[strongSwan] EAP-Radius setup not getting routes or passing traffic
C Babs
qoyagoogs at gmail.com
Mon Dec 5 21:33:06 CET 2016
Hi Noel,
I have made changes and it is much closer. I thought the leftsourceip was
arbitrary like assigning a loopback interface as source in Cisco world, so
thanks for the clarification. I added a second spoke and can now pass
traffic when initiated from the hub to the spoke but not vice versa, nor
spoke to spoke. iptables is set to ACCEPT as policy for FORWARD and INPUT
on all devices for testing purposes.
conn rw-eap
esp=aes128-sha256!
ike=aes128-sha256-modp2048!
left=172.30.5.161
leftsubnet=172.21.0.0/23
#leftsourceip=172.21.0.1
leftid=@moon <http://AwsEastNat1.qoya.io>
leftcert=/etc/ipsec.d/public/peer.der
leftauth=pubkey
leftfirewall=yes
rightid=*@qoya.io
rightauth=eap-radius
rightsourceip=%radius
rightsendcert=never
eap_identity=%any
right=%any
#rightsubnet=%any
auto=add
root at ip-172-30-5-161:/etc# ip xfrm policy
src 172.21.0.26/32 dst 172.21.0.0/23
dir fwd priority 2855 ptype main
tmpl src 24.11.199.101 dst 172.30.5.161
proto esp reqid 1 mode tunnel
src 172.21.0.26/32 dst 172.21.0.0/23
dir in priority 2855 ptype main
tmpl src 24.11.199.101 dst 172.30.5.161
proto esp reqid 1 mode tunnel
src 172.21.0.0/23 dst 172.21.0.26/32
dir out priority 2855 ptype main
tmpl src 172.30.5.161 dst 24.11.199.101
proto esp reqid 1 mode tunnel
src 172.21.0.25/32 dst 172.21.0.0/23
dir fwd priority 2855 ptype main
tmpl src 24.11.199.101 dst 172.30.5.161
proto esp reqid 2 mode tunnel
src 172.21.0.25/32 dst 172.21.0.0/23
dir in priority 2855 ptype main
tmpl src 24.11.199.101 dst 172.30.5.161
proto esp reqid 2 mode tunnel
src 172.21.0.0/23 dst 172.21.0.25/32
dir out priority 2855 ptype main
tmpl src 172.30.5.161 dst 24.11.199.101
proto esp reqid 2 mode tunnel
root at ip-172-30-5-161:/etc# ip route sho table 220
172.21.0.25 via 172.30.5.1 dev eth0 proto static src 172.21.0.2
172.21.0.26 via 172.30.5.1 dev eth0 proto static src 172.21.0.2
root at ip-172-30-5-161:/etc# ping 172.21.0.25
PING 172.21.0.25 (172.21.0.25) 56(84) bytes of data.
64 bytes from 172.21.0.25: icmp_seq=1 ttl=64 time=35.5 ms
root at ip-172-30-5-161:/etc# ping 172.21.0.26
PING 172.21.0.26 (172.21.0.26) 56(84) bytes of data.
64 bytes from 172.21.0.26: icmp_seq=1 ttl=64 time=35.2 ms
Client/Spoke:
conn AWS-EAST-NAT1-IKE2-TUN
esp=aes128-sha256!
ike=aes128-sha256-modp2048!
