Strongswan IPsec configuration ( Linux - Cisco)

0

I'm configuring site-to-site ipsec tunnel. The error that I am getting shows that Quick Mode proposal (ESP) doesn't match

Jan 27 09:23:42 raspberrypi charon: 10[ENC] generating QUICK_MODE request 2270601801 [ HASH SA No ID ID ] 
Jan 27 09:23:42 raspberrypi charon: 10[NET] sending packet: from 192.168.0.150[4500] to
194.24.131.1[4500] (204 bytes) 
Jan 27 09:23:42 raspberrypi charon: 12[NET] received packet: from 194.24.131.1[4500] to
192.168.0.150[4500] (92 bytes) 
Jan 27 09:23:42 raspberrypi charon: 12[ENC] parsed INFORMATIONAL_V1 request 3838561195 [ HASH N(NO_PROP) ] 
Jan 27 09:23:42 raspberrypi charon: 12[IKE] received NO_PROPOSAL_CHOSEN error notify

remote host:


! policy1

crypto isakmp policy 152

encr aes 256

hash sha

group 5

lifetime 86400

!

! policy2

crypto ipsec transform-set TS-AES-SHA256 esp-aes 256 esp-sha256-hmac

 mode tunnel

!

crypto keyring C-AVILOO

  pre-shared-key address 178.115.235.78 key *****************

!

crypto map vpn 89 ipsec-isakmp

 set peer 178.115.235.78

set transform-set TS-AES-SHA256

 set isakmp-profile C-AVILOO

match address C-AVILOO

reverse-route static

!

ip access-list extended C-AVILOO

permit ip host 172.19.254.89 host 178.115.131.146

    permit ip 10.0.0.0 0.0.31.255 128.0.0.0 127.255.255.255

    permit ip 10.0.0.0 0.0.31.255 64.0.0.0 63.255.255.255

    permit ip 10.0.0.0 0.0.31.255 32.0.0.0 31.255.255.255

    permit ip 10.0.0.0 0.0.31.255 16.0.0.0 15.255.255.255

    permit ip 10.0.0.0 0.0.31.255 8.0.0.0 7.255.255.255

    permit ip 10.0.0.0 0.0.31.255 4.0.0.0 3.255.255.255

    permit ip 10.0.0.0 0.0.31.255 2.0.0.0 1.255.255.255

    permit ip 10.0.0.0 0.0.31.255 1.0.0.0 0.255.255.255

!        

On my server I'm using strongswan with the following ipsec.conf:

# ipsec.conf - strongSwan IPsec configuration file

config setup

        charondebug="all"
#def    nat_traversal=yes

conn %default

        ikelifetime=86400s
        keylife=3600s
        keyexchange=ikev1
        authby=secret

conn cisco

#def    left=%any
#def    left=%defaultroute
        leftid= <my public IP>
        left=%any
#mod    left=192.168.0.150
        leftsubnet=0.0.0.0/0
        leftfirewall=yes
        rightid=<cisco public IP>
        right=<cisco public IP>
        rightsubnet=10.0.0.0/19
        auto=start
        ike=aes256-sha-modp1536
        esp=aes256-sha256
        aggressive=no


Running ipsec statusall provides this output:

Status of IKE charon daemon (strongSwan 5.7.2, Linux 4.19.75-v7+, armv7l):
  uptime: 3 seconds, since Jan 21 13:37:38 2020
  malloc: sbrk 1220608, mmap 0, used 302432, free 918176
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 7
  loaded plugins: charon aes rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown counters
Listening IP addresses:
  192.168.0.150
Connections:
       cisco:  %any...<cisco public IP>  IKEv1
       cisco:   local:  [<my public IP>] uses pre-shared key authentication
       cisco:   remote: [<cisco public IP>] uses pre-shared key authentication
       cisco:   child:  0.0.0.0/0 === 10.0.0.0/19 TUNNEL
Security Associations (1 up, 0 connecting):
       cisco[1]: ESTABLISHED 2 seconds ago, 192.168.0.150[<my public IP>]...<cisco public IP>[<cisco public IP>]
       cisco[1]: IKEv1 SPIs: 097a85775d335a12_i* ed7822635e06c267_r, pre-shared key reauthentication in 23 hours
       cisco[1]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536

