No, I didn't change anything. Best regards!
Andy > -----Ursprüngliche Nachricht----- > Von: Andreas Steffen [mailto:[email protected]] > Gesendet: Dienstag, 28. Oktober 2014 11:59 > An: raceface; [email protected] > Betreff: Re: [strongSwan] Strongswan and WP8.1 > > Hi, > > now it seems that the lumia does not receive the IKE_SA_INIT response > message sent by the strongSwan server. Did you change anything in > the network setup? > > Regards > > Andreas > > On 10/28/2014 11:38 AM, raceface wrote: > > Hi Andreas, > > > > thanks for the feedback. The leftid is already set tot he FQDN of the > server > > "leftid=@FQDN of the server". I alo checked, if I had a typo error. > The > > server is reachable from the internet via the FQDN. > > > > I just removed the FQDN in the logs I sent through the list. > > > > Now the Lumia shows me the error 809, that the server didn't respond, > but > > there is a kind of communication between the lumia and strongswan: > > > > 10[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) > > N(NATD_D_IP) N(MULT_AUTH) ] > > 10[NET] sending packet: from removed IP[500] to removed IP[500] (308 > bytes) > > 08[NET] received packet: from remove IP[500] to removed IP[500] (616 > bytes) > > 08[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) > N(NATD_D_IP) V > > V V V ] > > 08[IKE] received retransmit of request with ID 0, retransmitting > response > > 08[NET] sending packet: from removed IP[500] to removed IP[500] (308 > bytes) > > 15[NET] received packet: from removed IP[500] to removed IP[500] (616 > bytes) > > 15[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) > N(NATD_D_IP) V > > V V V ] > > 15[IKE] received retransmit of request with ID 0, retransmitting > response > > 15[NET] sending packet: from removed IP[500] to removed IP[500] (308 > bytes) > > > > Andy > > > >> -----Ursprüngliche Nachricht----- > >> Von: Andreas Steffen [mailto:[email protected]] > >> Gesendet: Dienstag, 28. Oktober 2014 08:01 > >> An: raceface; [email protected] > >> Betreff: Re: [strongSwan] Strongswan and WP8.1 > >> > >> Hello Andy, > >> > >> see my inline comments. > >> > >> On 10/27/2014 10:24 PM, raceface wrote: > >>> Hi all, > >>> > >>> I installed strongswan 5.2 on Debian wheezy running on a KVM > machine. > >>> Strongswan is up and running and can be reached from outside. But > >> there > >>> seems to be something wrong with the certs. > >>> > >>> The ca.crt is created including > >>> > >>> basicConstraints = critical, CA:true > >>> extendedKeyUsage = serverAuth > >>> keyUsage = critical, keyCertSign, cRLSign > >>> > >>> and the server.crt is created including > >>> > >>> extendedKeyUsage = serverAuth > >>> subjectAltName = DNS:FQDN removed > >>> authorityKeyIdentifier=keyid > >>> > >> Server certificate seems ok if FQDN is contained as subjectAltName > >> and serverAuth EKU is set. > >> > >> CA certificate does not need serverAuth EKU but the presence > probably > >> does not do any harm. > >> > >>> The ca.crt is already installed on the lumia and a reboot is > >> performed. > >>> > >>> After starting strongswan with --nofork I get following messages: > >>> Starting strongSwan 5.2.0 IPsec [starter]... > >>> 00[DMN] Starting IKE charon daemon (strongSwan 5.2.0, Linux 3.2.0- > 4- > >> amd64, > >>> x86_64) > >>> 00[CFG] HA config misses local/remote address > >>> 00[LIB] plugin 'ha': failed to load - ha_plugin_create returned > NULL > >>> 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts' > >>> 00[CFG] loaded ca certificate "C=DE, ST=Some-State, O=andy, > >> CN=removed" > >>> from '/etc/ipsec.d/cacerts/ca.crt' > >>> 