[strongSwan] payload of type AUTH more than 1 times (2) occurred in current message
asalinas at sierrawireless.com
Mon Jul 20 19:09:11 CEST 2015
From: Alexis Salinas
Sent: July 14, 2015 12:05
To: Andreas Steffen
Subject: RE: [strongSwan] payload of type AUTH more than 1 times (2) occurred in current message
Thanks for the reply Andreas.
That is what I thought too, but I was wondering if that was allowed. So, thank you for the strong clarification.
Do you know if this was allowed in IKEv1 and perhaps these guys just re-use part of their code?
As per your request, here are 2 files. One with ike=3 enabled, which didn't show much more detail around the error. On the second fiIe I also enable enc=2 in case that is more useful (you can see the parsing and verification of the message)
Let me know if you need anything else.
From: Andreas Steffen [andreas.steffen at strongswan.org]
Sent: July 14, 2015 03:12
To: Alexis Salinas; users at lists.strongswan.org
Subject: Re: [strongSwan] payload of type AUTH more than 1 times (2) occurred in current message
it looks as if the 3rd party VPN client sends two AUTH payloads in its
IKE_AUTH request. This does not conform with the IKEv2 RFC. Could you
send me a strongSwan log file with the log level set to
On 07/13/2015 09:23 PM, Alexis Salinas wrote:
> Hello All,
> I'm testing strongSwan as a VPN gateway for a 3rd party VPN client. PSK and certificate authentication works fine, but when testing EAP-TLS and I get this error message on the strongSwan side, after the EAP authentication succeeds.
> Jul 10 16:42:11 debian-vm1-alexis charon: 14[ENC] payload of type AUTH more than 1 times (2) occurred in current message
> Jul 10 16:42:11 debian-vm1-alexis charon: 14[IKE] message verification failed
> See attachment for full logs.
> Here is my strongSwan configuration:
> # ipsec.conf - strongSwan IPsec configuration file
> config setup
> # strictcrlpolicy=yes
> # uniqueids = no
> conn %default
> conn rw-eap-tls
> leftid=ocm at test.org
> Does any of you know what this is about?
> what is strongSwan expecting at this point? Looking at the RFC  there should be a message type AUTH (message 7).
> I can enable more logging if needed.
>  : https://tools.ietf.org/html/rfc7296#section-2.16
> Users mailing list
> Users at lists.strongswan.org
Andreas Steffen andreas.steffen at strongswan.org
strongSwan - the Open Source VPN Solution! www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
More information about the Users