Hi Paul I made the changes as suggested by you and there's progress, I see the tunnel is getting established now, but no communication is happening between the client and Server. By the way this tunnel I am looking at establishing is between my laptop running CentOS 8 at home and a CentOS 8 gateway at office which as I mentioned earlier has site- to-site VPN established successfully to 4 other locations using Libreswan. As of now, I am only looking at accessing resources behind this gateway, eventually the intention is to access all those 4 locations the gateway is talking to. As of now, the changes and logs look like this Server side. Replaced Server's public Ip with 1.2.3.4 conn MOBILE left=1.2.3.4 leftsubnet=192.168.0.0/24 leftcert=europa.abc.com [email protected] leftrsa sigkey=%cert leftsendcert=always right=%any rightsu bnet=0.0.0.0/0 rightca=%same rightrsasigkey=%cert auto=add dpddelay=60 dpdtimeout=300 dpdacti on=clear ikev2=insist narrowing=yes fragmentation=yes type=tunnel
Client side conn EUROPA left=%defaultroute leftcert=ceres.xyz.com leftid= %fromcert leftrsasigkey=%cert leftsubnet=10.10.128.0/24 leftmodecfgclient=yes right=1.2.3.4 rightsubnet=192.168.0.0/24 [email protected] rightrsasigkey=%cert ikev2=insist rekey=y es fragmentation=yes narrowing=yes mobike=yes auto=ad d On the client side when an attempt is made. # ipsec auto --up EUROPA181 "EUROPA"[2] 1.2.3.4 #5: initiating IKEv2 connection181 "EUROPA"[2] 1.2.3.4 #5: sent IKE_SA_INIT request182 "EUROPA"[2] 1.2.3.4 #5: sent IKE_AUTH request {auth=IKEv2 cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_512 group=MODP2048}002 "EUROPA"[2] 1.2.3.4 #5: certificate verified OK: O=Europa,CN=europa.abc.com002 "EUROPA"[2] 1.2.3.4 #5: IKEv2 mode peer ID is ID_FQDN: '@europa.abc.com'003 "EUROPA"[2] 1.2.3.4 #5: authenticated using RSA with SHA2_512003 "EUROPA"[2] 1.2.3.4 #6: missing v2CP reply, not attempting to setup child SA214 "EUROPA"[2] 1.2.3.4 #6: state transition 'Initiator: process IKE_AUTH response' failed with v2N_NO_PROPOSAL_CHOSEN002 "EUROPA"[2] 1.2.3.4 #6: deleting state (STATE_PARENT_I2) aged 60.09774s and NOT sending notification On the Server side, /var/log/pluto.log shows this. Replaced my public IP with 6.7.8.9 Mar 25 20:18:03.398343: "MOBILE"[3] 6.7.8.9: local IKE proposals (IKE SA responder matching remote proposals): Mar 25 20:18:03.398376: "MOBILE"[3] 6.7.8.9: 1:IKE=AES_GCM_C_256-HMAC_SHA2_512+HMAC_SHA2_256- NONE- MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519M ar 25 20:18:03.398381: "MOBILE"[3] 6.7.8.9: 2:IKE=AES_GCM_C_128- HMAC_SHA2_512+HMAC_SHA2_256-NONE- MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519M ar 25 20:18:03.398385: "MOBILE"[3] 6.7.8.9: 3:IKE=AES_CBC_256- HMAC_SHA2_512+HMAC_SHA2_256-HMAC_SHA2_512_256+HMAC_SHA2_256_128- MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519M ar 25 20:18:03.398403: "MOBILE"[3] 6.7.8.9: 4:IKE=AES_CBC_128- HMAC_SHA2_512+HMAC_SHA2_256-HMAC_SHA2_512_256+HMAC_SHA2_256_128- MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519M ar 25 20:18:03.398418: "MOBILE"[3] 6.7.8.9 #9: proposal 1:IKE=AES_GCM_C_256-HMAC_SHA2_512-MODP2048 chosen from remote proposals 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512;PRF=HMAC_SHA2_256;DH=MODP204 8;DH=MODP3072;DH=MODP4096;DH=MODP8192;DH=ECP_256;DH=ECP_384;DH=ECP_521; DH=CURVE25519[first-match] 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512;PRF=HMAC_SHA2_256;DH=MODP204 8;DH=MODP3072;DH=MODP4096;DH=MODP8192;DH=ECP_256;DH=ECP_384;DH=ECP_521; DH=CURVE25519 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512;PRF=HMAC_SHA2_256;INTEG=HMAC_S HA2_512_256;INTEG=HMAC_SHA2_256_128;DH=MODP2048;DH=MODP3072;DH=MODP4096 ;DH=MODP8192;DH=ECP_256;DH=ECP_384;DH=ECP_521;DH=CURVE25519 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512;PRF=HMAC_SHA2_256;INTEG=HMAC_S HA2_512_256;INTEG=HMAC_SHA2_256_128;DH=MODP2048;DH=MODP3072;DH=MODP4096 ;DH=MODP8192;DH=ECP_256;DH=ECP_384;DH=ECP_521;DH=CURVE25519Mar 25 20:18:03.399828: "MOBILE"[3] 6.7.8.9 #9: sent IKE_SA_INIT reply {auth=IKEv2 cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_512 group=MODP2048}Mar 25 20:18:03.452119: "MOBILE"[3] 6.7.8.9 #9: processing decrypted IKE_AUTH request: SK{IDi,CERT,IDr,AUTH,CP,SA,TSi,TSr,N}Mar 25 20:18:03.452836: "MOBILE"[3] 6.7.8.9 #9: certificate verified OK: O=Europa,CN=ceres.xyz.comMar 25 20:18:03.452857: "MOBILE"[3] 6.7.8.9 #9: certificate subjectAltName extension does not match ID_IPV4_ADDR '6.7.8.9'Mar 25 20:18:03.452862: "MOBILE"[3] 6.7.8.9 #9: Peer CERT payload SubjectAltName does not match peer ID for this connectionMar 25 20:18:03.452880: "MOBILE"[3] 6.7.8.9 #9: X509: connection failed due to unmatched IKE ID in certificate SANMar 25 20:18:03.452935: "MOBILE"[3] 6.7.8.9 #9: switched from "MOBILE"[3] 6.7.8.9 to "MOBILE"Mar 25 20:18:03.452949: "MOBILE"[3] 6.7.8.9: deleting connection instance with peer 6.7.8.9 {isakmp=#0/ipsec=#0}Mar 25 20:18:03.452964: "MOBILE"[4] 6.7.8.9 #9: IKEv2 mode peer ID is ID_DER_ASN1_DN: 'CN=ceres.xyz.com, O=Europa'Mar 25 20:18:03.453185: "MOBILE"[4] 6.7.8.9 #9: authenticated using RSA with SHA2_512Mar 25 20:18:03.461603: "MOBILE"[4] 6.7.8.9: local ESP/AH proposals (IKE_AUTH responder matching remote ESP/AH proposals): Mar 25 20:18:03.461622: "MOBILE"[4] 6.7.8.9: 1:ESP=AES_GCM_C_256-NONE-NONE-DISABLEDMar 25 20:18:03.461626: "MOBILE"[4] 6.7.8.9: 2:ESP=AES_GCM_C_128-NONE-NONE- DISABLEDMar 25 20:18:03.461630: "MOBILE"[4] 6.7.8.9: 3:ESP=AES_CBC_256-HMAC_SHA2_512_256+HMAC_SHA2_256_128-NONE- DISABLEDMar 25 20:18:03.461633: "MOBILE"[4] 6.7.8.9: 4:ESP=AES_CBC_128-HMAC_SHA2_512_256+HMAC_SHA2_256_128-NONE- DISABLEDMar 25 20:18:03.461642: "MOBILE"[4] 6.7.8.9 #10: proposal 1:ESP=AES_GCM_C_256-DISABLED SPI=7f84b6fd chosen from remote proposals 1:ESP:ENCR=AES_GCM_C_256;ESN=DISABLED[first-match] 2:ESP:ENCR=AES_GCM_C_128;ESN=DISABLED 3:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_512_256;INTEG=HMAC_SHA2_256_128; ESN=DISABLED 4:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256;INTEG=HMAC_SHA2_256_128; ESN=DISABLEDMar 25 20:18:03.494155: "MOBILE"[4] 6.7.8.9 #10: negotiated connection [192.168.0.0-192.168.0.255:0-65535 0] -> [0.0.0.0- 255.255.255.255:0-65535 0]Mar 25 20:18:03.494182: "MOBILE"[4] 6.7.8.9 #10: IPsec SA established tunnel mode {ESPinUDP=>0x7f84b6fd <0xd8d28ada xfrm=AES_GCM_16_256-NONE NATOA=none NATD=6.7.8.9:28646 DPD=active} Thanks, Best On Wed, 2021-03-24 at 15:36 -0400, Paul Wouters wrote: > On Thu, 25 Mar 2021, Blue Aquan wrote: > > Server side > > conn > > MOBILE left=europa.abc.com leftsubnet=192.168.1.0/24 > > right=%any rightaddresspool=10.10.128.10- > > 10.10.128.20 > > add [email protected] > > > Client side > > conn > > EUROPA left=%defaultroute leftsubnet=10.10.128.0/24 > > right=europa.abc.com rightsubnet=192.168.1.0/24 > > [email protected] > > I cannot tell whether you want a tunnel established from > 10.10.128.0/24 <-> 192.168.1.0/24Or that you want to hand out an > addresspool to the client via rightaddresspool= > If you meant a subnet to subnet, then on the conn MOBILE replace > theaddresspool line with rightsubnet=10.10.128.0/24 > If you meant giving it a single IP, then remote > therightsubnet=192.168.1.0/24 and add rightsubnet=0.0.0.0/0 with > narrowing=yes > Paul
_______________________________________________ Swan mailing list [email protected] https://lists.libreswan.org/mailman/listinfo/swan
