[strongSwan] VPN with preshared Key between BB10 and Raspberry-Pi

[Christian Klugesherz]

Hi Tobias,

Many thanks for your help.
No I don't have any error on the startup

sudo ipsec restart
         Stopping strongSwan IPsec...
         Starting strongSwan 5.2.1 IPsec [starter]...
         !! Your strongswan.conf contains manual plugin load options for charon.
         !! This is recommended for experts only, see
         !! http://wiki.strongswan.org/projects/strongswan/wiki/PluginLoad


I guess that : eap-mschapv2  is not loaded, even I have require it in
strongswan.conf
How can I fix it ?

Many thanks

Christian


Running : ipsec listall, provides

List of registered IKE algorithms:

  encryption: AES_CBC[aes]
  integrity:  HMAC_SHA1_96[hmac] HMAC_SHA1_128[hmac]
HMAC_SHA1_160[hmac] HMAC_MD5_96[hmac] HMAC_MD5_128[hmac]
              HMAC_SHA2_256_128[hmac] HMAC_SHA2_256_256[hmac]
HMAC_SHA2_384_192[hmac] HMAC_SHA2_384_384[hmac]
              HMAC_SHA2_512_256[hmac] HMAC_SHA2_512_512[hmac] AES_XCBC_96[xcbc]
  aead:
  hasher:     HASH_SHA1[sha1] HASH_SHA224[sha2] HASH_SHA256[sha2]
HASH_SHA384[sha2] HASH_SHA512[sha2] HASH_MD5[md5]
  prf:        PRF_KEYED_SHA1[sha1] PRF_HMAC_SHA1[hmac]
PRF_HMAC_MD5[hmac] PRF_HMAC_SHA2_256[hmac]
              PRF_HMAC_SHA2_384[hmac] PRF_HMAC_SHA2_512[hmac]
PRF_AES128_XCBC[xcbc] PRF_FIPS_SHA1_160[fips-prf]
  dh-group:   MODP_2048[gmp] MODP_2048_224[gmp] MODP_2048_256[gmp]
MODP_1536[gmp] MODP_3072[gmp] MODP_4096[gmp]
              MODP_6144[gmp] MODP_8192[gmp] MODP_1024[gmp]
MODP_1024_160[gmp] MODP_768[gmp] MODP_CUSTOM[gmp]
  random-gen: RNG_STRONG[random] RNG_TRUE[random]
  nonce-gen:  [nonce]

List of loaded Plugins:

