On Fri, 28 Sep 2018, Madden, Joe wrote:
Is there a keyword or something I can search the logs for?
I'll go back to the logs and see if I can find it!
It would look like:
Sep 28 12:03:19.079624: "west" #19: initiate rekey of IKEv2 CREATE_CHILD_SA IKE
Rekey
Sep 28 12:03:19.089626: "west" #20: local IKE proposals for west (IKE SA
initiating rekey):
1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256,HMAC_SHA1;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256
2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256,HMAC_SHA1;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256
3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256,HMAC_SHA1;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128,HMAC_SHA1_96;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256
4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256,HMAC_SHA1;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128,HMAC_SHA1_96;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256
(default)
Sep 28 12:03:19.107468: "west" #20: STATE_V2_REKEY_IKE_I: STATE_V2_REKEY_IKE_I
Sep 28 12:03:19.170311: "west" #20: rekeyed #19 STATE_V2_REKEY_IKE_I and expire
it remaining life 4s
Sep 28 12:03:19.173091: "west" #20: STATE_PARENT_I3: PARENT SA established
Paul
Thanks
Joe.
-----Original Message-----
From: Paul Wouters <[email protected]>
Sent: 27 September 2018 18:15
To: Madden, Joe <[email protected]>
Cc: [email protected]
Subject: RE: [Swan] Azure + LibreSwan
On Thu, 27 Sep 2018, Madden, Joe wrote:
I've ran though the output from debug but I'm not sure how to read it in order
to find the azure proposal.
https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpas
tebin.com%2Fraw%2FQdns0p5q&data=01%7C01%7CJoe.Madden%40mottmac.com
%7Cd10bd736bbff486be3ff08d6249cc60a%7Ca2bed0c459574f73b0c2a811407590fb
%7C0&sdata=pEzC%2BsAmiGmPiJ2C16CTQifAuDjrLgKAR%2BUVXBaN8Jg%3D&
reserved=0
Am I being dense - How do you tell the proposal from this log output?
That log is only of a single informational exchange for DPD. It is not actually
a rekey exchange or a response/initiator for an initial connection.
Paul
-----Original Message-----
From: Paul Wouters <[email protected]>
Sent: 26 September 2018 14:45
To: Madden, Joe <[email protected]>
Cc: [email protected]
Subject: Re: [Swan] Azure + LibreSwan
On Wed, 26 Sep 2018, Madden, Joe wrote:
Sep 26 10:33:24 gw pluto[788]: packet from #####:500: initial parent
SA message received on 87.85.199.82:500 but no connection has been
authorized with policy RSASIG+IKEV2_ALLOW
The above line I suspect is the issue (Because we are not using RSK to
authenticate.
That error can be a bit misleading as it could be other things that are not
matching. You can try running with plutodebug=all which should log all the
proposals at the time and hopefully that will show something.
I thought later versions of libreswan also logged the proposals in non-debug
mode, so perhaps you are running an older version.
Paul
_______________________________________________
Swan mailing list
[email protected]
https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis
ts.libreswan.org%2Fmailman%2Flistinfo%2Fswan&data=01%7C01%7Cjoe.madden%40mottmac.com%7Cf5c132dd27e84fff7e8608d623c4f867%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=cVbccwnPrr%2BEbn%2Fe0MKZDfZGGTruz0Vzo7i%2FtihN2%2B8%3D&reserved=0
_______________________________________________
Swan mailing list
[email protected]
https://lists.libreswan.org/mailman/listinfo/swan
