[strongSwan] Site-to-site VPN configuration help

[Noel Kuntze]

> Wed, 2020-03-25 15:08 14[CFG] <3> looking for pre-shared key peer configs matching x.x.x.x...y.y.y.y[172.20.0.10]
> Wed, 2020-03-25 15:08 14[IKE] <3> no peer config found 

>         rightid=aws 

Wrong id. The remote peer sends 172.20.0.10 as its own id, not 'aws'.

Am 25.03.20 um 16:13 schrieb Dafydd Tomos:
> On 25/03/2020 14:50, Noel Kuntze wrote:
>>> server-to-aws:  10.100.15.1...y.y.y.y  IKEv1, dpddelay=15s
>>>   I ended up adding an interface for 10.100.15.1 as that what appears to be required.
>> The conn is configured for x.x.x.x, not 10.100.15.1. strongSwan doesn't need such an address.
>> Set left=x.x.x.x.
>>
> Ah thanks. That's what I did originally in fact. The log now shows it looping around those proposing traffic selectors. Before this change it was trying to connect. Now it says 0 connecting.
> 
> Status of IKE charon daemon (strongSwan 5.5.1, Linux 4.9.0-11-amd64, x86_64):
>   uptime: 5 seconds, since Mar 25 15:07:42 2020
>   malloc: sbrk 2297856, mmap 0, used 418656, free 1879200
>   worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0
>   loaded plugins: charon aesni aes rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 p
> gp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown
> Listening IP addresses:
>   x.x.x.x
>   10.100.15.1
> Connections:
> server-to-aws:  x.x.x.x...y.y.y.y  IKEv1, dpddelay=15s
> server-to-aws:   local:  [server] uses pre-shared key authentication
> server-to-aws:   remote: [aws] uses pre-shared key authentication
> server-to-aws:   child:  10.100.15.0/24 === 172.21.0.0/16 172.22.0.0/16 TUNNEL, dpdaction=restart
> Security Associations (0 up, 0 connecting):
>   none
> 
> 
> Wed, 2020-03-25 15:08 13[IKE] <3> y.y.y.y is initiating a Main Mode IKE_SA
> Wed, 2020-03-25 15:08 13[IKE] <3> IKE_SA (unnamed)[3] state change: CREATED => CONNECTING
> Wed, 2020-03-25 15:08 13[CFG] <3> selecting proposal:
> Wed, 2020-03-25 15:08 13[CFG] <3>   proposal matches
> Wed, 2020-03-25 15:08 13[CFG] <3> received proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536
> Wed, 2020-03-25 15:08 13[CFG] <3> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536, IKE:AES_
> CBC_128/AES_CBC_192/AES_CBC_256/AES_CTR_128/AES_CTR_192/AES_CTR_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/3DES_CBC
> /HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/HMAC_MD5_96/HMAC_SHA1_96/PRF_AES128_XCBC/PRF_AES
> 128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_MD5/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_8192/MODP_2048/MODP_2048_256/MODP_1024, IKE:AES_CCM_16_128/AES_CCM_16_192/AES_CCM_16_256/AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/AES_CCM_8_128/AES_CCM_8_192/AES_CCM_8_256/AES_CCM_12_128/AES_CCM_12_192/AES_CCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_MD5/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_8192/MODP_2048/MODP_2048_256/MODP_1024
> Wed, 2020-03-25 15:08 13[CFG] <3> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536
> Wed, 2020-03-25 15:08 13[IKE] <3> sending XAuth vendor ID
> Wed, 2020-03-25 15:08 13[IKE] <3> sending DPD vendor ID
> Wed, 2020-03-25 15:08 13[IKE] <3> sending FRAGMENTATION vendor ID
> Wed, 2020-03-25 15:08 13[IKE] <3> sending NAT-T (RFC 3947) vendor ID
> Wed, 2020-03-25 15:08 13[ENC] <3> generating ID_PROT response 0 [ SA V V V V ]
> Wed, 2020-03-25 15:08 13[NET] <3> sending packet: from x.x.x.x[500] to y.y.y.y[500] (164 bytes)
> Wed, 2020-03-25 15:08 10[NET] <3> received packet: from y.y.y.y[500] to x.x.x.x[500] (316 bytes)
> Wed, 2020-03-25 15:08 10[ENC] <3> parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
> Wed, 2020-03-25 15:08 10[LIB] <3> size of DH secret exponent: 1535 bits
> Wed, 2020-03-25 15:08 10[IKE] <3> remote host is behind NAT
> Wed, 2020-03-25 15:08 10[ENC] <3> generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
> Wed, 2020-03-25 15:08 10[NET] <3> sending packet: from x.x.x.x[500] to y.y.y.y[500] (332 bytes)
> Wed, 2020-03-25 15:08 14[NET] <3> received packet: from y.y.y.y[4500] to x.x.x.x[4500] (108 bytes)
> Wed, 2020-03-25 15:08 14[ENC] <3> parsed ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
> Wed, 2020-03-25 15:08 14[CFG] <3> looking for pre-shared key peer configs matching x.x.x.x...y.y.y.y[172.20.0.10]
> Wed, 2020-03-25 15:08 14[IKE] <3> no peer config found
> Wed, 2020-03-25 15:08 14[IKE] <3> queueing INFORMATIONAL task
> Wed, 2020-03-25 15:08 14[IKE] <3> activating new tasks
> Wed, 2020-03-25 15:08 14[IKE] <3>   activating INFORMATIONAL task
> Wed, 2020-03-25 15:08 14[ENC] <3> generating INFORMATIONAL_V1 request 266312254 [ HASH N(AUTH_FAILED) ]
> Wed, 2020-03-25 15:08 14[NET] <3> sending packet: from x.x.x.x[4500] to y.y.y.y[4500] (108 bytes)
> Wed, 2020-03-25 15:08 14[IKE] <3> IKE_SA (unnamed)[3] state change: CONNECTING => DESTROYING
> Wed, 2020-03-25 15:08 03[CFG] proposing traffic selectors for us:
> Wed, 2020-03-25 15:08 03[CFG]  10.100.15.0/24
> Wed, 2020-03-25 15:08 03[CFG] proposing traffic selectors for other:
> Wed, 2020-03-25 15:08 03[CFG]  172.21.0.0/16
> Wed, 2020-03-25 15:08 03[CFG]  172.22.0.0/16
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.strongswan.org/pipermail/users/attachments/20200325/d4c6fadd/attachment.sig>