charon:
    CUSTOM:libcharon
        NONCE_GEN
        CUSTOM:libcharon-receiver
        CUSTOM:kernel-ipsec
        CUSTOM:kernel-net
    CUSTOM:libcharon-receiver
        HASHER:HASH_SHA1
        RNG:RNG_STRONG
        CUSTOM:socket
aes:
    CRYPTER:AES_CBC-16
    CRYPTER:AES_CBC-24
    CRYPTER:AES_CBC-32
sha1:
    HASHER:HASH_SHA1
    PRF:PRF_KEYED_SHA1
sha2:
    HASHER:HASH_SHA224
    HASHER:HASH_SHA256
    HASHER:HASH_SHA384
    HASHER:HASH_SHA512
md5:
    HASHER:HASH_MD5
pem:
    PRIVKEY:ANY (not loaded)
        PRIVKEY:ANY
        HASHER:HASH_MD5 (soft)
    PRIVKEY:RSA
        PRIVKEY:RSA
        HASHER:HASH_MD5 (soft)
    PRIVKEY:ECDSA (not loaded)
        PRIVKEY:ECDSA
        HASHER:HASH_MD5 (soft)
    PRIVKEY:DSA (not loaded)
        PRIVKEY:DSA
        HASHER:HASH_MD5 (soft)
    PUBKEY:ANY
        PUBKEY:ANY
    PUBKEY:RSA
        PUBKEY:RSA
    PUBKEY:ECDSA (not loaded)
        PUBKEY:ECDSA
    PUBKEY:DSA (not loaded)
        PUBKEY:DSA
    CERT_DECODE:ANY
        CERT_DECODE:X509 (soft)
        CERT_DECODE:PGP (soft)
    CERT_DECODE:X509
        CERT_DECODE:X509
    CERT_DECODE:X509_CRL
        CERT_DECODE:X509_CRL
    CERT_DECODE:X509_OCSP_REQUEST (not loaded)
        CERT_DECODE:X509_OCSP_REQUEST
    CERT_DECODE:X509_OCSP_RESPONSE
        CERT_DECODE:X509_OCSP_RESPONSE
    CERT_DECODE:X509_AC
        CERT_DECODE:X509_AC
    CERT_DECODE:PKCS10_REQUEST
        CERT_DECODE:PKCS10_REQUEST
    CERT_DECODE:TRUSTED_PUBKEY (not loaded)
        CERT_DECODE:TRUSTED_PUBKEY
    CERT_DECODE:PGP (not loaded)
        CERT_DECODE:PGP
    CONTAINER_DECODE:PKCS12 (not loaded)
        CONTAINER_DECODE:PKCS12
pkcs1:
    PRIVKEY:RSA
    PUBKEY:ANY
        PUBKEY:RSA (soft)
        PUBKEY:ECDSA (soft)
        PUBKEY:DSA (soft)
    PUBKEY:RSA
gmp:
    DH:MODP_2048
        RNG:RNG_STRONG
    DH:MODP_2048_224
        RNG:RNG_STRONG
    DH:MODP_2048_256
        RNG:RNG_STRONG
    DH:MODP_1536
        RNG:RNG_STRONG
    DH:MODP_3072
        RNG:RNG_STRONG
    DH:MODP_4096
        RNG:RNG_STRONG
    DH:MODP_6144
        RNG:RNG_STRONG
    DH:MODP_8192
        RNG:RNG_STRONG
    DH:MODP_1024
        RNG:RNG_STRONG
    DH:MODP_1024_160
        RNG:RNG_STRONG
    DH:MODP_768
        RNG:RNG_STRONG
    DH:MODP_CUSTOM
        RNG:RNG_STRONG
    PRIVKEY:RSA
    PRIVKEY_GEN:RSA
        RNG:RNG_TRUE
    PUBKEY:RSA
    PRIVKEY_SIGN:RSA_EMSA_PKCS1_NULL
    PRIVKEY_SIGN:RSA_EMSA_PKCS1_SHA1
        HASHER:HASH_SHA1
    PRIVKEY_SIGN:RSA_EMSA_PKCS1_SHA224
        HASHER:HASH_SHA224
    PRIVKEY_SIGN:RSA_EMSA_PKCS1_SHA256
        HASHER:HASH_SHA256
    PRIVKEY_SIGN:RSA_EMSA_PKCS1_SHA384
        HASHER:HASH_SHA384
    PRIVKEY_SIGN:RSA_EMSA_PKCS1_SHA512
        HASHER:HASH_SHA512
    PRIVKEY_SIGN:RSA_EMSA_PKCS1_MD5
        HASHER:HASH_MD5
    PUBKEY_VERIFY:RSA_EMSA_PKCS1_NULL
    PUBKEY_VERIFY:RSA_EMSA_PKCS1_SHA1
        HASHER:HASH_SHA1
    PUBKEY_VERIFY:RSA_EMSA_PKCS1_SHA224
        HASHER:HASH_SHA224
    PUBKEY_VERIFY:RSA_EMSA_PKCS1_SHA256
