[strongSwan] IPsec - between TL-ER6120 and OpenWRT with strongSwan [beginner]

tomek_byd at tlen.pl tomek_byd at tlen.pl
Mon Jul 20 16:13:35 CEST 2015


Hello!

I have a lot of progress. IPsec connection set up properly.
Unfortunately ping does not work between networks. In OpenVPN I had
tunnels in interfaces with their own addresses. I set up routing
between them. Now I don't see the ends of the IPsec tunnel in
interfaces and don't know how to set routing.

root at SomeWRT:~# ipsec statusall
no files found matching '/etc/strongswan.d/*.conf'
Status of IKE charon daemon (strongSwan 5.3.2, Linux 3.10.49, mips):
  uptime: 11 seconds, since Jul 20 15:58:34 2015
  malloc: sbrk 122880, mmap 0, used 116464, free 6416
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0,
scheduled: 1
  loaded plugins: charon aes des sha1 sha2 md5 random nonce x509
revocation constraints pubkey pkcs1 pgp dnskey pem fips-prf gmp xcbc
hmac attr kernel-netlink resolve socket-default stroke updown
xauth-generic
Listening IP addresses:
  192.168.2.1
Connections:
somename:  B.B.B.B...A.A.A.A  IKEv1
somename:   local:  [B.B.B.B] uses pre-shared key authentication
somename:   remote: [A.A.A.A] uses pre-shared key authentication
somename:   child:  192.168.2.0/24 === 192.168.1.0/24 TUNNEL
Security Associations (1 up, 0 connecting):
somename[2]: ESTABLISHED 10 seconds ago, B.B.B.B[B.B.B.B]...A.A.A.A[A.A.A.A]
somename[2]: IKEv1 SPIs: xxxxxxxxxxxxxxxx_i xxxxxxxxxxxxxxxx_r*,
rekeying disabled
somename[2]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
somename{1}:  INSTALLED, TUNNEL, reqid 1, ESP SPIs: xxxxxxxx_i xxxxxxxx_o
somename{1}:  AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying disabled
somename{1}:   192.168.2.0/24 === 192.168.1.0/24

