[strongSwan] StrongSwan w/ multiple local subnets.
TomK
tomkcpr at mdevsys.com
Mon Aug 17 04:16:28 CEST 2020
On 8/11/2020 1:16 AM, TomK wrote:
> On 8/9/2020 8:10 PM, TomK wrote:
>> On 6/30/2020 4:41 AM, Tobias Brunner wrote:
>>> Hi Tom,
>>>
>>>> What I meant to say, is that would confirm all proper kernel modules
>>>> were already in place to allow the communication would it not?
>>>> Anything
>>>> else I could try to, in the least, confirm if the packet was
>>>> successfully forwarded to the Azure VPN Gateway end?
>>>>
>>>> I know the packet arrives at the IPSec ipsec0 interface however,
>>>> checking just now, I don't see any traffic change on the WAN interface
>>>> of the on-prem StrongSwan VPN GW.
>>>
>>> As explained in previous emails, with kernel-libipsec you are not using
>>> any of the IPsec-related kernel modules. IPsec processing happens in
>>> userland via ipsec0 TUN device (see [1] for more on this plugin).
>>> rp_filter could be an issue when using it.
>>>
>>> To check traffic, use packet counters (strongSwan's status output,
>>> firewall etc.) or traffic captures on the respective hosts to see if
>>> e.g. ESP packets are exchanged.
>>>
>>> Regards,
>>> Tobias
>>>
>>> [1] https://wiki.strongswan.org/projects/strongswan/wiki/kernel-libipsec
>>>
>>
>>
>> Hey All,
>>
>> So I've given up on DD-WRT for the time being and decided instead to
>> use an old Raspberry PI 2 and OpenWRT.
>>
>> The topology I'll reference is available on the below OpenWRT forum.
>> For the sake of not replicating all the content (and partially due to
>> a touch of laziness), here is the link:
>>
>> Aug 9th post:
>>
>> https://forum.openwrt.org/t/openwrt-support-for-quagga-ospf-strongswan-ipsecv2-1-openvpn-firewalld-ssh-ddns-dnsmasquerade/69528/18
>>
>>
>> I'm effectively running into this error:
>>
>> Aug 9 17:04:06 OWRT01 : 14[IKE] initiating IKE_SA AZURE[1] to
>> 123.123.123.123
>> Aug 9 17:04:06 OWRT01 : 14[ENC] generating IKE_SA_INIT request 0 [ SA
>> KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
>> Aug 9 17:04:06 OWRT01 : 14[NET] sending packet: from
>> 100.100.100.100[500] to 123.123.123.123[500] (1188 bytes)
>> Aug 9 17:04:06 OWRT01 : 04[NET] error writing to socket: Network
>> unreachable
>> Aug 9 17:04:10 OWRT01 : 14[IKE] retransmit 1 of request with message
>> ID 0
>>
>>
>> This time, XFRM modules are loaded:
>>
>>
>> root at OWRT01:~# lsmod|grep xfrm
>> tunnel4 12288 2 sit,xfrm4_tunnel
>> tunnel6 12288 1 xfrm6_tunnel
>> xfrm_algo 12288 7
>> esp6,ah6,esp4,ah4,xfrm_user,xfrm_ipcomp,af_key
>> xfrm_ipcomp 12288 2 ipcomp6,ipcomp
>> xfrm_user 28672 0
>> xfrm4_mode_beet 12288 0
>> xfrm4_mode_transport 12288 0
>> xfrm4_mode_tunnel 12288 0
>> xfrm4_tunnel 12288 0
>> xfrm6_mode_beet 12288 0
>> xfrm6_mode_transport 12288 0
>> xfrm6_mode_tunnel 12288 0
>> xfrm6_tunnel 12288 1 ipcomp6
>> root at OWRT01:~#
>>
>>
>> However, from the OpenWRT post, you can see that packets arent' even
>> making it out of the ipsec0 interface, nor from the br-lan iterface.
>>
>>
>
>
> Made it past the above issue. Had to set:
>
>
> left=192.168.0.12
> type=passthrough
>
>
> since this is a device behind the main router. My bad!.
>
>
> Now I'm receiving a reply back:
>
>
> root at DD-WRT-INTERNET-ASUS:~# tcpdump -n | grep -Ei "123.123.123.123"
> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
> listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
> 21:42:10.410556 IP 192.168.0.12.500 > 123.123.123.123.500: isakmp:
> parent_sa ikev2_init[I]
> 21:42:10.414404 IP 123.123.123.123.500 > 192.168.0.12.500: isakmp:
> parent_sa ikev2_init[R]
>
>
> However the result is this error:
>
> received NO_PROPOSAL_CHOSEN notify error
>
> I've gone and searched the above error but nothing worked so far. Tried
> different settings for ike= and esp= but no luck either.
>
>
> Perhaps I'm missing something here a trained eye won't? Any help is
> appreciated.
>
>
> ---------------------------------------------------------
> Full session:
>
>
> Aug 11 00:41:57 OWRT01 : 00[DMN] signal of type SIGINT received.
