================================================
# strongswan version
Linux strongSwan
U5.1.3/K3.12.26-1.2014080
8git4ab8abb.rpfr20.armv6hl.bcm2708
==========================>>> Noel Kuntze <noel at familie-kuntze.de> 25.11.14 22.34 Uhr >>>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Hello Bjoern,
You might want to try using simple strings as IDs on both sides and
setting right=%any on the responder.
E.g.:
client config:
[...]
right=myGateway
rightid=myGatewaysomethingsomething
leftid=myClientomethingsomething
[...]
gateway config:
[...]
right=%any
rightid=myClientsomethingsomething
leftid=myGatewaysomethingsomething
[...]
Keep in mind that you have to set matching selectors in ipsec.secrets
for your PSKs,
so strongSwan knows what secrets to use!
Example:
ipsec.secrets on client:
myGatewaysomethingsomething : PSK "foobar"
ipsec.secrets on gateway
myClientsomethingsomething : PSK "foobar"
Mit freundlichen Grüßen/Regards,
Noel Kuntze
GPG Key ID: 0x63EC6658
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658
Am 25.11.2014 um 22:27 schrieb bjoern wahl:
> Hello!
>
> I want to connect a Pidora Gateway with a dynamic ip adress to a
static
> gateway in my company.
> When i enter the fix ip-address to both sides everything works find.
But
> i just do not get the point, how to do that with a
> dynamic ip address at one side.
>
> I found the examples at [1] but i still do not get it working.
>
> At the GW with the static ip the config looks like this:
>
> ================================================
> conn pidora
> keyexchange=ikev1
> closeaction=restart
> compress=no
> authby=secret
> leftid=FIX-IP-OF-THE-ONE-GW
> left=FIX-IP-OF-THE-ONE-GW
> leftsubnet=x.x.x.x/xx
> rightid=DYN-IP-OF-THE-OTHER-GW
> right=DYN-IP-OF-THE-OTHER-GW
> rightsubnet=yyy.yy.yy.0/24
> ike=aes256-sha-modp1024
> esp=aes256-sha1
> auto=add
>
> ================================================
>
> So for me it is all about the rightid which does not work if i give it
a
> name like "rightid=pidora". And it also does not work
> if I do "rigth=%any".
>
> The strongswan versions are not the same btw. The GW with the fix ip
is
> Linux strongSwan U5.1.1 and the version on the pidora is a
> newer version.
> Actually I can not enter the client now, so i can not tell you the
exact
> version we use there, sorry.
>
> I also read something about nameresolution via dyndns. So I have the
> question if this is needed. I understand that in any other way
> the GW with the fix IP would never be able to open the connection as
> this side does not know the ip, but does it ever have to ?
>
> In my mind i think of the GW with the dynamic IP always initiating the
> connection, is this working ?
> How would a configuration look like ?
>
> I did saw [1] which seems to me to be the exact same thing i want, but
i
> did not work out for me with this config. I do not want to
> user certs and I used no xy at test.com as the rightid, would that be the
> reason why it did not work ?
>
> Thanks for any idea.
>
> björn
>
> [1] https://www.strongswan.org/testresults4.html
>
>
>
----------------------------------------------------------------------------------------------------
> Klinikverbund Westmünsterland gGmbH
> Jur. Sitz der Gesellschaft: Am Boltenhof 7, 46325 Borken
> Registergericht Coesfeld, HRB Nr. 8983
> Ust.-Id.Nr.: DE 222740345
> Geschäftsführer: Christoph Bröcker, Ludger Hellmann
>
> Diese E-Mail enthält vertrauliche oder rechtlich geschützte
> Informationen. Wenn Sie nicht der beabsichtige Empfänger sind,
> informieren Sie bitte sofort den Absender und löschen Sie diese
E-Mail.
>
> Das unbefugte Kopieren dieser E-Mail oder die unbefugte Weitergabe
der
> enthaltenen Informationen ist nicht gestattet.
