<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI Semilight";
panose-1:2 11 4 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Segoe UI Semilight",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">I managed to make a working connection between two linux machines, one running OpenSwan and the other running StrongSwan using PSK. The config on the Openswan side
was as follows:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">conn test<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> authby=secret<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> type=tunnel<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> left=192.168.100.37<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> leftsubnet=10.2.0.0/24<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> right=192.168.100.38<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> rightsubnet=10.1.0.0/24<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> auto=start<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> esp=aes128-sha1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> ike=aes128-sha1-modp2048<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> rekey=yes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> dpdaction=clear<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> dpddelay=15<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> dpdtimeout=50<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> compress=no<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">However, after attempting to change this to work with RSA certs, I have run into a problem. The Openswan config now looks like this:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">conn test<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> authby=rsasig<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> type=tunnel<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> left=192.168.100.37<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> leftsubnet=10.2.0.0/24<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> right=192.168.100.38<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> rightsubnet=10.1.0.0/24<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> auto=start<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> esp=aes128-sha1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> ike=aes128-sha1-modp2048<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> rekey=yes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> dpdaction=clear<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> dpddelay=15<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> dpdtimeout=50<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> compress=no<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> leftcert=/etc/ipsec.d/certs/covazfw.pem<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> rightcert=/etc/ipsec.d/certs/aspfw2.pem<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> leftid="C=CH, O=strongSwan, CN=covazfw"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"> rightid="C=CH, O=strongSwan, CN=aspfw2"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">All the relevant public certs are in the ipsec.d subfolder hierarchy, along with the private key for the OpenSwan side covazfw.pem.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Ipsec.secrets is as follows:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">: RSA /etc/ipsec.d/private/covazfw.pem<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">The auth.log shows this:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:43 covtestvpn pluto[7623]: packet from 192.168.100.38:500: received Vendor ID payload [XAUTH]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:43 covtestvpn pluto[7623]: packet from 192.168.100.38:500: received Vendor ID payload [Dead Peer Detection]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:43 covtestvpn pluto[7623]: packet from 192.168.100.38:500: received Vendor ID payload [RFC 3947] method set to=109<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:43 covtestvpn pluto[7623]: packet from 192.168.100.38:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using
method 109<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:43 covtestvpn pluto[7623]: "test" #14: responding to Main Mode<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:43 covtestvpn pluto[7623]: "test" #14: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:43 covtestvpn pluto[7623]: "test" #14: STATE_MAIN_R1: sent MR1, expecting MI2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:43 covtestvpn pluto[7623]: "test" #14: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:43 covtestvpn pluto[7623]: "test" #14: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:43 covtestvpn pluto[7623]: "test" #14: STATE_MAIN_R2: sent MR2, expecting MI3<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:43 covtestvpn pluto[7623]: "test" #14: Main mode peer ID is ID_DER_ASN1_DN: 'C=CH, O=strongSwan, CN=aspfw2'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:43 covtestvpn pluto[7623]: "test" #14: no suitable connection for peer 'C=CH, O=strongSwan, CN=aspfw2'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:43 covtestvpn pluto[7623]: "test" #14: sending encrypted notification INVALID_ID_INFORMATION to 192.168.100.38:500<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:47 covtestvpn pluto[7623]: "test" #14: Main mode peer ID is ID_DER_ASN1_DN: 'C=CH, O=strongSwan, CN=aspfw2'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:47 covtestvpn pluto[7623]: "test" #14: no suitable connection for peer 'C=CH, O=strongSwan, CN=aspfw2'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Jul 4 16:37:47 covtestvpn pluto[7623]: "test" #14: sending encrypted notification INVALID_ID_INFORMATION to 192.168.100.38:500<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">It seems that it cannot / will not authenticate the certificate from the Strongswan side. Could someone tell me what I’m doing wrong please?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI Semilight",sans-serif">Matt<o:p></o:p></span></p>
</div>
<br>
<hr>
<font face="Courier New" color="Black" size="2"><br>
Plum Software is a fully owned subsidiary of Praemium Limited.<br>
<br>
This e-mail is confidential. It may also be legally privileged. If you are not the addressee, you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify
the sender immediately by return email. Internet communications cannot be guaranteed to be timely, secure, or error or virus free. The sender does not accept liability for any errors or omissions.<br>
<br>
In the UK the Praemium Group is: Praemium Portfolio Services Ltd (Company Number: 05362168), Praemium (UK) Ltd (Company Number: 05362153), Praemium Administration Ltd (Company Number: 06016828) and Smartfund Nominees Ltd (Company Number: 07153417) each having
its registered office at 4th Floor, Suite 643-659, Salisbury House, London Wall, London, EC2M 5QQ, United Kingdom. Praemium Administration Ltd is authorised and regulated by the Financial Conduct Authority under reference 463566. See http://www.fca.org.uk/register
for more details.<br>
<br>
In Jersey the Praemium Group is: Praemium International Ltd (Company Number: 107624) which has its registered office at 3rd Floor East, Salisbury House, 1-9 Union Street, St Helier, JE2 3RF and is regulated under the Financial Service (Jersey) Law 1998 by the
Jersey Financial Services Commission for the conduct of investment business in Jersey. See http://www.jerseyfsc.org for more details.<br>
<br>
Thank you for your cooperation. Please contact us on +44 (0)207 5622 450 if you require assistance.<br>
</font>
</body>
</html>