<div dir="ltr"><div><div>This is my test connection:<br><br>conn testcon<br> keyexchange=ike<br> keyingtries=2<br> type=tunnel<br> authby=secret<br> auto=start<br> pfs=yes<br> ike=aes256-sha1;modp1024<br>
phase2alg=aes256-hmac_sha1;modp1024<br> ikelifetime=24h<br> salifetime=1h<br> aggrmode=no<br> left=ipv6 address<br> right=ipv6 address<br><br></div>And this is the result of ipsec auto --status:<br>
<br>000 using kernel interface: netkey<br>000 interface lo/lo ::1<br>000 interface eth0/eth0 2a03:b0c0:1:d0::d4:4001<br>000 interface lo/lo 127.0.0.1<br>000 interface lo/lo 127.0.0.1<br>000 interface eth0/eth0 178.62.61.145<br>
000 interface eth0/eth0 178.62.61.145<br>000 %myid = (none)<br>000 debug raw+crypt+parsing+emitting+control+lifecycle+klips+dns+oppo+controlmore+pfkey+nattraversal+x509+dpd+oppoinfo<br>000 <br>000 virtual_private (%priv):<br>
000 - allowed 6 subnets: <a href="http://10.0.0.0/8">10.0.0.0/8</a>, <a href="http://192.168.0.0/16">192.168.0.0/16</a>, <a href="http://172.16.0.0/12">172.16.0.0/12</a>, <a href="http://25.0.0.0/8">25.0.0.0/8</a>, fd00::/8, fe80::/10<br>
000 - disallowed 0 subnets: <br>000 WARNING: Disallowed subnets in virtual_private= is empty. If you have <br>000 private address space in internal use, it should be excluded!<br>000 <br>000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64<br>
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192<br>000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8, keysizemin=40, keysizemax=128<br>000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448<br>
000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0<br>000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8, keysizemin=160, keysizemax=288<br>
000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256<br>
000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=8, keysizemin=128, keysizemax=256<br>
000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256<br>
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128<br>000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160<br>000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256<br>
000 algorithm ESP auth attr: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384, keysizemin=384, keysizemax=384<br>000 algorithm ESP auth attr: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512, keysizemin=512, keysizemax=512<br>000 algorithm ESP auth attr: id=8, name=AUTH_ALGORITHM_HMAC_RIPEMD, keysizemin=160, keysizemax=160<br>
000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128<br>000 algorithm ESP auth attr: id=251, name=AUTH_ALGORITHM_NULL_KAME, keysizemin=0, keysizemax=0<br>000 <br>000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131<br>
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192<br>000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128<br>000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<br>
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<br>000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32<br>000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64<br>000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024<br>
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536<br>000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048<br>000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072<br>
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096<br>000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144<br>000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192<br>
000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024<br>000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048<br>000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048<br>000 <br>
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,3,64} trans={0,3,3072} attrs={0,3,2048} <br>000 <br>000 "testcon": 2a03:b0c0:1:d0::d4:4001<2a03:b0c0:1:d0::d4:4001>...2a03:b0c0:1:d0::d3:7001<2a03:b0c0:1:d0::d3:7001>; prospective erouted; eroute owner: #0<br>
000 "testcon": myip=unset; hisip=unset;<br>000 "testcon": ike_life: 86400s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 2 <br>000 "testcon": policy: PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 128,128; interface: eth0; <br>
000 "testcon": dpd: action:clear; delay:0; timeout:0; <br>000 "testcon": newest ISAKMP SA: #1; newest IPsec SA: #0; <br>000 "testcon": IKE algorithms wanted: AES_CBC(7)_256-SHA1(2)_000-MODP1024(2); flags=-strict<br>
000 "testcon": IKE algorithms found: AES_CBC(7)_256-SHA1(2)_160-MODP1024(2)<br>000 "testcon": IKE algorithm newest: AES_CBC_256-SHA1-MODP1024<br>000 "testcon": ESP algorithms wanted: AES(12)_256-SHA1(2)_000; pfsgroup=MODP1024(2); flags=-strict<br>
000 "testcon": ESP algorithms loaded: AES(12)_256-SHA1(2)_160<br>000 <br>000 #1: "testcon":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 81304s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate<br>
000<br><br></div>Despite of presence modp1024 in phase2alg, DH is absent in "ESP algorithms loaded". No matter which cipher I will chose, where's always difference between ESP algorithms wanted and ESP algorithms loaded. Why loaded algorithms in ESP phase always differs from the wanted ones? How can I make openswan to load modp1024 and use it during phase2? <br>
</div>