Hello,
I used strongSwan 4.5 on my Linux 2.6.28 device.
I get the following output:
r...@picopc7802:~# ipsec start
Starting strongSwan 4.5.0 IPsec [starter]...
Initializing XFRM netlink socket
r...@picopc7802:~# ipsec up panda
initiating IKE_SA panda[1] to 211.136.114.107
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
sending packet: from 192.168.1.198[500] to 211.136.114.107[500]
received packet: from 211.136.114.107[500] to 192.168.1.198[500]
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
local host is behind NAT, sending keep alives
establishing CHILD_SA panda
generating IKE_AUTH request 1 [ IDi IDr CP(ADDR DNS) SA TSi TSr N(MOBIKE_SUP)
N(NO_ADD_ADDR) N((40960)) ]
sending packet: from 192.168.1.198[4500] to 211.136.114.107[4500]
retransmit 1 of request with message ID 1
sending packet: from 192.168.1.198[4500] to 211.136.114.107[4500]
retransmit 2 of request with message ID 1
sending packet: from 192.168.1.198[4500] to 211.136.114.107[4500]
received packet: from 211.136.114.107[4500] to 192.168.1.198[4500]
parsed IKE_AUTH response 1 [ IDr EAP/REQ/AKA ]
server requested EAP_AKA authentication
allow mutual EAP-only authentication
generating IKE_AUTH request 2 [ EAP/RES/AKA ]
sending packet: from 192.168.1.198[4500] to 211.136.114.107[4500]
retransmit 1 of request with message ID 2
sending packet: from 192.168.1.198[4500] to 211.136.114.107[4500]
received packet: from 211.136.114.107[4500] to 192.168.1.198[4500]
parsed IKE_AUTH response 2 [ EAP/SUCC ]
EAP method EAP_AKA succeeded, MSK established
authentication of '[email protected]' (myself) with EAP
generating IKE_AUTH request 3 [ AUTH ]
sending packet: from 192.168.1.198[4500] to 211.136.114.107[4500]
received packet: from 211.136.114.107[4500] to 192.168.1.198[4500]
parsed IKE_AUTH response 3 [ AUTH CP(ADDR) SA TSi TSr ]
authentication of 'strongswan.org' with EAP successful
IKE_SA panda[1] established between
192.168.1.198[[email protected]]...211.136.114.107[strongswan.org]
scheduling reauthentication in 3323s
maximum IKE_SA lifetime 3503s
installing new virtual IP 172.16.64.58
received netlink error: Protocol not supported (93)
unable to add SAD entry with SPI c7684d6b
received netlink error: Protocol not supported (93)
unable to add SAD entry with SPI 08003ed1
unable to install inbound and outbound IPsec SA (SAD) in kernel.
r...@picopc7802:~# ipsec statusall
Status of IKEv2 charon daemon (strongSwan 4.5.0):
uptime: 4 minutes, since Jan 01 00:01:08 1970
malloc: sbrk 135168, mmap 0, used 69408, free 65760
worker threads: 9 idle of 16, job queue load: 0, scheduled events: 3
loaded plugins: aes des sha1 sha2 md5 random x509 revocation pubkey
pkcs1 pgp pem fips-prf gmp xcbc hmac attr kernel-netlink resolve socket-raw
stroke updown eap-aka eap-aka-3gpp2
Listening IP addresses:
192.168.1.198
Connections:
panda:
192.168.1.198...211.136.114.107
panda: local:
[[email protected]] uses EAP_AKA authentication with EAP identity
'460006000000219'
panda: remote:
[strongswan.org] uses any authentication
panda: child: dynamic
=== 172.16.64.0/24
Security Associations:
panda[1]: ESTABLISHED 3 minutes ago,
192.168.1.198[[email protected]]...211.136.114.107[strongswan.org]
panda[1]: IKE SPIs: 58a66da49298e7ac_i*
d1000007165230c8_r, EAP reauthentication in 51 minutes
panda[1]: IKE proposal:
3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
I have config kernel as:
http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules
Ipsec.config as follow:
config setup
# plutodebug=all
# crlcheckinterval=600
# strictcrlpolicy=yes
# cachecrls=yes
# nat_traversal=yes
# charonstart=no
plutostart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn panda
keyexchange=ikev2
left=%defaultroute
leftsourceip=%config
#leftcert=panda.pem
#leftnexthop=%direct
[email protected]
#leftid=460006000000280
eap_identity=460006000000219
#eap_identity=460006000000280
leftauth=eap-aka
#leftfirewall=yes
right=211.136.114.107
rightid=strongswan.org
#rightsubnet=172.16.64.0/24
#rightauth=pubkey
ike=3des-sha-modp1024
esp=3des-sha1
pfs=yes
auto=add
_______________________________________________
Users mailing list
[email protected]
https://lists.strongswan.org/mailman/listinfo/users
