On 11/05/2020 07:48, Andreas Steffen wrote:
> But I think the remote side is not configured
> for EAP-based client authentication or cannot
> find its private signature key so AUTHENTICATION
> FAILED ensues. Any chance of getting the remote log?
>
> Andreas
>
> On 11.05.20 08:45, Andreas Steffen wrote:
>> Hi,
>>
>> in the remote section you have to set
>>
>> auth = pubkey
>>
>> since the responder is using a certificate-based
>> authentication.
>>
>> Regards
>>
>> Andreas
>>
>> On 10.05.20 14:17, lejeczek wrote:
>>> hi guys
>>>
>>> I got my strongswan updated to 5.8 and I think I migrated my
>>> simple config correctly:
>>>
>>> connections {
>>> camuni {
>>> remote_addrs="remote.fqdn" # The location
>>> of the host, FQDN or IP
>>> vips="0.0.0.0"
>>> send_cert="never"
>>> local {
>>> id="me@domain"
>>> auth="eap"
>>> }
>>> remote {
>>> certs="remote.fqdn.crt"
>>> id="DNS:remote.fqdn"
>>> auth="eap"
>>> }
>>> children {
>>> camuni {
>>> remote_ts="172.16.0.0/12"
>>> mode="pass"
>>> start_action="start"
>>> }
>>> }
>>> }
>>> }
>>> secrets {
>>> eap {
>>> secret="aSecret"
>>> id="me@fqdn
>>> }
>>> }
>>>
>>> Yet still auth fails. I have no control over "remote.fqdn"
>>> but at my end I see:
>>> ...
>>> IKE] initiating IKE_SA camuni[9] to xx.XX.zz.ZZ
>>> [ENC] generating IKE_SA_INIT request 0 [ SA KE No
>>> N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
>>> [NET] sending packet: from xx.XX.yy.YY[500] to
>>> xx.XX.zz.ZZ[500] (1400 bytes)
>>> [NET] received packet: from xx.XX.zz.ZZ[500] to
>>> xx.XX.yy.YY[500] (592 bytes)
>>> [ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP)
>>> N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(MULT_AUTH) ]
>>> [CFG] selected proposal:
>>> IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072
>>> [IKE] remote host is behind NAT
>>> [IKE] sending cert request for "O=CA, CN=mydom.local"
>>> [IKE] sending cert request for "O=CA, CN=mydom.local"
>>> [IKE] establishing CHILD_SA camuni{9}
>>> [ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT)
>>> CERTREQ IDr CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP)
>>> N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR)
>>> N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
>>> [NET] sending packet: from xx.XX.yy.YY[4500] to
>>> xx.XX.zz.ZZ[4500] (432 bytes)
>>> [NET] received packet: from xx.XX.zz.ZZ[4500] to
>>> xx.XX.yy.YY[4500] (80 bytes)
>>> [ENC] parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]
>>> [IKE] received AUTHENTICATION_FAILED notify error
>>> initiate failed: establishing CHILD_SA 'camuni' failed
>>>
>>> Would you have any suggestions and advice I'll be grateful.
>>> many thanks, L.
>>>
I'm afraid no chance to see what's happening on the remote.
All I know is that is should be "IKEv2 with RSA and EAP"
Just for the sake of clarity, below is the working 5.7 config:
conn MAC
left=%any
leftid="me@domain"
leftauth=eap
leftsourceip=%config
leftfirewall=yes
right="vpn.remote.fqdn"
rightid="DNS:vpn.remote.fqdn"
rightid=%any
rightcert="/etc/strongswan/ipsec.d/certs/mac-vpn-server.crt"
rightsubnet=172.16.0.0/12
auto=start
There is, I guess, a bit more in how 5.7 and 5.8 differ.
Some "defaults" perhaps?
Changing config in remote to:
auth = "pubkey"
still fails with:
...
May 11 10:23:51 swir.private.pawel charon-systemd[13223]:
12[IKE] received AUTHENTICATION_FAILED notify error
May 11 10:23:51 swir.private.pawel charon-systemd[13223]:
parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]
May 11 10:23:51 swir.private.pawel charon-systemd[13223]:
12[CHD] CHILD_SA amuni{2} state change: CREATED => DESTROYING
May 11 10:23:51 swir.private.pawel charon-systemd[13223]:
received AUTHENTICATION_FAILED notify error
May 11 10:23:51 swir.private.pawel charon-systemd[13223]:
12[IKE] IKE_SA amuni[2] state change: CONNECTING => DESTROYING
ps. I'm on Centos 7.8
many thanks, L.