        HASHER:HASH_SHA256
    PUBKEY_VERIFY:RSA_EMSA_PKCS1_SHA384
        HASHER:HASH_SHA384
    PUBKEY_VERIFY:RSA_EMSA_PKCS1_SHA512
        HASHER:HASH_SHA512
    PUBKEY_VERIFY:RSA_EMSA_PKCS1_MD5
        HASHER:HASH_MD5
    PRIVKEY_DECRYPT:ENCRYPT_RSA_PKCS1
    PUBKEY_ENCRYPT:ENCRYPT_RSA_PKCS1
        RNG:RNG_WEAK
random:
    RNG:RNG_STRONG
    RNG:RNG_TRUE
nonce:
    NONCE_GEN
        RNG:RNG_WEAK
x509:
    CERT_ENCODE:X509
        HASHER:HASH_SHA1
    CERT_DECODE:X509
        HASHER:HASH_SHA1
        PUBKEY:ANY
    CERT_ENCODE:X509_AC
    CERT_DECODE:X509_AC
    CERT_ENCODE:X509_CRL
    CERT_DECODE:X509_CRL
    CERT_ENCODE:X509_OCSP_REQUEST
        HASHER:HASH_SHA1
        RNG:RNG_WEAK
    CERT_DECODE:X509_OCSP_RESPONSE
    CERT_ENCODE:PKCS10_REQUEST
    CERT_DECODE:PKCS10_REQUEST
revocation:
    CUSTOM:revocation
        CERT_ENCODE:X509_OCSP_REQUEST (soft)
        CERT_DECODE:X509_OCSP_RESPONSE (soft)
        CERT_DECODE:X509_CRL (soft)
        CERT_DECODE:X509 (soft)
        FETCHER:(null) (soft)
hmac:
    PRF:PRF_HMAC_SHA1
        HASHER:HASH_SHA1
    PRF:PRF_HMAC_MD5
        HASHER:HASH_MD5
    PRF:PRF_HMAC_SHA2_256
        HASHER:HASH_SHA256
    PRF:PRF_HMAC_SHA2_384
        HASHER:HASH_SHA384
    PRF:PRF_HMAC_SHA2_512
        HASHER:HASH_SHA512
    SIGNER:HMAC_SHA1_96
        HASHER:HASH_SHA1
    SIGNER:HMAC_SHA1_128
        HASHER:HASH_SHA1
    SIGNER:HMAC_SHA1_160
        HASHER:HASH_SHA1
    SIGNER:HMAC_MD5_96
        HASHER:HASH_MD5
    SIGNER:HMAC_MD5_128
        HASHER:HASH_MD5
    SIGNER:HMAC_SHA2_256_128
        HASHER:HASH_SHA256
    SIGNER:HMAC_SHA2_256_256
        HASHER:HASH_SHA256
    SIGNER:HMAC_SHA2_384_192
        HASHER:HASH_SHA384
    SIGNER:HMAC_SHA2_384_384
        HASHER:HASH_SHA384
    SIGNER:HMAC_SHA2_512_256
        HASHER:HASH_SHA512
    SIGNER:HMAC_SHA2_512_512
        HASHER:HASH_SHA512
xcbc:
    PRF:PRF_AES128_XCBC
        CRYPTER:AES_CBC-16
    PRF:PRF_CAMELLIA128_XCBC (not loaded)
        CRYPTER:CAMELLIA_CBC-16
    SIGNER:CAMELLIA_XCBC_96 (not loaded)
        CRYPTER:CAMELLIA_CBC-16
    SIGNER:AES_XCBC_96
        CRYPTER:AES_CBC-16
stroke:
    CUSTOM:stroke
        PRIVKEY:RSA (soft)
        PRIVKEY:ECDSA (soft)
        PRIVKEY:DSA (soft)
        CERT_DECODE:ANY (soft)
        CERT_DECODE:X509 (soft)
        CERT_DECODE:X509_CRL (soft)
        CERT_DECODE:X509_AC (soft)
        CERT_DECODE:TRUSTED_PUBKEY (soft)
kernel-netlink:
    CUSTOM:kernel-ipsec
    CUSTOM:kernel-net
socket-default:
    CUSTOM:socket
        CUSTOM:kernel-ipsec (soft)
fips-prf:
    PRF:PRF_FIPS_SHA1_160
        PRF:PRF_KEYED_SHA1
updown:
    CUSTOM:updown

2016-07-14 9:59 GMT+02:00 Tobias Brunner <tobias at strongswan.org>:
> Hi Christian,
>
>> Is the issue linked to : "loading EAP_MSCHAPV2 method failed" ?
>
> So check the log and `ipsec listall`.  Is the eap-mschapv2 plugin
> actually loaded?  Are the DES and MD4 algorithms available?  Are any
> errors logged during startup?
>
> Regards,
> Tobias
>