Hi Gurus,
I recently reconfigured a system so that I could connect with a Mac to
an IKEv2 conn. That tested as working, and existing windows
workstations that were using the system continued working. I added a
new cert and configured a windows laptop today to connect to this same
machine. The machine will report that it is connected, but it is
passing no data. The firewall will report up to certificate verified
OK, then it spits out this:
Nov 28 11:57:11 fw-kz pluto[6011]: "rw-ikev2"[1] 50.117.141.6 #1:
Unhandled ID type -1: 18446744073709551615??
Nov 28 11:57:11 fw-kz pluto[6011]: "rw-ikev2"[1] 50.117.141.6 #1: X509:
Certificate rejected for this connection
Nov 28 11:57:11 fw-kz pluto[6011]: "rw-ikev2"[1] 50.117.141.6 #1: X509:
CERT payload bogus or revoked
However, afterwards it negotiates a connection and reports ipsec SA
established.
The machine stays connected for a few minutes, then disconnects,
presumably dead peer detection is determining that it is not there
because no data passes. Tcpdump shows that after the connection is
established, a good pile of packets are sent from the windows machine,
but are never replied to from the firewall, and if a ping is sent from
inside the LAN to the remote windows machine, the packets are reported
leaving on the external interface, but never show up at the windows
machine.
Googling the unhandled ID finds nothing of value, but then it occurred
to me that one of the changes I had to make to get the Mac working was
to make rightid=%myid, so I changed it to rightid=%cert and now windows
is working as expected.
it was suggested that .mobileconfig is the way to go with the OSX, but I
haven't gotten that mac back to make changes yet, so wondering if the
rightid=%myid is known to not work with windows, or if there is
something I can do to make it work? Seems like it wants to work. I am
hoping to find a way to do this without breaking the mac till I can get
my hands on it again and try the .mobileconfig thing...
--
Bob Miller
Cell: 867-334-7117
Office: 867-633-3760
www.computerisms.ca
_______________________________________________
Swan mailing list
[email protected]
https://lists.libreswan.org/mailman/listinfo/swan