> Shutting down
> Aug 11 00:42:00 OWRT01 : 00[DMN] Starting IKE charon daemon (strongSwan
> 5.8.2, Linux 4.14.180, armv7l)
> Aug 11 00:42:00 OWRT01 : 00[CFG] PKCS11 module '<name>' lacks library path
> Aug 11 00:42:01 OWRT01 : 00[LIB] curl SSL backend 'mbedTLS/2.16.6' not
> supported, https:// disabled
> Aug 11 00:42:01 OWRT01 : 00[CFG] disabling load-tester plugin, not
> configured
> Aug 11 00:42:01 OWRT01 : 00[LIB] plugin 'load-tester': failed to load -
> load_tester_plugin_create returned NULL
> Aug 11 00:42:01 OWRT01 : 00[LIB] created TUN device: ipsec0
> Aug 11 00:42:01 OWRT01 : 00[LIB] plugin 'uci' failed to load: Error
> relocating /usr/lib/ipsec/plugins/libstrongswan-uci.so: uci_lookup:
> symbol not found
> Aug 11 00:42:01 OWRT01 : 00[CFG] attr-sql plugin: database URI not set
> Aug 11 00:42:01 OWRT01 : 00[NET] using forecast interface br-lan
> Aug 11 00:42:01 OWRT01 : 00[CFG] joining forecast multicast groups:
> 224.0.0.1,224.0.0.22,224.0.0.251,224.0.0.252,239.255.255.250
> Aug 11 00:42:01 OWRT01 : 00[CFG] loading ca certificates from
> '/etc/ipsec.d/cacerts'
> Aug 11 00:42:01 OWRT01 : 00[CFG] loading aa certificates from
> '/etc/ipsec.d/aacerts'
> Aug 11 00:42:01 OWRT01 : 00[CFG] loading ocsp signer certificates from
> '/etc/ipsec.d/ocspcerts'
> Aug 11 00:42:01 OWRT01 : 00[CFG] loading attribute certificates from
> '/etc/ipsec.d/acerts'
> Aug 11 00:42:01 OWRT01 : 00[CFG] loading crls from '/etc/ipsec.d/crls'
> Aug 11 00:42:01 OWRT01 : 00[CFG] loading secrets from '/etc/ipsec.secrets'
> Aug 11 00:42:01 OWRT01 : 00[CFG] loaded IKE secret for 192.168.0.12
> 123.123.123.123
> Aug 11 00:42:01 OWRT01 : 00[CFG] sql plugin: database URI not set
> Aug 11 00:42:01 OWRT01 : 00[CFG] loaded 0 RADIUS server configurations
> Aug 11 00:42:01 OWRT01 : 00[CFG] HA config misses local/remote address
> Aug 11 00:42:01 OWRT01 : 00[CFG] coupling file path unspecified
> Aug 11 00:42:01 OWRT01 : 00[LIB] loaded plugins: charon test-vectors
> ldap pkcs11 aes des blowfish rc2 sha2 sha1 md4 md5 random nonce x509
> revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey
> pem openssl gcrypt af-alg fips-prf gmp gmpdh curve25519 agent xcbc cmac
> hmac ctr ccm gcm curl mysql sqlite attr kernel-libipsec kernel-netlink
> resolve socket-default socket-dynamic connmark forecast farp stroke vici
> smp updown eap-identity eap-md5 eap-mschapv2 eap-radius eap-tls
> xauth-generic xauth-eap dhcp whitelist led duplicheck addrblock unity
> Aug 11 00:42:01 OWRT01 : 00[JOB] spawning 16 worker threads
> Aug 11 00:42:01 OWRT01 : 13[CFG] received stroke: add connection 'AZURE'
> Aug 11 00:42:01 OWRT01 : 13[CFG] added configuration 'AZURE'
> Aug 11 00:42:01 OWRT01 : 15[CFG] received stroke: initiate 'AZURE'
> Aug 11 00:42:01 OWRT01 : 15[IKE] initiating IKE_SA AZURE[1] to
> 123.123.123.123
> Aug 11 00:42:01 OWRT01 : 15[ENC] generating IKE_SA_INIT request 0 [ SA
> KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
> Aug 11 00:42:01 OWRT01 : 15[NET] sending packet: from 192.168.0.12[500]
> to 123.123.123.123[500] (336 bytes)
> Aug 11 00:42:01 OWRT01 : 10[NET] received packet: from 192.168.0.6[500]
> to 192.168.0.12[500] (336 bytes)
> Aug 11 00:42:01 OWRT01 : 10[ENC] parsed IKE_SA_INIT request 0 [ SA KE No
> N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
> Aug 11 00:42:01 OWRT01 : 10[IKE] no IKE config found for
> 192.168.0.12...192.168.0.6, sending NO_PROPOSAL_CHOSEN
> Aug 11 00:42:01 OWRT01 : 10[ENC] generating IKE_SA_INIT response 0 [
> N(NO_PROP) ]
> Aug 11 00:42:01 OWRT01 : 10[NET] sending packet: from 192.168.0.12[500]
> to 192.168.0.6[500] (36 bytes)
> Aug 11 00:42:01 OWRT01 : 11[NET] received packet: from
> 123.123.123.123[500] to 192.168.0.12[500] (36 bytes)
> Aug 11 00:42:01 OWRT01 : 11[ENC] parsed IKE_SA_INIT response 0 [
> N(NO_PROP) ]
> Aug 11 00:42:01 OWRT01 : 11[IKE] received NO_PROPOSAL_CHOSEN notify error
>
>
>
>
>
>
> root at OWRT01:~# ipsec restart
> Stopping strongSwan IPsec...
