[strongSwan] IKE2 4500 Reply Not Making it Out
Noel Kuntze
noel.kuntze+strongswan-users-ml at thermi.consulting
Fri Mar 23 19:48:24 CET 2018
>
> Anyone know why CentOS 7.4 with kernel 4.13.0-1.el7.elrepo.x86_64 makes an:
> ipsec0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1400
> inet6 fe80::8ad2:285b:b89d:44ea prefixlen 64 scopeid 0x20<link>
> unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 500 (UNSPEC)
> RX packets 0 bytes 0 (0.0 B)
> RX errors 0 dropped 0 overruns 0 frame 0
> TX packets 0 bytes 0 (0.0 B)
> TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
> ... interface, when ipsec tunnels were supposed to have gone out years ago? Could some of my traffic be getting diverted here? Should this be set up in the firewall?
That's because you're loading kernel-libipsec, which you shouldn't. Disable loading it.
No, nothing is getting diverted there. No, don't set it up, because you're getting rid of it right now.
> Fri, 2018-03-23 11:11 00[LIB] plugin 'kernel-libipsec': loaded successfully
> Anyone know why Strongswan seems to consider this the correct location for CA certs:
> Mar 23 10:40:35 cygnus.darkmatter.org charon-systemd[41093]: loading ca certificates from '/etc/strongswan/ipsec.d/cacerts'
> ... rather than:
> Mar 23 10:40:35 cygnus.darkmatter.org charon-systemd[41093]: loaded certificate 'C=US, O=Quantum, CN=quantum-equities.com CA'
> Mar 23 10:40:35 cygnus.darkmatter.org charon-systemd[41093]: 11[CFG] loaded certificate 'C=US, O=Quantum, CN=quantum-equities.com CA'
> Mar 23 10:40:36 cygnus.darkmatter.org swanctl[41112]: loaded certificate from '/etc/strongswan/swanctl/x509ca/aries-CAcert.pem'
It's because you're loading the stroke plugin, which you don't need.
> Fri, 2018-03-23 11:11 00[LIB] plugin 'stroke': loaded successfully
>
> Attached hereto: charon.log and iptables-save. SELinux is Permissive, and no firewall on the IPSec gateway. No change.
Those logs are too verbose, again. Please really use the logger configuration from the HelpRequests page.
Is there anything logged by the kernel in its ring buffer?
And please add the route I previously mentioned. And stop using ifconfig, or generally the net-tools.
Kind regards
Noel
On 23.03.2018 19:24, Info wrote:
> Trying again, a month and a half and counting, back to the simpler swanctl config, pro forma <https://wiki.strongswan.org/projects/strongswan/wiki/HelpRequests>:
>
> Anyone know why CentOS 7.4 with kernel 4.13.0-1.el7.elrepo.x86_64 makes an:
> ipsec0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1400
> inet6 fe80::8ad2:285b:b89d:44ea prefixlen 64 scopeid 0x20<link>
> unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 500 (UNSPEC)
> RX packets 0 bytes 0 (0.0 B)
> RX errors 0 dropped 0 overruns 0 frame 0
> TX packets 0 bytes 0 (0.0 B)
> TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
> ... interface, when ipsec tunnels were supposed to have gone out years ago? Could some of my traffic be getting diverted here? Should this be set up in the firewall?
>
> Anyone know why Strongswan seems to consider this the correct location for CA certs:
> Mar 23 10:40:35 cygnus.darkmatter.org charon-systemd[41093]: loading ca certificates from '/etc/strongswan/ipsec.d/cacerts'
> ... rather than:
> Mar 23 10:40:35 cygnus.darkmatter.org charon-systemd[41093]: loaded certificate 'C=US, O=Quantum, CN=quantum-equities.com CA'
> Mar 23 10:40:35 cygnus.darkmatter.org charon-systemd[41093]: 11[CFG] loaded certificate 'C=US, O=Quantum, CN=quantum-equities.com CA'
> Mar 23 10:40:36 cygnus.darkmatter.org swanctl[41112]: loaded certificate from '/etc/strongswan/swanctl/x509ca/aries-CAcert.pem'
>
> Anyone know why the phone is making four consecutive attempts, with no response from the daemon?
