I'm trying to connect server nnmain to server tony1 but I get this error
"11[CFG] looking for peer configs matching
173.45.168.24[nnmain.ezprovider.net]...66.199.171.245[C=US, ST=CA,
L=SanFrancisco, O=Fort-Funston, CN=tony1.ezp.net, e...@myhost.mydomain]
11[CFG] no matching peer config found"
Here's my configuration files (ipsec.conf)
Tony1:
config setup
plutostart=no
interfaces=%defaultroute
conn %default
keyexchange=ikev2
ike=aes256-sha1-modp1024!
esp=aes256-sha1!
dpdaction=clear
dpddelay=300s
rekey=no
conn net-to-net
left=66.199.171.245
leftcert=vpnCert.pem
left...@tony1.ezp.net
leftfirewall=yes
right=173.45.168.24
right...@nnmain.ezprovider.net
auto=add
nnmain:
config setup
crlcheckinterval=180
strictcrlpolicy=no
plutostart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
mobike=no
conn net-net
left=173.45.168.24
leftcert=nnmain.pem
left...@nnmain.ezprovider.net
leftfirewall=yes
right=66.199.171.245
right...@tony1.ezp.net
auto=add
And here's the connection logs:
Tony1:
01[CFG] received stroke: initiate 'net-to-net'
10[IKE] initiating IKE_SA net-to-net[1] to 173.45.168.24
10[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP)
N(NATD_D_IP) ]
10[NET] sending packet: from 66.199.171.245[500] to 173.45.168.24[500]
12[NET] received packet: from 173.45.168.24[500] to 66.199.171.245[500]
12[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP)
CERTREQ N(MULT_AUTH) ]
12[IKE] received cert request for "C=US, ST=CA, L=SanFrancisco,
O=Fort-Funston, CN=tony1.ezp.net, e...@myhost.mydomain"
12[IKE] sending cert request for "C=US, ST=CA, L=SanFrancisco,
O=Fort-Funston, CN=tony1.ezp.net, e...@myhost.mydomain"
12[IKE] authentication of 'C=US, ST=CA, L=SanFrancisco, O=Fort-Funston,
CN=tony1.ezp.net, e...@myhost.mydomain' (myself) with RSA signature
successful
12[IKE] sending end entity cert "C=US, ST=CA, L=SanFrancisco,
O=Fort-Funston, CN=tony1.ezp.net, e...@myhost.mydomain"
12[IKE] establishing CHILD_SA net-to-net
12[ENC] generating IKE_AUTH request 1 [ IDi CERT CERTREQ IDr AUTH SA TSi TSr
N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]
12[NET] sending packet: from 66.199.171.245[4500] to 173.45.168.24[4500]
05[NET] received packet: from 173.45.168.24[4500] to 66.199.171.245[4500]
05[ENC] parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]
05[IKE] received AUTHENTICATION_FAILED notify error
Nnmain:
charon (14675) started after 120 ms
05[CFG] received stroke: add connection 'net-net'
05[CFG] loaded certificate "C=US, ST=CA, L=SanFrancisco, O=Fort-Funston,
CN=nnmain.ezprovider.net, e=he...@yeah.ca" from 'nnmain.pem'
05[CFG] id 'nnmain.ezprovider.net' not confirmed by certificate,
defaulting to 'C=US, ST=CA, L=SanFrancisco, O=Fort-Funston,
CN=nnmain.ezprovider.net, e=he...@yeah.ca'
05[CFG] added configuration 'net-net'
10[NET] received packet: from 66.199.171.245[500] to 173.45.168.24[500]
10[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
10[IKE] 66.199.171.245 is initiating an IKE_SA
10[IKE] sending cert request for "C=US, ST=CA, L=SanFrancisco,
O=Fort-Funston, CN=tony1.ezp.net, e...@myhost.mydomain"
10[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP)
N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]
10[NET] sending packet: from 173.45.168.24[500] to 66.199.171.245[500]
11[NET] received packet: from 66.199.171.245[4500] to 173.45.168.24[4500]
11[ENC] parsed IKE_AUTH request 1 [ IDi CERT CERTREQ IDr AUTH SA TSi TSr
N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]
11[IKE] received cert request for "C=US, ST=CA, L=SanFrancisco,
O=Fort-Funston, CN=tony1.ezp.net, e...@myhost.mydomain"
11[IKE] received end entity cert "C=US, ST=CA, L=SanFrancisco,
O=Fort-Funston, CN=tony1.ezp.net, e...@myhost.mydomain"
11[CFG] looking for peer configs matching
173.45.168.24[nnmain.ezprovider.net]...66.199.171.245[C=US, ST=CA,
L=SanFrancisco, O=Fort-Funston, CN=tony1.ezp.net, e...@myhost.mydomain]
11[CFG] no matching peer config found
11[IKE] peer supports MOBIKE
11[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
11[NET] sending packet: from 173.45.168.24[4500] to 66.199.171.245[4500]
What am I doing wrong?
--
Anthony Moon
EZProvider Networks, Inc.
http://ezp.net
1.888.397.7853 x203
_______________________________________________
Users mailing list
Users@lists.strongswan.org
https://lists.strongswan.org/mailman/listinfo/users