> Starting strongSwan 5.8.2 IPsec [starter]...
> root at OWRT01:~# cat /etc/ipsec.conf
> # ipsec.conf - strongSwan IPsec configuration file
>
> # basic configuration
>
> config setup
> # strictcrlpolicy=yes
> # uniqueids = no
>
> conn AZURE
> authby=secret
> auto=start
> type=passthrough
> keyexchange=ikev2
> keylife=3600s
> ikelifetime=28800s
>
> left=192.168.0.12
> leftsubnet=0.0.0.0/0
> right=123.123.123.123
> rightsubnet=0.0.0.0/0
>
> ike=aes256-sha2_256-modp1024
> esp=aes256-sha2_256
>
> root at OWRT01:~#
>
>
>
>
>
> root at OWRT01:~# cat /etc/strongswan.conf
> # strongswan.conf - strongSwan configuration file
> #
> # Refer to the strongswan.conf(5) manpage for details
> #
> # Configuration changes should be made in the included files
> # Verbosity levels
> # -1: Absolutely silent
> # 0: Very basic auditing logs, (e.g. SA up/SA down)
> # 1: Generic control flow with errors, a good default to see whats going on
> # 2: More detailed debugging control flow
> # 3: Including RAW data dumps in Hex
> # 4: Also include sensitive material in dumps, e.g. keys
> charon {
> load_modular = yes
> plugins {
> include strongswan.d/charon/*.conf
> }
> filelog {
> charon {
> path = /var/log/charon.log
> time_format = %b %e %T
> append = no
> default = 0 # in case troubleshoot is required
> switch this to 2
> }
> stderr {
> ike = 0 # in case troubleshoot is required
> switch this to 2
> knl = 0 # in case troubleshoot is required
> switch this to 3
> ike_name = yes
> }
> }
> syslog {
> # enable logging to LOG_DAEMON, use defaults
> daemon {
> }
> # minimalistic IKE auditing logging to LOG_AUTHPRIV
> auth {
> default = 0 # in case troubleshoot is required
> switch this to 2
> ike = 0 # in case troubleshoot is required
> switch this to 2
> }
> }
> }
> include strongswan.d/*.conf
> root at OWRT01:~#
>
>
>
>
>
>
>
Given the below:
Azure VPN Gateway (123.123.123.123) -> DD-WRT (On Site PUB IP
100.100.100.100, Local Router IP 192.168.0.6: Port Forwarding 500, 4500
to Raspberry Pi 2) -> Raspberry Pi 2 OpenWRT (OWRT01, 192.168.0.12)
Am I correct in thinking that due to this statement in the logs:
Aug 16 01:00:06 OWRT01 : 11[ENC] parsed IKE_SA_INIT request 0 [ SA KE No
N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Aug 16 01:00:06 OWRT01 : 11[IKE] no IKE config found for
192.168.0.12...192.168.0.6, sending NO_PROPOSAL_CHOSEN
I now also need an ipsec policy between the DD-WRT router and the
OpenWRT Raspberry Pi 2? Thank you for taking a look.
My config and logs:
root at OWRT01:~# cat /etc/ipsec.conf
config setup
conn azure
authby=secret
auto=start
type=passthrough
left=192.168.0.12
leftsubnet=0.0.0.0/0
right=123.123.123.123
rightsubnet=0.0.0.0/0
ike=aes128gcm16-prfsha256-ecp256,aes256gcm16-prfsha384-ecp384
esp=aes128gcm16-ecp256,aes256gcm16-ecp384
root at OWRT01:~#
Aug 16 01:00:00 OWRT01 : 00[DMN] signal of type SIGINT received.
