[strongSwan] No traffic through strong swan

Frank Uccello frank.uccello at borrowell.com
Thu Oct 25 15:36:26 CEST 2018


I am setup a site to site vpn to one my vendors they have Cisco ASA ios 9.x

They gave me a sample of config file but its not send any traffic to them

Here is what I have

config setup

conn vpn_tunnel
    compress=no
    type=tunnel
    authby=secret
    forceencaps=yes
    auto=start
    rekey=yes


        ikelifetime=28800s
        keylife=3600s
        rekeymargin=3m
        keyingtries=1
        keyexchange=ike
        authby=secret

# conn ciscoios
        left=192.168.x.x
        leftsubnet=192.168.x.x/32         #network behind strongswan
        leftid=23.xxx.xxx.175                #IKEID sent by strongswan
        leftfirewall=yes
        right=206.xxxx.xxx.134                 #IOS outside address
        rightsubnet=206.xxx.xxx.161/32        #network behind IOS
        rightid=206.xxx.xxx.134               #IKEID sent by IOS
        auto=add
        ike=aes256-sha1-modp1024
        esp=aes128-sha1                   #P2

What might I be missing here is the ipsec status 

Status of IKE charon daemon (strongSwan 5.6.2, Linux 4.15.0-1025-azure, x86_64):
  uptime: 2 minutes, since Oct 25 13:24:22 2018
  malloc: sbrk 1482752, mmap 0, used 465360, free 1017392
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0
  loaded plugins: charon aesni aes rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic counters
Listening IP addresses:
192.168.x.x
Connections:
  vpn_tunnel:  192.168.x.x...206.xxx.xxx.134  IKEv1/2
  vpn_tunnel:   local:  [23.xx.xxx.175] uses pre-shared key authentication
  vpn_tunnel:   remote: [206.xxx.xx.134] uses pre-shared key authentication
  vpn_tunnel:   child:  172.xxx.xxx.4/32 === 206.xxx.xxxx.161/32 TUNNEL
Security Associations (0 up, 0 connecting):
  None


And finally here my secrets  file
23.xxx.xxx.175  : PSK "MyBigSecert key"
206.xxx.xxxx.161 : PSK " MyBigSecert key "



Sent from Mail for Windows 10

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20181025/c65539af/attachment-0001.html>


More information about the Users mailing list