[strongSwan] Site-to-site VPN configuration help

[Dafydd Tomos]

On 25/03/2020 14:50, Noel Kuntze wrote:
>> server-to-aws:  10.100.15.1...y.y.y.y  IKEv1, dpddelay=15s
>>   I ended up adding an interface for 10.100.15.1 as that what appears to be required.
> The conn is configured for x.x.x.x, not 10.100.15.1. strongSwan doesn't need such an address.
> Set left=x.x.x.x.
>
Ah thanks. That's what I did originally in fact. The log now shows it 
looping around those proposing traffic selectors. Before this change it 
was trying to connect. Now it says 0 connecting.

Status of IKE charon daemon (strongSwan 5.5.1, Linux 4.9.0-11-amd64, 
x86_64):
   uptime: 5 seconds, since Mar 25 15:07:42 2020
   malloc: sbrk 2297856, mmap 0, used 418656, free 1879200
   worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, 
scheduled: 0
   loaded plugins: charon aesni aes rc2 sha2 sha1 md5 random nonce x509 
revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 p
gp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr 
kernel-netlink resolve socket-default connmark stroke updown
Listening IP addresses:
   x.x.x.x
   10.100.15.1
Connections:
server-to-aws:  x.x.x.x...y.y.y.y  IKEv1, dpddelay=15s
server-to-aws:   local:  [server] uses pre-shared key authentication
server-to-aws:   remote: [aws] uses pre-shared key authentication
server-to-aws:   child:  10.100.15.0/24 === 172.21.0.0/16 172.22.0.0/16 
TUNNEL, dpdaction=restart
Security Associations (0 up, 0 connecting):
   none


Wed, 2020-03-25 15:08 13[IKE] <3> y.y.y.y is initiating a Main Mode IKE_SA
Wed, 2020-03-25 15:08 13[IKE] <3> IKE_SA (unnamed)[3] state change: 
CREATED => CONNECTING
Wed, 2020-03-25 15:08 13[CFG] <3> selecting proposal:
Wed, 2020-03-25 15:08 13[CFG] <3>   proposal matches
Wed, 2020-03-25 15:08 13[CFG] <3> received proposals: 
IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536
Wed, 2020-03-25 15:08 13[CFG] <3> configured proposals: 
IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536, IKE:AES_
CBC_128/AES_CBC_192/AES_CBC_256/AES_CTR_128/AES_CTR_192/AES_CTR_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/3DES_CBC
/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/HMAC_MD5_96/HMAC_SHA1_96/PRF_AES128_XCBC/PRF_AES
128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_MD5/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_8192/MODP_2048/MODP_2048_256/MODP_1024, 
IKE:AES_CCM_16_128/AES_CCM_16_192/AES_CCM_16_256/AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/AES_CCM_8_128/AES_CCM_8_192/AES_CCM_8_256/AES_CCM_12_128/AES_CCM_12_192/AES_CCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_MD5/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_8192/MODP_2048/MODP_2048_256/MODP_1024
Wed, 2020-03-25 15:08 13[CFG] <3> selected proposal: 
IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536
Wed, 2020-03-25 15:08 13[IKE] <3> sending XAuth vendor ID
Wed, 2020-03-25 15:08 13[IKE] <3> sending DPD vendor ID
Wed, 2020-03-25 15:08 13[IKE] <3> sending FRAGMENTATION vendor ID
Wed, 2020-03-25 15:08 13[IKE] <3> sending NAT-T (RFC 3947) vendor ID
Wed, 2020-03-25 15:08 13[ENC] <3> generating ID_PROT response 0 [ SA V V 
V V ]
Wed, 2020-03-25 15:08 13[NET] <3> sending packet: from x.x.x.x[500] to 
y.y.y.y[500] (164 bytes)
Wed, 2020-03-25 15:08 10[NET] <3> received packet: from y.y.y.y[500] to 
x.x.x.x[500] (316 bytes)
Wed, 2020-03-25 15:08 10[ENC] <3> parsed ID_PROT request 0 [ KE No NAT-D 
NAT-D ]
Wed, 2020-03-25 15:08 10[LIB] <3> size of DH secret exponent: 1535 bits
Wed, 2020-03-25 15:08 10[IKE] <3> remote host is behind NAT
Wed, 2020-03-25 15:08 10[ENC] <3> generating ID_PROT response 0 [ KE No 
NAT-D NAT-D ]
Wed, 2020-03-25 15:08 10[NET] <3> sending packet: from x.x.x.x[500] to 
y.y.y.y[500] (332 bytes)
Wed, 2020-03-25 15:08 14[NET] <3> received packet: from y.y.y.y[4500] to 
x.x.x.x[4500] (108 bytes)
Wed, 2020-03-25 15:08 14[ENC] <3> parsed ID_PROT request 0 [ ID HASH 
N(INITIAL_CONTACT) ]
Wed, 2020-03-25 15:08 14[CFG] <3> looking for pre-shared key peer 
configs matching x.x.x.x...y.y.y.y[172.20.0.10]
Wed, 2020-03-25 15:08 14[IKE] <3> no peer config found
Wed, 2020-03-25 15:08 14[IKE] <3> queueing INFORMATIONAL task
Wed, 2020-03-25 15:08 14[IKE] <3> activating new tasks
Wed, 2020-03-25 15:08 14[IKE] <3>   activating INFORMATIONAL task
Wed, 2020-03-25 15:08 14[ENC] <3> generating INFORMATIONAL_V1 request 
266312254 [ HASH N(AUTH_FAILED) ]
Wed, 2020-03-25 15:08 14[NET] <3> sending packet: from x.x.x.x[4500] to 
y.y.y.y[4500] (108 bytes)
Wed, 2020-03-25 15:08 14[IKE] <3> IKE_SA (unnamed)[3] state change: 
CONNECTING => DESTROYING
Wed, 2020-03-25 15:08 03[CFG] proposing traffic selectors for us:
Wed, 2020-03-25 15:08 03[CFG]  10.100.15.0/24
Wed, 2020-03-25 15:08 03[CFG] proposing traffic selectors for other:
Wed, 2020-03-25 15:08 03[CFG]  172.21.0.0/16
Wed, 2020-03-25 15:08 03[CFG]  172.22.0.0/16