Shutting down
Aug 16 01:00:04 OWRT01 : 00[DMN] Starting IKE charon daemon (strongSwan
5.8.2, Linux 4.14.180, armv7l)
Aug 16 01:00:04 OWRT01 : 00[CFG] PKCS11 module '<name>' lacks library path
Aug 16 01:00:05 OWRT01 : 00[LIB] curl SSL backend 'mbedTLS/2.16.6' not
supported, https:// disabled
Aug 16 01:00:05 OWRT01 : 00[CFG] disabling load-tester plugin, not
configured
Aug 16 01:00:05 OWRT01 : 00[LIB] plugin 'load-tester': failed to load -
load_tester_plugin_create returned NULL
Aug 16 01:00:05 OWRT01 : 00[LIB] created TUN device: ipsec0
Aug 16 01:00:05 OWRT01 : 00[LIB] plugin 'uci' failed to load: Error
relocating /usr/lib/ipsec/plugins/libstrongswan-uci.so: uci_lookup:
symbol not found
Aug 16 01:00:05 OWRT01 : 00[CFG] attr-sql plugin: database URI not set
Aug 16 01:00:05 OWRT01 : 00[NET] using forecast interface br-lan
Aug 16 01:00:05 OWRT01 : 00[CFG] joining forecast multicast groups:
224.0.0.1,224.0.0.22,224.0.0.251,224.0.0.252,239.255.255.250
Aug 16 01:00:05 OWRT01 : 00[CFG] loading ca certificates from
'/etc/ipsec.d/cacerts'
Aug 16 01:00:05 OWRT01 : 00[CFG] loading aa certificates from
'/etc/ipsec.d/aacerts'
Aug 16 01:00:05 OWRT01 : 00[CFG] loading ocsp signer certificates from
'/etc/ipsec.d/ocspcerts'
Aug 16 01:00:05 OWRT01 : 00[CFG] loading attribute certificates from
'/etc/ipsec.d/acerts'
Aug 16 01:00:05 OWRT01 : 00[CFG] loading crls from '/etc/ipsec.d/crls'
Aug 16 01:00:05 OWRT01 : 00[CFG] loading secrets from '/etc/ipsec.secrets'
Aug 16 01:00:05 OWRT01 : 00[CFG] loaded IKE secret for 192.168.0.12
123.123.123.123
Aug 16 01:00:05 OWRT01 : 00[CFG] sql plugin: database URI not set
Aug 16 01:00:05 OWRT01 : 00[CFG] loaded 0 RADIUS server configurations
Aug 16 01:00:05 OWRT01 : 00[CFG] HA config misses local/remote address
Aug 16 01:00:05 OWRT01 : 00[CFG] coupling file path unspecified
Aug 16 01:00:05 OWRT01 : 00[LIB] loaded plugins: charon test-vectors
ldap pkcs11 aes des blowfish rc2 sha2 sha1 md4 md5 random nonce x509
revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey
pem openssl gcrypt af-alg fips-prf gmp gmpdh curve25519 agent xcbc cmac
hmac ctr ccm gcm curl mysql sqlite attr kernel-libipsec kernel-netlink
resolve socket-default socket-dynamic connmark forecast farp stroke vici
smp updown eap-identity eap-md5 eap-mschapv2 eap-radius eap-tls
xauth-generic xauth-eap dhcp whitelist led duplicheck addrblock unity
Aug 16 01:00:05 OWRT01 : 00[JOB] spawning 16 worker threads
Aug 16 01:00:05 OWRT01 : 09[CFG] received stroke: add connection 'azure'
Aug 16 01:00:05 OWRT01 : 09[CFG] added configuration 'azure'
Aug 16 01:00:05 OWRT01 : 12[CFG] received stroke: initiate 'azure'
Aug 16 01:00:05 OWRT01 : 12[IKE] initiating IKE_SA azure[1] to
123.123.123.123
Aug 16 01:00:05 OWRT01 : 12[ENC] generating IKE_SA_INIT request 0 [ SA
KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Aug 16 01:00:05 OWRT01 : 12[NET] sending packet: from 192.168.0.12[500]
to 123.123.123.123[500] (1152 bytes)
Aug 16 01:00:05 OWRT01 : 11[NET] received packet: from 192.168.0.6[26]
to 192.168.0.12[500] (1152 bytes)
Aug 16 01:00:06 OWRT01 : 11[ENC] parsed IKE_SA_INIT request 0 [ SA KE No
N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Aug 16 01:00:06 OWRT01 : 11[IKE] no IKE config found for
192.168.0.12...192.168.0.6, sending NO_PROPOSAL_CHOSEN
Aug 16 01:00:06 OWRT01 : 11[ENC] generating IKE_SA_INIT response 0 [
N(NO_PROP) ]
Aug 16 01:00:06 OWRT01 : 11[NET] sending packet: from 192.168.0.12[500]