>
> Dem Klinikverbund Westmünsterland sind fünf Krankenhäuser mit 1.332
> Planbetten und mehrere Einrichtungen der Altenhilfe angeschlossen.
Mehr
> als 50 Fachbereiche orientieren sich an neusten medizinischen
Sta
ndards
> und erfüllen die hohen Anforderungen einer quali> Krankenhäusern stationär behandelt. Mit über 3.800 Mitarbeitern gehört
> der Verbund zu den größten Arbeitgebern der Region.
>
> _______________________________________________
> Users mailing list
> Users at lists.strongswan.org
> https://lists.strongswan.org/mailman/listinfo/users
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJUdPVYAAoJEDg5KY9j7GZYGe4P+weJEVfRZ9D31lYvtLSa9tDQ
M0jJvs0U0XfkDsIhDHV0rvtKiSFn/s+vKJPNCbKLU30hgFv0GlS3t8qwV9yusCqO
/jFPM0Jey68bhiilsqXvCkf/o3MKHneqopTqlZTapTzOTEATmJ/UOFEaGgIAjWHD
LBqEnZSDFPnEDIdzvtV2rxDXHHgeuS+XmewTD8Wn1Y3owYYYESLbYj8VyBqDgfuM
P6TmlsajpBgnTgvQ4U6hqDslBQAD0MTzyfHpbyT42bV0fbichqg4cMP1Lc/vf6xS
6T8/DEU/n7cPeOT8nHiNwsFmn70CPDmkp4qh+uWZHUpDOXTD+2GVSIg9LCJdBn5o
kRdPvx0MHnU2mG71Wk/kpsjP/qGnFZm9bUOEBlVmoQy9I9lv5RRELlioyZph0j+U
jpsc1fJ99rPS0F0kTCSFb3GLQ1YssSwJojbIZt413Kp51wGj8RnJk89W3vpYXrfO
Zi3sFFcsaajbRgvKBNbWvI5jTsC+sAq73vQIc6FTqyxvctZrrphXFvqaZW3ZA8hO
Un45koI0+i0hnQMcSWFKT904QxSHobTpOrF1Q1XLXJi9cjw0jOfnmCMqD4nfCNNd
JaWFq+yhWyahYbOOoVFFdfKgteYs9sqg8MKoxqgs5eBTV8o36tD70xGCN8my9et/
g6uI8X4O3rxjnYulG79I
=aQZc
-----END PGP SIGNATURE-----
_______________________________________________
Users mailing list
Users at lists.strongswan.org
https://lists.strongswan.org/mailman/listinfo/users
----------------------------------------------------------------------------------------------------
Klinikverbund Westmünsterland gGmbH
Jur. Sitz der Gesellschaft: Am Boltenhof 7, 46325 Borken
Registergericht Coesfeld, HRB Nr. 8983
Ust.-Id.Nr.: DE 222740345
Geschäftsführer: Christoph Bröcker, Ludger Hellmann
Diese E-Mail enthält vertrauliche oder rechtlich geschützte
Informationen. Wenn Sie nicht der beabsichtige Empfänger sind,
informieren Sie bitte sofort den Absender und löschen Sie diese E-Mail.
Das unbefugte Kopieren dieser E-Mail oder die unbefugte Weitergabe der
enthaltenen Informationen ist nicht gestattet.
Dem Klinikverbund Westmünsterland sind fünf Krankenhäuser mit 1.332
Planbetten und mehrere Einrichtungen der Altenhilfe angeschlossen. Mehr
als 50 Fachbereiche orientieren sich an neusten medizinischen Standards
und erfüllen die hohen Anforderungen einer qualifizierten und
zertifizierten Versorgung. Rund 50.000 Patienten werden jährlich in den
Krankenhäusern stationär behandelt. Mit über 3.800 Mitarbeitern gehört
der Verbund zu den größten Arbeitgebern der Region.
More information about the Users
mailing list