[strongSwan] IKE2 4500 Reply Not Making it Out
Info
infosec at quantum-equities.com
Fri Mar 23 19:24:40 CET 2018
Trying again, a month and a half and counting, back to the simpler
swanctl config, pro forma
<https://wiki.strongswan.org/projects/strongswan/wiki/HelpRequests>:
Anyone know why CentOS 7.4 with kernel 4.13.0-1.el7.elrepo.x86_64 makes an:
ipsec0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1400
inet6 fe80::8ad2:285b:b89d:44ea prefixlen 64 scopeid 0x20<link>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
txqueuelen 500 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
... interface, when ipsec tunnels were supposed to have gone out years
ago? Could some of my traffic be getting diverted here? Should this be
set up in the firewall?
Anyone know why Strongswan seems to consider this the correct location
for CA certs:
Mar 23 10:40:35 cygnus.darkmatter.org charon-systemd[41093]: loading ca
certificates from '/etc/strongswan/ipsec.d/cacerts'
... rather than:
Mar 23 10:40:35 cygnus.darkmatter.org charon-systemd[41093]: loaded
certificate 'C=US, O=Quantum, CN=quantum-equities.com CA'
Mar 23 10:40:35 cygnus.darkmatter.org charon-systemd[41093]: 11[CFG]
loaded certificate 'C=US, O=Quantum, CN=quantum-equities.com CA'
Mar 23 10:40:36 cygnus.darkmatter.org swanctl[41112]: loaded certificate
from '/etc/strongswan/swanctl/x509ca/aries-CAcert.pem'
Anyone know why the phone is making four consecutive attempts, with no
response from the daemon?
Attached hereto: charon.log and iptables-save. SELinux is Permissive,
and no firewall on the IPSec gateway. No change.
-------------------------------------------------------------------------------------------------------_
strongswan.conf:_
charon {
load_modular = yes
plugins {
include strongswan.d/charon/*.conf
}
}
include strongswan.d/*.conf
_charon.conf_
charon {
# two defined file loggers
filelog {
/var/log/charon.log {
time_format = %a, %Y-%m-%d %R
ike_name = yes
append = no
default = 2
flush_line = yes
}
stderr {
mgr = 0
net = 1
enc = 1
asn = 1
job = 1
knl = 1
}
}
_swanctl.conf:
_connections {
ikev2-pubkey {
version = 2
rekey_time = 0s
local {
id = quantum-equities.com
id = cygnus.darkmatter.org
}
remote {
# defaults are fine.
}
children {
ikev2-pubkey {
local_ts = %any
remote_ts = %any
mode = transport
}
}
}
}
# swanctl -L
ikev2-pubkey: IKEv2, no reauthentication, no rekeying
local: %any
remote: %any
local unspecified authentication:
id: cygnus.darkmatter.org
remote unspecified authentication:
ikev2-pubkey: TRANSPORT, rekeying every 3600s
local: 0.0.0.0/32
remote: 0.0.0.0/32
# swanctl -l
#
# ip route show table all
default via 192.168.1.1 dev eth0
169.254.0.0/16 dev eth0 scope link metric 1002
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.16
broadcast 127.0.0.0 dev lo table local proto kernel scope link src
127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src
127.0.0.1
broadcast 192.168.1.0 dev eth0 table local proto kernel scope link src
192.168.1.16
local 192.168.1.16 dev eth0 table local proto kernel scope host src
192.168.1.16
broadcast 192.168.1.255 dev eth0 table local proto kernel scope link src
192.168.1.16
unreachable ::/96 dev lo metric 1024 error -113
unreachable ::ffff:0.0.0.0/96 dev lo metric 1024 error -113
unreachable 2002:a00::/24 dev lo metric 1024 error -113
unreachable 2002:7f00::/24 dev lo metric 1024 error -113
unreachable 2002:a9fe::/32 dev lo metric 1024 error -113
unreachable 2002:ac10::/28 dev lo metric 1024 error -113
unreachable 2002:c0a8::/32 dev lo metric 1024 error -113
unreachable 2002:e000::/19 dev lo metric 1024 error -113
unreachable 3ffe:ffff::/32 dev lo metric 1024 error -113
fe80::/64 dev eth0 proto kernel metric 256
fe80::/64 dev ipsec0 proto kernel metric 256
local ::1 dev lo table local proto kernel metric 0
local fe80::5054:ff:fec0:9330 dev lo table local proto kernel metric 0
local fe80::8ad2:285b:b89d:44ea dev lo table local proto kernel metric 0
ff00::/8 dev eth0 table local metric 256
ff00::/8 dev ipsec0 table local metric 256
# ip address
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen
1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
state UP qlen 1000
link/ether 52:54:00:c0:93:30 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.16/24 brd 192.168.1.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::5054:ff:fec0:9330/64 scope link
valid_lft forever preferred_lft forever
58: ipsec0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1400 qdisc
pfifo_fast state UNKNOWN qlen 500
link/none
inet6 fe80::8ad2:285b:b89d:44ea/64 scope link flags 800
valid_lft forever preferred_lft forever
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20180323/5ceba0fa/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: charon.log.bz2
Type: application/x-bzip
Size: 9458 bytes
Desc: not available
URL: <http://lists.strongswan.org/pipermail/users/attachments/20180323/5ceba0fa/attachment-0001.bin>
-------------- next part --------------
# Generated by iptables-save v1.4.21 on Fri Mar 23 11:21:51 2018
*mangle
:PREROUTING ACCEPT [127:8908]
:INPUT ACCEPT [127:8908]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [67:5189]
:POSTROUTING ACCEPT [66:5105]
COMMIT
# Completed on Fri Mar 23 11:21:51 2018
# Generated by iptables-save v1.4.21 on Fri Mar 23 11:21:51 2018
*nat
:PREROUTING ACCEPT [4:692]
:INPUT ACCEPT [4:692]
:OUTPUT ACCEPT [1:48]
:POSTROUTING ACCEPT [1:48]
COMMIT
# Completed on Fri Mar 23 11:21:51 2018
# Generated by iptables-save v1.4.21 on Fri Mar 23 11:21:51 2018
*raw
:PREROUTING ACCEPT [127:8908]
:OUTPUT ACCEPT [66:5105]
COMMIT
# Completed on Fri Mar 23 11:21:51 2018
# Generated by iptables-save v1.4.21 on Fri Mar 23 11:21:51 2018
*filter
:INPUT ACCEPT [127:8908]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [66:5105]
COMMIT
# Completed on Fri Mar 23 11:21:51 2018
More information about the Users
mailing list