to 192.168.0.6[26] (36 bytes)
Aug 16 01:00:06 OWRT01 : 14[NET] received packet: from
123.123.123.123[500] to 192.168.0.12[500] (36 bytes)
Aug 16 01:00:06 OWRT01 : 14[ENC] parsed IKE_SA_INIT response 0 [
N(NO_PROP) ]
Aug 16 01:00:06 OWRT01 : 14[IKE] received NO_PROPOSAL_CHOSEN notify error
Aug 16 01:00:06 OWRT01 : 03[NET] received packet: from 192.168.0.6[500]
to 192.168.0.12[500] (620 bytes)
Aug 16 01:00:06 OWRT01 : 03[ENC] parsed IKE_SA_INIT request 0 [ SA KE No
N(NATD_S_IP) N(NATD_D_IP) V V V V ]
Aug 16 01:00:06 OWRT01 : 03[IKE] no IKE config found for
192.168.0.12...192.168.0.6, sending NO_PROPOSAL_CHOSEN
Aug 16 01:00:06 OWRT01 : 03[ENC] generating IKE_SA_INIT response 0 [
N(NO_PROP) ]
Aug 16 01:00:06 OWRT01 : 03[NET] sending packet: from 192.168.0.12[500]
to 192.168.0.6[500] (36 bytes)
Aug 16 01:00:05 11[ENC] parsing rule 0 U_INT_8
Aug 16 01:00:05 11[ENC] parsing rule 1 RESERVED_BYTE
Aug 16 01:00:05 11[ENC] parsing rule 2 PAYLOAD_LENGTH
Aug 16 01:00:05 11[ENC] parsing rule 3 U_INT_8
Aug 16 01:00:05 11[ENC] parsing rule 4 RESERVED_BYTE
Aug 16 01:00:05 11[ENC] parsing rule 5 U_INT_16
Aug 16 01:00:05 11[ENC] parsing rule 6 (1262)
Aug 16 01:00:05 11[ENC] 4 bytes left, parsing recursively
TRANSFORM_ATTRIBUTE
Aug 16 01:00:05 11[ENC] parsing TRANSFORM_ATTRIBUTE payload, 388 bytes left
Aug 16 01:00:05 11[ENC] parsing rule 0 ATTRIBUTE_FORMAT
Aug 16 01:00:05 11[ENC] parsing rule 1 ATTRIBUTE_TYPE
Aug 16 01:00:05 11[ENC] parsing rule 2 ATTRIBUTE_LENGTH_OR_VALUE
Aug 16 01:00:05 11[ENC] parsing rule 3 ATTRIBUTE_VALUE
Aug 16 01:00:05 11[ENC] parsing TRANSFORM_ATTRIBUTE payload finished
Aug 16 01:00:05 11[ENC] parsing TRANSFORM_SUBSTRUCTURE payload finished
Aug 16 01:00:05 11[ENC] 152 bytes left, parsing recursively
TRANSFORM_SUBSTRUCTURE
Aug 16 01:00:05 11[ENC] parsing TRANSFORM_SUBSTRUCTURE payload, 384
bytes left
Aug 16 01:00:05 11[ENC] parsing rule 0 U_INT_8
Aug 16 01:00:05 11[ENC] parsing rule 1 RESERVED_BYTE
Aug 16 01:00:05 11[ENC] parsing rule 2 PAYLOAD_LENGTH
Aug 16 01:00:05 11[ENC] parsing rule 3 U_INT_8
Aug 16 01:00:05 11[ENC] parsing rule 4 RESERVED_BYTE
Aug 16 01:00:05 11[ENC] parsing rule 5 U_INT_16
Aug 16 01:00:05 11[ENC] parsing rule 6 (1262)
Aug 16 01:00:05 11[ENC] parsing TRANSFORM_SUBSTRUCTURE payload finished
Aug 16 01:00:05 11[ENC] 144 bytes left, parsing recursively
TRANSFORM_SUBSTRUCTURE
.
.
.
.
.
.
.
.
Aug 16 01:00:06 11[ENC] parsing NOTIFY payload finished
Aug 16 01:00:06 11[ENC] verifying payload of type NOTIFY
Aug 16 01:00:06 11[ENC] NOTIFY payload verified, adding to payload list
Aug 16 01:00:06 11[ENC] starting parsing a NOTIFY payload
Aug 16 01:00:06 11[ENC] parsing NOTIFY payload, 8 bytes left
Aug 16 01:00:06 11[ENC] parsing rule 0 U_INT_8
Aug 16 01:00:06 11[ENC] parsing rule 1 FLAG
Aug 16 01:00:06 11[ENC] parsing rule 2 RESERVED_BIT
Aug 16 01:00:06 11[ENC] parsing rule 3 RESERVED_BIT
Aug 16 01:00:06 11[ENC] parsing rule 4 RESERVED_BIT
Aug 16 01:00:06 11[ENC] parsing rule 5 RESERVED_BIT
Aug 16 01:00:06 11[ENC] parsing rule 6 RESERVED_BIT
Aug 16 01:00:06 11[ENC] parsing rule 7 RESERVED_BIT
Aug 16 01:00:06 11[ENC] parsing rule 8 RESERVED_BIT
Aug 16 01:00:06 11[ENC] parsing rule 9 PAYLOAD_LENGTH
Aug 16 01:00:06 11[ENC] parsing rule 10 U_INT_8
Aug 16 01:00:06 11[ENC] parsing rule 11 SPI_SIZE
Aug 16 01:00:06 11[ENC] parsing rule 12 U_INT_16
Aug 16 01:00:06 11[ENC] parsing rule 13 SPI
Aug 16 01:00:06 11[ENC] parsing rule 14 CHUNK_DATA
Aug 16 01:00:06 11[ENC] parsing NOTIFY payload finished
