[strongSwan] Two problems with cisco and sonicwall.

Jordi Casanellas matalaaranya at gmail.com
Sun Mar 19 14:20:30 CET 2017


Hello,

I followed the sonicwall manual to the letter, but after 48h the tunnel
drops and there is no possibility of lifting the tunnel from any side.
I can only lift it by entering the sonicwall and the vpn by dialing
renegociate. (i'm restart ipsec and force up tunnel and not working only
renegociate in sonicwall).

The parameters that you quote me "In sonicwall, activate keep a live in
advanced tab, in ipsec.conf put auto = start" I have them as you told me
following the tutorial.

I gave you the route table 220
Ip route show table 220
172.20.1.0/24 dev eth0 scope link

I only see the route of the sonicwall vpn, I have 3 up more raised.
2 cisco and a Zyxel.

In all I happen something similar, there is no traffic and only from one
side or renegotiating with it to work correctly the VPN.
If you need more data, I'll give it to you.
I also give you the iptables in case you can help (camouflaging the ips).

~# iptables -L
-- START ---
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere             tcp
flags:ACK/ACK
ACCEPT     all  --  anywhere             anywhere             state
ESTABLISHED
ACCEPT     all  --  anywhere             anywhere             state RELATED
ACCEPT     udp  --  anywhere             anywhere             udp
spt:domain dpt
                s:1024:65535
ACCEPT     icmp --  anywhere             anywhere             icmp
echo-reply
ACCEPT     icmp --  anywhere             anywhere             icmp
destination-u
              nreachable
ACCEPT     icmp --  anywhere             anywhere             icmp
source-quench
ACCEPT     icmp --  anywhere             anywhere             icmp
time-exceeded
ACCEPT     icmp --  anywhere             anywhere             icmp
parameter-pro
              blem
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:auth
ACCEPT     icmp --  anywhere             anywhere             icmp
echo-request
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             tcp multiport
dpor
      ts smtp,submission
ACCEPT     tcp  --  anywhere             anywhere             tcp
dpts:ftp-data:
                ftp
ACCEPT     tcp  --  anywhere             anywhere             tcp multiport
dpor
      ts pop3,pop3s
ACCEPT     tcp  --  anywhere             anywhere             tcp multiport
dpor
      ts imap2,imap3,imaps
ACCEPT     tcp  --  anywhere             anywhere             tcp
dpts:webmin:10
                010
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:20000
ACCEPT     ah   --  anywhere             anywhere
ACCEPT     esp  --  anywhere             anywhere
ACCEPT     udp  --  anywhere             anywhere             udp dpt:isakmp
ACCEPT     udp  --  anywhere             anywhere             udp
dpt:ipsec-nat-
                t
ACCEPT     udp  --  anywhere             anywhere             udp
dpts:re-mail-c
                k:58
ACCEPT     tcp  --  anywhere             anywhere             tcp
dpts:re-mail-c
                k:58
ACCEPT     all  --  172.20.1.0/24        anywhere
ACCEPT     all  --  192.168.4.0/24       anywhere
ACCEPT     all  --  192.168.1.0/24       anywhere
ACCEPT     all  --  192.168.3.0/24       anywhere
ACCEPT     all  --  192.168.3.0/24       anywhere
ACCEPT     all  --  192.168.6.0/24       anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  172.20.1.0/24        10.200.1.0/24        policy match
dir i
      n pol ipsec reqid 1 proto esp
ACCEPT     all  --  10.200.1.0/24        172.20.1.0/24        policy match
dir o
      ut pol ipsec reqid 1 proto esp
ACCEPT     all  --  10.200.1.0/24        192.168.3.0/24       policy match
dir o
      ut pol ipsec reqid 1 proto esp
ACCEPT     all  --  192.168.3.0/24       10.200.1.0/24        policy match
dir i
      n pol ipsec reqid 1 proto esp
ACCEPT     all  --  192.168.4.0/24       10.200.1.0/24        policy match
dir i
      n pol ipsec reqid 1 proto esp
ACCEPT     all  --  10.200.1.0/24        192.168.4.0/24       policy match
dir o
      ut pol ipsec reqid 1 proto esp
ACCEPT     all  --  192.168.6.0/24       10.200.1.0/24        policy match
dir i
      n pol ipsec reqid 1 proto esp
ACCEPT     all  --  10.200.1.0/24        192.168.6.0/24       policy match
dir o
      ut pol ipsec reqid 1 proto esp
ACCEPT     all  --  192.168.6.0/24       10.200.1.0/24        policy match
dir i
      n pol ipsec reqid 1 proto esp
ACCEPT     all  --  10.200.1.0/24        192.168.1.0/24       policy match
dir o
      ut pol ipsec reqid 1 proto esp
ACCEPT     all  --  192.168.1.0/24       10.200.1.0/24        policy match
dir i
      n pol ipsec reqid 1 proto esp