left=%any
#leftsubnet=0.0.0.0/0
leftid=HARDA-CORP4 at qoya.io
eap_identity=HARDA-CORP4
leftauth=eap
leftsourceip=%config4
leftfirewall=yes
right=54.209.117.209
rightid=@AwsEastNat1.qoya.io
rightcert=/etc/ipsec.d/certs/peerAwsEastNat1Cert.der
rightrsasigkey=/etc/ipsec.d/public/peerAwsEastNat1Key.der
rightsubnet=172.21.0.0/23
#rightsourceip=%config
rightauth=pubkey
auto=start
root at Need-Config:/etc# ip xfrm policy
src 172.21.0.0/23 dst 172.21.0.26/32
dir fwd priority 185920
tmpl src 54.209.117.209 dst 10.100.0.116
proto esp reqid 1 mode tunnel
src 172.21.0.0/23 dst 172.21.0.26/32
dir in priority 185920
tmpl src 54.209.117.209 dst 10.100.0.116
proto esp reqid 1 mode tunnel
src 172.21.0.26/32 dst 172.21.0.0/23
dir out priority 185920
tmpl src 10.100.0.116 dst 54.209.117.209
proto esp reqid 1 mode tunnel
root at Need-Config:/etc# ping 172.21.0.2
PING 172.21.0.2 (172.21.0.2): 56 data bytes
^C^C
--- 172.21.0.2 ping statistics ---
4 packets transmitted, 0 packets received, 100% packet loss
root at Need-Config:/etc# ping 172.21.0.25
PING 172.21.0.25 (172.21.0.25): 56 data bytes
^C
--- 172.21.0.25 ping statistics ---
3 packets transmitted, 0 packets received, 100% packet loss
root at Need-Config:/etc#
Thanks,
Chris
On Mon, Dec 5, 2016 at 11:30 AM, C Babcock <qoyagoogs at gmail.com> wrote:
> Hi Noel,
>
> Thank for the kind response. Something happened when I copy/pasted.
>
> This:
>
> > leftsubnet=172.21.0.0/23
> > leftsourceip=172.21.0.
>
> Actually looks like this:
>
> > leftsubnet=172.21.0.0/23
> > leftsourceip=172.21.0.2
>
> I dont know why the 2 got cut off.
>
> I added this when I could get TS to accept.
>
> > conn AWS-EAST-NAT1-IKE2-TUN
> > leftsubnet=%any
>
> I will make the other changes you suggested. Thanks.
>
> CB
>
> On Mon, Dec 5, 2016 at 5:46 AM, Noel Kuntze <noel at familie-kuntze.de>
> wrote:
>
>> Hello Chris,
>>
>> On 05.12.2016 05:23, C Babcock wrote:
>> > however I cant pass traffic to the server from the client and vice
>> versa.
>> That is because nearly every single setting in your configuration related
>> to the TS is invalid.
>>
>> > leftsubnet=172.21.0.0/23
>> > leftsourceip=172.21.0.
>>
>> First of all, you're assigning virtual IPs to the wrong side.
>>
>> Then the value of leftsourceip is invalid. It must be the subnet that you
>> want to assign virtual IPs from.
>> Do not set leftsubnet, if you already set leftsourceip. Vice versa for
>> rightsubnet and rightsourceip.
>>
>> > rightsubnet=%any
>> That's invalid, too.
>>
>> > ip xfrm policy
>> > src 0.0.0.0/32 dst 172.21.0.0/23
>> > dir fwd priority 2855 ptype main
>> > tmpl src 24.11.199.101 dst 172.30.5.161
>> > proto esp reqid 2 mode tunnel
>> > src 0.0.0.0/32 dst 172.21.0.0/23
>> > dir in priority 2855 ptype main
>> > tmpl src 24.11.199.101 dst 172.30.5.161
>> > proto esp reqid 2 mode tunnel
>> > src 172.21.0.0/23 dst 0.0.0.0/32
>> > dir out priority 2855 ptype main
>> > tmpl src 172.30.5.161 dst 24.11.199.101
>> > proto esp reqid 2 mode tunnel
>>
>> Those nonsensical policies are the result of your invalid configuration.
>>
>> >
>> > ip route show table 220
>> > 0.0.0.0 via 172.30.5.1 dev eth0 proto static src 172.21.0.2
>>
>> Result of the nonsensical policies.
>>
>> > conn AWS-EAST-NAT1-IKE2-TUN
>> > leftsubnet=%any
>>
>> Invalid setting. Don't set it when using leftsourceip (Unless you know
>> what you're doing, which you obviously don't).
>>
>>
>>
>> --
>>
>> Mit freundlichen Grüßen/Kind Regards,
>> Noel Kuntze
>>
>> GPG Key ID: 0x63EC6658
>> Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658
>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20161205/fc758246/attachment-0001.html>
More information about the Users
mailing list