>
>
> Attached hereto: charon.log and iptables-save. SELinux is Permissive, and no firewall on the IPSec gateway. No change.
>
> -------------------------------------------------------------------------------------------------------_
>
> strongswan.conf:_
> charon {
> load_modular = yes
> plugins {
> include strongswan.d/charon/*.conf
> }
> }
> include strongswan.d/*.conf
>
> _charon.conf_
> charon {
>
>
> # two defined file loggers
> filelog {
> /var/log/charon.log {
> time_format = %a, %Y-%m-%d %R
> ike_name = yes
> append = no
> default = 2
> flush_line = yes
> }
> stderr {
> mgr = 0
> net = 1
> enc = 1
> asn = 1
> job = 1
> knl = 1
> }
> }
>
>
> _swanctl.conf:
> _connections {
> ikev2-pubkey {
> version = 2
> rekey_time = 0s
> local {
> id = quantum-equities.com
> id = cygnus.darkmatter.org
> }
> remote {
> # defaults are fine.
> }
> children {
> ikev2-pubkey {
> local_ts = %any
> remote_ts = %any
> mode = transport
> }
> }
> }
> }
>
>
>
> # swanctl -L
> ikev2-pubkey: IKEv2, no reauthentication, no rekeying
> local: %any
> remote: %any
> local unspecified authentication:
> id: cygnus.darkmatter.org
> remote unspecified authentication:
> ikev2-pubkey: TRANSPORT, rekeying every 3600s
> local: 0.0.0.0/32
> remote: 0.0.0.0/32
> # swanctl -l
> #
>
>
> # ip route show table all
> default via 192.168.1.1 dev eth0
> 169.254.0.0/16 dev eth0 scope link metric 1002
> 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.16
> broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
> local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
> local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
> broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
> broadcast 192.168.1.0 dev eth0 table local proto kernel scope link src 192.168.1.16
> local 192.168.1.16 dev eth0 table local proto kernel scope host src 192.168.1.16
> broadcast 192.168.1.255 dev eth0 table local proto kernel scope link src 192.168.1.16
> unreachable ::/96 dev lo metric 1024 error -113
> unreachable ::ffff:0.0.0.0/96 dev lo metric 1024 error -113
> unreachable 2002:a00::/24 dev lo metric 1024 error -113
> unreachable 2002:7f00::/24 dev lo metric 1024 error -113
> unreachable 2002:a9fe::/32 dev lo metric 1024 error -113
> unreachable 2002:ac10::/28 dev lo metric 1024 error -113
> unreachable 2002:c0a8::/32 dev lo metric 1024 error -113
> unreachable 2002:e000::/19 dev lo metric 1024 error -113
> unreachable 3ffe:ffff::/32 dev lo metric 1024 error -113
> fe80::/64 dev eth0 proto kernel metric 256
> fe80::/64 dev ipsec0 proto kernel metric 256
> local ::1 dev lo table local proto kernel metric 0
> local fe80::5054:ff:fec0:9330 dev lo table local proto kernel metric 0
> local fe80::8ad2:285b:b89d:44ea dev lo table local proto kernel metric 0
> ff00::/8 dev eth0 table local metric 256
> ff00::/8 dev ipsec0 table local metric 256
>
>
> # ip address
> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
> link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
> inet 127.0.0.1/8 scope host lo
> valid_lft forever preferred_lft forever
> inet6 ::1/128 scope host
> valid_lft forever preferred_lft forever
> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
> link/ether 52:54:00:c0:93:30 brd ff:ff:ff:ff:ff:ff
> inet 192.168.1.16/24 brd 192.168.1.255 scope global eth0
> valid_lft forever preferred_lft forever
> inet6 fe80::5054:ff:fec0:9330/64 scope link
> valid_lft forever preferred_lft forever
> 58: ipsec0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1400 qdisc pfifo_fast state UNKNOWN qlen 500
> link/none
> inet6 fe80::8ad2:285b:b89d:44ea/64 scope link flags 800
> valid_lft forever preferred_lft forever
>
>
>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.strongswan.org/pipermail/users/attachments/20180323/0fcad22c/attachment-0001.sig>
More information about the Users
mailing list