Aug 16 01:00:06 11[ENC] verifying payload of type NOTIFY
Aug 16 01:00:06 11[ENC] NOTIFY payload verified, adding to payload list
Aug 16 01:00:06 11[ENC] process payload of type SECURITY_ASSOCIATION
Aug 16 01:00:06 11[ENC] process payload of type KEY_EXCHANGE
Aug 16 01:00:06 11[ENC] process payload of type NONCE
Aug 16 01:00:06 11[ENC] process payload of type NOTIFY
Aug 16 01:00:06 11[ENC] process payload of type NOTIFY
Aug 16 01:00:06 11[ENC] process payload of type NOTIFY
Aug 16 01:00:06 11[ENC] process payload of type NOTIFY
Aug 16 01:00:06 11[ENC] process payload of type NOTIFY
Aug 16 01:00:06 11[ENC] verifying message structure
Aug 16 01:00:06 11[ENC] found payload of type NOTIFY
Aug 16 01:00:06 11[ENC] found payload of type NOTIFY
Aug 16 01:00:06 11[ENC] found payload of type NOTIFY
Aug 16 01:00:06 11[ENC] found payload of type NOTIFY
Aug 16 01:00:06 11[ENC] found payload of type NOTIFY
Aug 16 01:00:06 11[ENC] found payload of type SECURITY_ASSOCIATION
Aug 16 01:00:06 11[ENC] found payload of type KEY_EXCHANGE
Aug 16 01:00:06 11[ENC] found payload of type NONCE
Aug 16 01:00:06 11[ENC] parsed IKE_SA_INIT request 0 [ SA KE No
N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Aug 16 01:00:06 11[CFG] looking for an IKEv2 config for
192.168.0.12...192.168.0.6
Aug 16 01:00:06 11[IKE] no IKE config found for
192.168.0.12...192.168.0.6, sending NO_PROPOSAL_CHOSEN
Aug 16 01:00:06 11[ENC] added payload of type NOTIFY to message
Aug 16 01:00:06 11[ENC] order payloads in message
Aug 16 01:00:06 11[ENC] added payload of type NOTIFY to message
Aug 16 01:00:06 11[ENC] generating IKE_SA_INIT response 0 [ N(NO_PROP) ]
Aug 16 01:00:06 11[ENC] not encrypting payloads
Aug 16 01:00:06 11[ENC] generating payload of type HEADER
Aug 16 01:00:06 11[ENC] generating rule 0 IKE_SPI
Aug 16 01:00:06 11[ENC] generating rule 1 IKE_SPI
Aug 16 01:00:06 11[ENC] generating rule 2 U_INT_8
Aug 16 01:00:06 11[ENC] generating rule 3 U_INT_4
Aug 16 01:00:06 11[ENC] generating rule 4 U_INT_4
Aug 16 01:00:06 11[ENC] generating rule 5 U_INT_8
Aug 16 01:00:06 11[ENC] generating rule 6 RESERVED_BIT
Aug 16 01:00:06 11[ENC] generating rule 7 RESERVED_BIT
Aug 16 01:00:06 11[ENC] generating rule 8 FLAG
Aug 16 01:00:06 11[ENC] generating rule 9 FLAG
Aug 16 01:00:06 11[ENC] generating rule 10 FLAG
Aug 16 01:00:06 11[ENC] generating rule 11 FLAG
Aug 16 01:00:06 11[ENC] generating rule 12 FLAG
Aug 16 01:00:06 11[ENC] generating rule 13 FLAG
Aug 16 01:00:06 11[ENC] generating rule 14 U_INT_32
Aug 16 01:00:06 11[ENC] generating rule 15 HEADER_LENGTH
Aug 16 01:00:06 11[ENC] generating HEADER payload finished
Aug 16 01:00:06 11[ENC] generating payload of type NOTIFY
Aug 16 01:00:06 11[ENC] generating rule 0 U_INT_8
Aug 16 01:00:06 11[ENC] generating rule 1 FLAG
Aug 16 01:00:06 11[ENC] generating rule 2 RESERVED_BIT
Aug 16 01:00:06 11[ENC] generating rule 3 RESERVED_BIT
Aug 16 01:00:06 11[ENC] generating rule 4 RESERVED_BIT
Aug 16 01:00:06 11[ENC] generating rule 5 RESERVED_BIT
Aug 16 01:00:06 11[ENC] generating rule 6 RESERVED_BIT
Aug 16 01:00:06 11[ENC] generating rule 7 RESERVED_BIT
Aug 16 01:00:06 11[ENC] generating rule 8 RESERVED_BIT
Aug 16 01:00:06 11[ENC] generating rule 9 PAYLOAD_LENGTH
Aug 16 01:00:06 11[ENC] generating rule 10 U_INT_8
Aug 16 01:00:06 11[ENC] generating rule 11 SPI_SIZE
Aug 16 01:00:06 11[ENC] generating rule 12 U_INT_16
Aug 16 01:00:06 11[ENC] generating rule 13 SPI
