[Openswan Users] Assistance with configuration
Ian Barnes
ian.lidtech at gmail.com
Thu Apr 23 14:31:10 EDT 2015
Hi All
Apologies for the probable stupid question - but I am having some problems
getting an IPSEC tunnel up and running to a provider.
Here is my network config:
*Connecting Server*
Connecting Server has two interfaces
eth0: x.x.x.x/28
eth1: 10.0.64.150/24
Connecting server is running CentOS 6.6, OpenSwan (2.6.32-37.el6)
Here is a verify:
# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.32/K2.6.32-504.el6.x86_64 (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing for disabled ICMP send_redirects [OK]
NETKEY detected, testing for disabled ICMP accept_redirects [OK]
Testing against enforced SElinux mode [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Two or more interfaces found, checking IP forwarding [OK]
Checking NAT and MASQUERADEing [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
*Remote Server*
Here are the connection details of the remote connection i've been given:
Remote IP: y.y.y.y
Internal IP: z.z.z.z
*Phase 1:*
Cipher: AES-256
MD Algorithm: SHA1
LifeTime: 86400sec
DH Group: 2
IKE Mode: Main
Auth Mode: PSK
*Phase 2:*
IPSec Type: ESP
Cipher: AES-256
MD Algorithm: SHA1
PFS: NO
LifeTime: 3600seconds
Granularity: Host
*My Config*
conn tj-vpn
type=tunnel
auth=esp
authby=secret
ikelifetime=86400m
rekeymargin=10m
rekeyfuzz=0%
keylife=3600s
esp=aes256-sha1
ike=aes256-sha1
keyexchange=ike
pfs=no
left=x.x.x.x
leftsubnet=10.0.0.0/16
leftnexthop=%defaultroute
right=y.y.y.y
rightsubnet=z.z.z.z/32
auto=start
Startup shows the following:
# ipsec auto --up tj-vpn
104 "tj-vpn" #2: STATE_MAIN_I1: initiate
003 "tj-vpn" #2: received Vendor ID payload [RFC 3947] method set to=109
003 "tj-vpn" #2: ignoring Vendor ID payload [FRAGMENTATION c0000000]
003 "tj-vpn" #2: peer requested 5184000 seconds which exceeds our limit
86400 seconds. Attribute OAKLEY_LIFE_DURATION (variable length)
003 "tj-vpn" #2: no acceptable Oakley Transform
214 "tj-vpn" #2: STATE_MAIN_I1: NO_PROPOSAL_CHOSEN
*JUST HANGS THERE*
# ipsec --status
000 using kernel interface: netkey
000 interface lo/lo ::1
000 interface lo/lo 127.0.0.1
000 interface lo/lo 127.0.0.1
000 interface eth0/eth0 x.x.x.x
000 interface eth0/eth0 x.x.x.x
000 interface eth1/eth1 10.0.64.150
000 interface eth1/eth1 10.0.64.150
000 %myid = (none)
000 debug none
000
000 virtual_private (%priv):
000 - allowed 0 subnets:
000 - disallowed 0 subnets:
000 WARNING: Either virtual_private= is not specified, or there is a syntax
000 error in that line. 'left/rightsubnet=vhost:%priv' will not
work!
000 WARNING: Disallowed subnets in virtual_private= is empty. If you have
000 private address space in internal use, it should be excluded!
000
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192,
keysizemax=192
000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8, keysizemin=128,
keysizemax=128
000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40,
keysizemax=448
000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0,
keysizemax=0
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128,
keysizemax=256
000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=12,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=16,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=12,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=16,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=22, name=(null), ivlen=8, keysizemin=128,
keysizemax=256
000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5,
keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1,
keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256,
keysizemin=256, keysizemax=256
000 algorithm ESP auth attr: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384,
keysizemin=384, keysizemax=384
000 algorithm ESP auth attr: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512,
keysizemin=512, keysizemax=512
000 algorithm ESP auth attr: id=8, name=(null), keysizemin=160,
keysizemax=160
000 algorithm ESP auth attr: id=9, name=(null), keysizemin=128,
keysizemax=128
000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0, keysizemax=0
000
000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=3, name=OAKLEY_BLOWFISH_CBC, blocksize=8,
keydeflen=128
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8,
keydeflen=192
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16,
keydeflen=128
000 algorithm IKE encrypt: id=65004, name=OAKLEY_SERPENT_CBC, blocksize=16,
keydeflen=128
000 algorithm IKE encrypt: id=65005, name=OAKLEY_TWOFISH_CBC, blocksize=16,
keydeflen=128
000 algorithm IKE encrypt: id=65289, name=OAKLEY_TWOFISH_CBC_SSH,
blocksize=16, keydeflen=128
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32
000 algorithm IKE hash: id=5, name=OAKLEY_SHA2_384, hashsize=48
000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024
000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048
000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048
000
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,2,64}
trans={0,2,3072} attrs={0,2,2048}
000
000 "tj-vpn": 10.0.0.0/16===x.x.x.x<x.x.x.x>[+S=C]...y.y.y.y<y.y.y.y>[+S=C]===z.z.z.z/32;
prospective erouted; eroute owner: #0
000 "tj-vpn": myip=unset; hisip=unset;
000 "tj-vpn": ike_life: 5184000s; ipsec_life: 3600s; rekey_margin: 600s;
rekey_fuzz: 0%; keyingtries: 0; nat_keepalive: yes
000 "tj-vpn": policy:
PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 16,32;
interface: eth0;
000 "tj-vpn": newest ISAKMP SA: #0; newest IPsec SA: #0;
000 "tj-vpn": IKE algorithms wanted:
AES_CBC(7)_256-SHA1(2)_000-MODP1536(5),
AES_CBC(7)_256-SHA1(2)_000-MODP1024(2)
000 "tj-vpn": IKE algorithms found:
AES_CBC(7)_256-SHA1(2)_160-MODP1536(5),
AES_CBC(7)_256-SHA1(2)_160-MODP1024(2)
000 "tj-vpn": ESP algorithms wanted: AES(12)_256-SHA1(2)_000
000 "tj-vpn": ESP algorithms loaded: AES(12)_256-SHA1(2)_160
000
000 #2: "tj-vpn":500 STATE_MAIN_I1 (sent MI1, expecting MR1); none in -1s;
nodpd; idle; import:admin initiate
000 #2: pending Phase 2 for "tj-vpn" replacing #0
000
# cat ipsec.secrets
x.x.x.x y.y.y.y: PSK "PSKGOESHERE"
Anyone have any ideas what i'm doing wrong? I'd appreciate all assistance.
Thanks so much in advance!
Cheers
Ian
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openswan.org/pipermail/users/attachments/20150423/9ebb46aa/attachment.html>
More information about the Users
mailing list