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     udp  --  anywhere
205.red-80-32-138.staticip.rima-tde.net
                                          udp dpt:isakmp
ACCEPT     esp  --  anywhere
205.red-80-32-138.staticip.rima-tde.net

ACCEPT     udp  --  anywhere             8x.1xx.1.2x.static.user.ono.com
 udp dp
        t:isakmp
ACCEPT     esp  --  anywhere             8x.1xx.1.2x.static.user.ono.com
ACCEPT     udp  --  anywhere             default              udp dpt:isakmp
ACCEPT     esp  --  anywhere             default
----- END ---

As I understand routes 220 are not necessary as long as this is correct in
the policies. (Maybe I misunderstood).

Ip xfrm policy
Src 0.0.0.0/0 dst 0.0.0.0/0
         Socket in priority 0 ptype main
Src 0.0.0.0/0 dst 0.0.0.0/0
         Socket out priority 0 ptype main
Src 0.0.0.0/0 dst 0.0.0.0/0
         Socket in priority 0 ptype main
Src 0.0.0.0/0 dst 0.0.0.0/0
         Socket out priority 0 ptype main
Src :: / 0 dst :: / 0
         Socket in priority 0 ptype main
Src :: / 0 dst :: / 0
         Socket out priority 0 ptype main
Src :: / 0 dst :: / 0
         Socket in priority 0 ptype main
Src :: / 0 dst :: / 0
         Socket out priority 0 ptype main

That when I lift the vpn forcing the correct routes appear.
Also what I do not know if it is normal since the debian that I have
installed strongswan did not reach any subnet of any vpn raised. I do not
know if this is normal.

Thank you!


2017-03-19 10:38 GMT+01:00 Faycal BEKHTI <f.bekhti at paris-turf.com>:

> Hello ,
>
> In sonicwall , activate keep a live in advanced tab  , in ipsec.conf put
> auto=start
>
> https://support.sonicwall.com/kb/sw13753
>
> Télécharger Outlook pour Android <https://aka.ms/ghei36>
>
> ------------------------------
> *From:* Users <users-bounces at lists.strongswan.org> on behalf of Jordi
> Casanellas <matalaaranya at gmail.com>
> *Sent:* Friday, March 17, 2017 8:10:57 AM
> *To:* users at lists.strongswan.org
> *Subject:* [strongSwan] Two problems with cisco and sonicwall.
>
> Hello,
>
> I'm have a strongswan configured to connect sonicwall.  The tunnel its ok
> and work perfectly but 8h disconect and not renegociate,  but in sonicwall
> click in button renegociate and work perfectly.  Can you help me?.
>
> With cisco asa i'm have a another problem only up tunnel,  create ping on
> cisco to strongswan.
>
> In my strongswan not working ping to any subnet vpn.
>
> Thank you!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20170319/6719bc7d/attachment-0001.html>


More information about the Users mailing list