Aug 16 01:00:06 11[ENC] generating rule 14 CHUNK_DATA
Aug 16 01:00:06 11[ENC] generating NOTIFY payload finished
Aug 16 01:00:06 11[NET] sending packet: from 192.168.0.12[500] to
192.168.0.6[26] (36 bytes)
Aug 16 01:00:06 11[MGR] checkin and destroy IKE_SA (unnamed)[2]
Aug 16 01:00:06 16[NET] sending packet: from 192.168.0.12[500] to
192.168.0.6[26]
Aug 16 01:00:06 11[IKE] IKE_SA (unnamed)[2] state change: CREATED =>
DESTROYING
Aug 16 01:00:06 11[MGR] checkin and destroy of IKE_SA successful
Aug 16 01:00:06 04[NET] received packet: from 123.123.123.123[500] to
192.168.0.12[500]
Aug 16 01:00:06 04[ENC] parsing header of message
Aug 16 01:00:06 04[ENC] parsing HEADER payload, 36 bytes left
Aug 16 01:00:06 04[ENC] parsing rule 0 IKE_SPI
Aug 16 01:00:06 04[ENC] parsing rule 1 IKE_SPI
Aug 16 01:00:06 04[ENC] parsing rule 2 U_INT_8
Aug 16 01:00:06 04[ENC] parsing rule 3 U_INT_4
Aug 16 01:00:06 04[ENC] parsing rule 4 U_INT_4
Aug 16 01:00:06 04[ENC] parsing rule 5 U_INT_8
Aug 16 01:00:06 04[ENC] parsing rule 6 RESERVED_BIT
Aug 16 01:00:06 04[ENC] parsing rule 7 RESERVED_BIT
Aug 16 01:00:06 04[ENC] parsing rule 8 FLAG
Aug 16 01:00:06 04[ENC] parsing rule 9 FLAG
Aug 16 01:00:06 04[ENC] parsing rule 10 FLAG
Aug 16 01:00:06 04[ENC] parsing rule 11 FLAG
Aug 16 01:00:06 04[ENC] parsing rule 12 FLAG
Aug 16 01:00:06 04[ENC] parsing rule 13 FLAG
Aug 16 01:00:06 04[ENC] parsing rule 14 U_INT_32
Aug 16 01:00:06 04[ENC] parsing rule 15 HEADER_LENGTH
Aug 16 01:00:06 04[ENC] parsing HEADER payload finished
Aug 16 01:00:06 04[ENC] parsed a IKE_SA_INIT response header
Aug 16 01:00:06 04[NET] waiting for data on sockets
Aug 16 01:00:06 14[MGR] checkout IKEv2 SA by message with SPIs
5d4dbd5514ee8ae1_i 7e6ea225251f2a77_r
Aug 16 01:00:06 14[MGR] IKE_SA azure[1] successfully checked out
Aug 16 01:00:06 14[NET] received packet: from 123.123.123.123[500] to
192.168.0.12[500] (36 bytes)
Aug 16 01:00:06 14[ENC] parsing body of message, first payload is NOTIFY
Aug 16 01:00:06 14[ENC] starting parsing a NOTIFY payload
Aug 16 01:00:06 14[ENC] parsing NOTIFY payload, 8 bytes left
Aug 16 01:00:06 14[ENC] parsing rule 0 U_INT_8
Aug 16 01:00:06 14[ENC] parsing rule 1 FLAG
Aug 16 01:00:06 14[ENC] parsing rule 2 RESERVED_BIT
Aug 16 01:00:06 14[ENC] parsing rule 3 RESERVED_BIT
Aug 16 01:00:06 14[ENC] parsing rule 4 RESERVED_BIT
Aug 16 01:00:06 14[ENC] parsing rule 5 RESERVED_BIT
Aug 16 01:00:06 14[ENC] parsing rule 6 RESERVED_BIT
Aug 16 01:00:06 14[ENC] parsing rule 7 RESERVED_BIT
Aug 16 01:00:06 14[ENC] parsing rule 8 RESERVED_BIT
Aug 16 01:00:06 14[ENC] parsing rule 9 PAYLOAD_LENGTH
Aug 16 01:00:06 14[ENC] parsing rule 10 U_INT_8
Aug 16 01:00:06 14[ENC] parsing rule 11 SPI_SIZE
Aug 16 01:00:06 14[ENC] parsing rule 12 U_INT_16
Aug 16 01:00:06 14[ENC] parsing rule 13 SPI
Aug 16 01:00:06 14[ENC] parsing rule 14 CHUNK_DATA
Aug 16 01:00:06 14[ENC] parsing NOTIFY payload finished
Aug 16 01:00:06 14[ENC] verifying payload of type NOTIFY
Aug 16 01:00:06 14[ENC] NOTIFY payload verified, adding to payload list
Aug 16 01:00:06 14[ENC] process payload of type NOTIFY
Aug 16 01:00:06 14[ENC] verifying message structure
Aug 16 01:00:06 14[ENC] found payload of type NOTIFY
Aug 16 01:00:06 14[ENC] parsed IKE_SA_INIT response 0 [ N(NO_PROP) ]
Aug 16 01:00:06 14[IKE] received NO_PROPOSAL_CHOSEN notify error
Aug 16 01:00:06 14[CFG] configured proposals:
IKE:AES_GCM_16_128/PRF_HMAC_SHA2_256/ECP_256,
IKE:AES_GCM_16_256/PRF_HMAC_SHA2_384/ECP_384,
IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/AES_CTR_128/AES_CTR_192/AES_CTR_256/CAMELLIA_CTR_128/CAMELLIA_CTR_192/CAMELLIA_CTR_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/HMAC_SHA1_96/AES_XCBC_96/AES_CMAC_96/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/CURVE_448/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048,
IKE:AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/CHACHA20_POLY1305/AES_CCM_16_128/AES_CCM_16_192/AES_CCM_16_256/CAMELLIA_CCM_16_128/CAMELLIA_CCM_16_192/CAMELLIA_CCM_16_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_CCM_8_128/AES_CCM_8_192/AES_CCM_8_256/AES_CCM_12_128/AES_CCM_12_192/AES_CCM_12_256/CAMELLIA_CCM_8_128/CAMELLIA_CCM_8_192/CAMELLIA_CCM_8_256/CAMELLIA_CCM_12_128/CAMELLIA_CCM_12_192/CAMELLIA_CCM_12_256/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/CURVE_448/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048
Aug 16 01:00:06 14[MGR] checkin and destroy IKE_SA azure[1]
Aug 16 01:00:06 14[IKE] IKE_SA azure[1] state change: CONNECTING =>
DESTROYING
Aug 16 01:00:06 14[MGR] checkin and destroy of IKE_SA successful
Aug 16 01:00:06 08[ESP] no matching outbound IPsec policy for
fe80::f44e:e17a:fbc2:3cc3 == ff02::16 [58]
Aug 16 01:00:06 04[NET] received packet: from 192.168.0.6[500] to
192.168.0.12[500]
Aug 16 01:00:06 04[ENC] parsing header of message
Aug 16 01:00:06 04[ENC] parsing HEADER payload, 620 bytes left
Aug 16 01:00:06 04[ENC] parsing rule 0 IKE_SPI
Aug 16 01:00:06 04[ENC] parsing rule 1 IKE_SPI
Aug 16 01:00:06 04[ENC] parsing rule 2 U_INT_8
Aug 16 01:00:06 04[ENC] parsing rule 3 U_INT_4
Aug 16 01:00:06 04[ENC] parsing rule 4 U_INT_4
Aug 16 01:00:06 04[ENC] parsing rule 5 U_INT_8
Aug 16 01:00:06 04[ENC] parsing rule 6 RESERVED_BIT
Aug 16 01:00:06 04[ENC] parsing rule 7 RESERVED_BIT
Aug 16 01:00:06 04[ENC] parsing rule 8 FLAG
Aug 16 01:00:06 04[ENC] parsing rule 9 FLAG
Aug 16 01:00:06 04[ENC] parsing rule 10 FLAG
Aug 16 01:00:06 04[ENC] parsing rule 11 FLAG
Aug 16 01:00:06 04[ENC] parsing rule 12 FLAG
Aug 16 01:00:06 04[ENC] parsing rule 13 FLAG
Aug 16 01:00:06 04[ENC] parsing rule 14 U_INT_32
Aug 16 01:00:06 04[ENC] parsing rule 15 HEADER_LENGTH
Aug 16 01:00:06 04[ENC] parsing HEADER payload finished
Aug 16 01:00:06 04[ENC] parsed a IKE_SA_INIT request header
Aug 16 01:00:06 03[MGR] checkout IKEv2 SA by message with SPIs
31219711e858bab2_i 0000000000000000_r
Aug 16 01:00:06 03[MGR] created IKE_SA (unnamed)[3]
Aug 16 01:00:06 03[NET] received packet: from 192.168.0.6[500] to
192.168.0.12[500] (620 bytes)
Aug 16 01:00:06 03[ENC] parsing body of message, first payload is
SECURITY_ASSOCIATION
Aug 16 01:00:06 03[ENC] starting parsing a SECURITY_ASSOCIATION payload
Aug 16 01:00:06 03[ENC] parsing SECURITY_ASSOCIATION payload, 592 bytes left
.
.
.
.
.
.
.
Aug 16 01:02:06 06[ENC] generating rule 12 U_INT_16
Aug 16 01:02:06 06[ENC] generating rule 13 SPI
Aug 16 01:02:06 06[ENC] generating rule 14 CHUNK_DATA
Aug 16 01:02:06 06[ENC] generating NOTIFY payload finished
Aug 16 01:02:06 06[NET] sending packet: from 192.168.0.12[500] to
192.168.0.6[500] (36 bytes)
Aug 16 01:02:06 16[NET] sending packet: from 192.168.0.12[500] to
192.168.0.6[500]
Aug 16 01:02:06 06[MGR] checkin and destroy IKE_SA (unnamed)[4]
Aug 16 01:02:06 06[IKE] IKE_SA (unnamed)[4] state change: CREATED =>
DESTROYING
Aug 16 01:02:06 06[MGR] checkin and destroy of IKE_SA successful
On the Azure side:
--
Thx,
TK.
More information about the Users
mailing list