2015-07-20 14:19 GMT+02:00 Noel Kuntze <noel at familie-kuntze.de>:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Hello Tomek,
>
> I can tell from "Exchange Mode: Main" that it uses IKEv1.
> Append an @ to the IDs  on the strongSwan side
> to force charon to send the ID as type FQDN,
> which the other side expects (you set ID type to FQDN).
> Use AES-128 instead of 3DES. You should also
> use SHA1, not MD5. Furthermore, you enabled PFS in
> the configuration on the TP link, but not in strongSwan.
> Append the correct dh group to your ESP cipher settings.
>
> Look at the logs in the webinterface to find out what the TP link
> side doesn't like.
>
> Mit freundlichen Grüßen/Regards,
> Noel Kuntze
> Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658
>
> Am 20.07.2015 um 13:58 schrieb tomek_byd at tlen.pl:
>> Hello!
>>
>> After the change from IKEv1 to IKEv2 I have errors as shown below. In
>> the settings TP-Link I don't see the possibility to change IKEv1/v2. I
>> don't know what is even set in TP-Link. A sample panel is visible on
>> http://www.tp-link.com.pl/resources/simulator/TL-ER6120(UN)/userRpm/Index.htm.
>> What is best to change 3DES?
>>
>> root at SomeWRT:~# ipsec up somename
>> no files found matching '/etc/strongswan.d/*.conf'
>> initiating Main Mode IKE_SA somename[1] to A.A.A.A
>> generating ID_PROT request 0 [ SA V V V V ]
>> sending packet: from B.B.B.B[500] to A.A.A.A[500] (152 bytes)
>> received packet: from A.A.A.A[500] to B.B.B.B[500] (56 bytes)
>> parsed INFORMATIONAL_V1 request 1324794912 [ N(NO_PROP) ]
>> received NO_PROPOSAL_CHOSEN error notify
>> establishing connection 'somename' failed
>>
>> 2015-07-19 22:32 GMT+02:00 Noel Kuntze <noel at familie-kuntze.de>:
>>>
>> Hello Tomek,
>>
>> Try using IKEv1, not IKEv2. And use a different cipher than 3DES. It is very slow.
>>
>> Mit freundlichen Grüßen/Kind Regards,
>> Noel Kuntze
>>
>> GPG Key ID: 0x63EC6658
>> Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658
>>
>> Am 19.07.2015 um 13:34 schrieb tomek_byd:
>>>>> I don't know how to write the correct config file for the connection. My config is a conglomeration of many examples from the Internet. So far I havn't had contact with IPsec. I'm under the control of TL-ER6120 and OpenWRT so I can make changes on both devices. I see the error "IDr payload missing" but parameter "leftid" is set in the config file.
>>>>>
>>>>> LAN A (192.168.1.0/24) <-> TL-ER6120 (IP: A.A.A.A) <-> INTERNET <-> OpenWRT with strongSwan (IP: B.B.B.B) <-> LAN B (192.168.2.0/24)
>>>>>
>>>>> TL-ER6120 configuration:
>>>>> IKE Proposal: MD5, 3DES, DH2
>>>>> IKE Policy:
>>>>>   Exchange Mode: main,
>>>>>   Local ID Type: FQDN,
>>>>>   Local ID: A.A.A.A
>>>>>   Remote ID Type: FQDN
>>>>>   Remote ID: B.B.B.B
>>>>>   Pre-shared Key: XXXXXX
>>>>>   SA Lifetime: 28800
>>>>>   DPD: Disable
>>>>> IPsec Proposal: ESP, MD5, 3DES
>>>>> IPsec Policy:
>>>>>   Mode: LAN-to-LAN
>>>>>   Local Subnet: 192.168.1.0/24
>>>>>   Remote Subnet: 192.168.2.0/24
>>>>>   WAN: WAN1
>>>>>   Remote Gateway: B.B.B.B
>>>>>   Policy Mode: IKE
>>>>>   PFS: DH2
>>>>>   SA Lifetime: 28800
>>>>>
>>>>> OpenWRT configuration:
>>>>> /etc/ipsec.conf:
>>>>> config setup
>>>>>     # strictcrlpolicy = no
>>>>>     # uniqueids = no
>>>>> conn somename
>>>>>     ikelifetime=60m
>>>>>     keylife=20m
>>>>>     rekeymargin=3m
>>>>>     keyingtries=1
>>>>>     keyexchange=ikev2
>>>>>     type=tunnel
>>>>>     authby=secret
>>>>>     ike=3des-md5-modp1024!
>>>>>     esp=3des-md5!
>>>>>     rekey=no
>>>>>     left=B.B.B.B
>>>>>     leftid=B.B.B.B
>>>>>     leftsubnet=192.168.2.0/24
>>>>>     leftauth=psk
>>>>>     right=A.A.A.A
>>>>>     rightid=A.A.A.A
>>>>>     rightsubnet=192.168.1.0/24
>>>>>     rightauth=psk
>>>>>     dpdaction=none
>>>>>     auto=add
>>>>>     mobike=no
>>>>> /etc/ipsec.secrets
>>>>> A.A.A.A : PSK "XXXXXX"
>>>>> B.B.B.B : PSK "XXXXXX"
>>>>>
>>>>> Output:
>>>>> root at SomeWRT:~# ipsec up somename
>>>>> no files found matching '/etc/strongswan.d/*.conf'
>>>>> initiating IKE_SA somename[1] to A.A.A.A
>>>>> generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) ]
>>>>> sending packet: from B.B.B.B[500] to A.A.A.A[500] (316 bytes)
>>>>> received packet: from A.A.A.A[500] to B.B.B.B[500] (332 bytes)
>>>>> parsed IKE_SA_INIT response 0 [ N(NATD_S_IP) N(NATD_D_IP) SA KE No ]
>>>>> local host is behind NAT, sending keep alives
>>>>> remote host is behind NAT
>>>>> authentication of 'B.B.B.B' (myself) with pre-shared key
>>>>> establishing CHILD_SA somename
>>>>> generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(EAP_ONLY) ]
>>>>> sending packet: from B.B.B.B[4500] to A.A.A.A[4500] (212 bytes)
>>>>> received packet: from A.A.A.A[4500] to B.B.B.B[4500] (68 bytes)
>>>>> parsed IKE_AUTH response 1 [ N(TS_UNACCEPT) ]
>>>>> IDr payload missing
>>>>> generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ]
>>>>> sending packet: from B.B.B.B[4500] to A.A.A.A[4500] (68 bytes)
>>>>> establishing connection 'somename' failed
>>>>>
>>>>> _______________________________________________
>>>>> Users mailing list
>>>>> Users at lists.strongswan.org
>>>>> https://lists.strongswan.org/mailman/listinfo/users
>>
>>>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQIcBAEBCAAGBQJVrOc2AAoJEDg5KY9j7GZYoaEP/3B0Ktku7nDagsjQiIbCeyaR
> kSSfegu/IrgbinSsXPzMbCFJUlyesRAM+qIUM4t21bWnHGPJh+ydrBc8b+5ybCxq
> lPhpTioEnASpOIDSH2Vc5tpPMJnXusslep5JU+KwcifnKAbhnZVtKpBAFNeAbPU0
> G9cu16a1sXcx9zxqhNUvrLqKJqrNsAy9oKTZ9aoPrTNCtUdLAHvHGALWXTgdNR60
> E87/G3Eo1GtDAMziiFs5ePsoI774H+uXITB3LmP4mo3t5lc1vC7bIa91FRTji5ol
> xTieBrsjUfs8dsWfa8Q5PzcXAPwxPuo3FCEXQ86ZEf8alEdyHAAwXfqo38UYUi6p
> Ll09XECjseBkQ7HjBy6Qf2mHO9A2poFsDkXIGJgt5Gfv/ZbH+6j7UH2YmghWNmgm
> 5YZpgO03Q4eVkVu4m1iWKW2H9PV9ZTQL7k5gpVA8NfoEZ6lWjd3lOE+8FnNqECPm
> ZdDZl4I+6NHXsuN6qYTw30q2E/doC22bQiInd/br5wwjcKi5JRTjsP4pfehbLeLm
> 3utkQ7JeewAunpG0NIfBsOiaElHxxA83DbfJo8q/vjrKQkKzT51YgTzRgQcWCdV2
> h+MfWSpLY3tW3KscrwDmBqz4x9HDSb9TVi3Pq1BBTcYaqYs5d17eufOhjBCnsZrx
> m4tmqqmn4CVLTlXGWLyP
> =0xLZ
> -----END PGP SIGNATURE-----


More information about the Users mailing list