log file

Jan 21 13:37:38 raspberrypi charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.7.2, Linux 4.19.75-v7+, armv7l)
Jan 21 13:37:38 raspberrypi charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
Jan 21 13:37:38 raspberrypi charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
Jan 21 13:37:38 raspberrypi charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
Jan 21 13:37:38 raspberrypi charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
Jan 21 13:37:38 raspberrypi charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'
Jan 21 13:37:38 raspberrypi charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'
Jan 21 13:37:38 raspberrypi charon: 00[CFG]   loaded IKE secret for <my public IP> <cisco public IP>
Jan 21 13:37:38 raspberrypi charon: 00[CFG] expanding file expression '/var/lib/strongswan/ipsec.secrets.inc' failed
Jan 21 13:37:38 raspberrypi charon: 00[LIB] loaded plugins: charon aes rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown counters
Jan 21 13:37:38 raspberrypi charon: 00[LIB] dropped capabilities, running as uid 0, gid 0
Jan 21 13:37:38 raspberrypi charon: 00[JOB] spawning 16 worker threads
Jan 21 13:37:38 raspberrypi charon: 05[CFG] received stroke: add connection 'cisco'
Jan 21 13:37:38 raspberrypi charon: 05[CFG] added configuration 'cisco'
Jan 21 13:37:38 raspberrypi charon: 07[CFG] received stroke: initiate 'cisco'
Jan 21 13:37:38 raspberrypi charon: 07[IKE] initiating Main Mode IKE_SA cisco[1] to <cisco public IP>
Jan 21 13:37:38 raspberrypi charon: 07[ENC] generating ID_PROT request 0 [ SA V V V V V ]
Jan 21 13:37:38 raspberrypi charon: 07[NET] sending packet: from 192.168.0.150[500] to <cisco public IP>[500] (252 bytes)
Jan 21 13:37:38 raspberrypi charon: 09[NET] received packet: from <cisco public IP>[500] to 192.168.0.150[500] (108 bytes)
Jan 21 13:37:38 raspberrypi charon: 09[ENC] parsed ID_PROT response 0 [ SA V ]
Jan 21 13:37:38 raspberrypi charon: 09[IKE] received NAT-T (RFC 3947) vendor ID
Jan 21 13:37:38 raspberrypi charon: 09[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
Jan 21 13:37:38 raspberrypi charon: 09[ENC] generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
Jan 21 13:37:38 raspberrypi charon: 09[NET] sending packet: from 192.168.0.150[500] to <cisco public IP>[500] (308 bytes)
Jan 21 13:37:38 raspberrypi charon: 10[NET] received packet: from <cisco public IP>[500] to 192.168.0.150[500] (368 bytes)
Jan 21 13:37:38 raspberrypi charon: 10[ENC] parsed ID_PROT response 0 [ KE No V V V V NAT-D NAT-D ]
Jan 21 13:37:38 raspberrypi charon: 10[IKE] received Cisco Unity vendor ID
Jan 21 13:37:38 raspberrypi charon: 10[IKE] received DPD vendor ID
Jan 21 13:37:38 raspberrypi charon: 10[ENC] received unknown vendor ID: 18:bf:85:7e:5e:07:c2:67:eb:55:0d:a8:e0:60:c2:b7
Jan 21 13:37:38 raspberrypi charon: 10[IKE] received XAuth vendor ID
Jan 21 13:37:38 raspberrypi charon: 10[IKE] local host is behind NAT, sending keep alives
Jan 21 13:37:38 raspberrypi charon: 10[ENC] generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
Jan 21 13:37:38 raspberrypi charon: 10[NET] sending packet: from 192.168.0.150[4500] to <cisco public IP>[4500] (108 bytes)
Jan 21 13:37:39 raspberrypi charon: 16[NET] received packet: from <cisco public IP>[4500] to 192.168.0.150[4500] (92 bytes)
Jan 21 13:37:39 raspberrypi charon: 16[ENC] invalid HASH_V1 payload length, decryption failed?
Jan 21 13:37:39 raspberrypi charon: 16[ENC] could not decrypt payloads
Jan 21 13:37:39 raspberrypi charon: 16[IKE] message parsing failed
Jan 21 13:37:39 raspberrypi charon: 16[IKE] ignore malformed INFORMATIONAL request
Jan 21 13:37:39 raspberrypi charon: 16[IKE] INFORMATIONAL_V1 request with message ID 1010083930 processing failed
Jan 21 13:37:39 raspberrypi charon: 16[NET] received packet: from <cisco public IP>[4500] to 192.168.0.150[4500] (76 bytes)
Jan 21 13:37:39 raspberrypi charon: 16[ENC] parsed ID_PROT response 0 [ ID HASH ]
Jan 21 13:37:39 raspberrypi charon: 16[IKE] IKE_SA cisco[1] established between 192.168.0.150[<my public IP>]...<cisco public IP>[<cisco public IP>]
Jan 21 13:37:39 raspberrypi charon: 16[IKE] scheduling reauthentication in 85426s
Jan 21 13:37:39 raspberrypi charon: 16[IKE] maximum IKE_SA lifetime 85966s
Jan 21 13:37:39 raspberrypi charon: 16[ENC] generating QUICK_MODE request 2584173163 [ HASH SA No ID ID ]
Jan 21 13:37:39 raspberrypi charon: 16[NET] sending packet: from 192.168.0.150[4500] to <cisco public IP>[4500] (204 bytes)
Jan 21 13:37:39 raspberrypi charon: 12[NET] received packet: from <cisco public IP>[4500] to 192.168.0.150[4500] (92 bytes)
Jan 21 13:37:39 raspberrypi charon: 12[ENC] parsed INFORMATIONAL_V1 request 3026828106 [ HASH N(NO_PROP) ]
Jan 21 13:37:39 raspberrypi charon: 12[IKE] received NO_PROPOSAL_CHOSEN error notify
Jan 21 13:37:42 raspberrypi kernel: [511387.051018] Voltage normalised (0x00000000)
Jan 21 13:38:02 raspberrypi charon: 09[IKE] sending keep alive to <cisco public IP>[4500]

** This is my first experience in the IPSec. I'm quite confused as I can't understand exactly what's wrong. Advices will be appreciated.**

linux
ipsec
strongswan
asked on Super User Jan 21, 2020 by Max Dotsenko • edited Jan 27, 2020 by Max Dotsenko

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0