Hi all,

trying to re create our strongswan setup on a new server, we had a working proof of concept but the old server was scrapped. We had some files copied for the config that unfortunately arent working for some reason now.

also, with charon debug we are not receiving logs for some reason, nothing in journalctl to help either?


the scenario

server with an external facing IP hosting strongswan (no firewall currently for testing setup)

clients connecting in via mobile strongswan with certificate and EAP so that they can be on the network, the plan is to have it so that any phone traffic routes through here and any other traffic doesnt.


we have done the local server as the ca for testing, and copied the ca cert to the phone, however it wont connect, as theres no logs server side this doesnt help (but a tcpdump when trying to connect shows:

isakmp: isakmp: parent_sa ikev2_init[I]

admin prohibited filter, length 556

phone logs show: unable to terminate ike_sa, peer not responding

I

here is the config file that i named "android working" from the old server that isnt working now. (there are duplicate entries of right send cert, should this be never?, aso for the right auth, what should i be expecting my .secrets file to look like?)


config setup
    charondebug="ike 1, knl 1, cfg 0"
    uniqueids=no

conn ikev2-vpn
    auto=add
    compress=no
    type=tunnel
    keyexchange=ikev2
    fragmentation=yes
    forceencaps=yes
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%any
    leftid=my-servers-external-ip
    leftcert=the-server-cert
    leftsendcert=always
    leftsubnet=0.0.0.0/0
    right=%any
    rightid=%any
    rightsendcert=always
    rightauth=pubkey
    authby=pubkey
    #rightauth=eap-mschapv2
    rightsourceip=10.10.10.0/24
    rightdns=8.8.8.8,8.8.4.4
    rightsendcert=never
    eap_identity=%identity
ike=chacha20poly1305-sha512-curve25519-prfsha512,aes256gcm16-sha384-prfsha384-ecp384,aes256-sha1-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024!

any help much appreciated

thankyou kindly



Reply via email to