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts' > >>> 00[CFG] loading ocsp signer certificates from > >> '/etc/ipsec.d/ocspcerts' > >>> 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts' > >>> 00[CFG] loading crls from '/etc/ipsec.d/crls' > >>> 00[CFG] loading secrets from '/etc/ipsec.secrets' > >>> 00[CFG] loading secrets from > '/var/lib/strongswan/ipsec.secrets.inc' > >>> 00[CFG] loaded RSA private key from > >> '/etc/ipsec.d/private/server.key' > >>> 00[CFG] loaded EAP secret for "aceface2nd" > >>> 00[CFG] loaded 0 RADIUS server configurations > >>> 00[LIB] loaded plugins: charon aes rc2 sha1 sha2 md5 random nonce > >> x509 > >>> revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey > >> sshkey pem > >>> openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink > resolve > >>> socket-default farp stroke updown eap-identity eap-aka eap-md5 eap- > >> gtc > >>> eap-mschapv2 eap-radius eap-tls eap-ttls eap-tnc xauth-generic > xauth- > >> eap > >>> xauth-pam tnc-tnccs dhcp lookip error-notify certexpire led > addrblock > >> unity > >>> 00[LIB] unable to load 5 plugin features (5 due to unmet > >> dependencies) > >>> 00[LIB] dropped capabilities, running as uid 0, gid 0 > >>> 00[JOB] spawning 16 worker threads > >>> charon (3751) started after 60 ms > >>> 03[CFG] received stroke: add connection 'rw-mschapv2' > >>> 03[CFG] left nor right host is our side, assuming left=local > >>> 03[CFG] adding virtual IP address pool 10.0.0.0/24 > >>> 03[CFG] loaded certificate "C=DE, ST=Some-State, O=andy, > >> CN=removed" from > >>> 'server.crt' > >>> 03[CFG] id 'removed' not confirmed by certificate, defaulting to > >> 'C=DE, > >>> ST=Some-State, O=andy, CN=removed' > >> You have to set leftid=<FQDN of the server> as contained in the > >> subjectAltName of the certificate, because by default leftid is set > to > >> the IP address defined by left which in your case is %any. > >> > >>> 03[CFG] added configuration 'rw-mschapv2' > >>> 01[CFG] received stroke: initiate 'rw-mschapv2' > >>> 01[IKE] unable to resolve %any, initiate aborted > >>> 01[MGR] tried to check-in and delete nonexisting IKE_SA > >>> 09[NET] received packet: from removed[500] to removed[500] (616 > >> bytes) > >>> 09[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) > >> N(NATD_D_IP) V > >>> V V V ] > >>> 09[ENC] received unknown vendor ID: > >>> 1e:2b:51:69:05:99:1c:7d:7c:96:fc:bf:b5:87:e4:61:00:00:00:09 > >>> 09[ENC] received unknown vendor ID: > >>> fb:1d:e3:cd:f3:41:b7:ea:16:b7:e5:be:08:55:f1:20 > >>> 09[ENC] received unknown vendor ID: > >>> 26:24:4d:38:ed:db:61:b3:17:2a:36:e3:d0:cf:b8:19 > >>> 09[ENC] received unknown vendor ID: > >>> 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:02 > >>> 09[IKE] removed is initiating an IKE_SA > >>> 09[IKE] remote host is behind NAT > >>> 09[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) > >>> N(NATD_D_IP) N(MULT_AUTH) ] > >>> 09[NET] sending packet: from removed[500] to removed[500] (308 > bytes) > >>> 07[NET] received packet: from removed[17224] to removed[4500] (1324 > >> bytes) > >>> 07[ENC] parsed IKE_AUTH request 1 [ IDi CERTREQ N(MOBIKE_SUP) > >> CPRQ(ADDR DNS > >>> NBNS SRV ADDR6 DNS6 SRV6) SA TSi TSr ] > >>> 07[IKE] received cert request for "C=DE, ST=Some-State, O=andy, > >> CN=removed" > >>> 07[IKE] received 49 cert requests for an unknown ca > >>> 07[CFG] looking for peer configs matching > >> removed[%any]...removed[removed] > >>> 07[CFG] selected peer config 'rw-mschapv2' > >>> 07[IKE] initiating EAP_IDENTITY method (id 0x00) > >>> 07[IKE] peer supports MOBIKE > >>> 07[IKE] authentication of 'C=DE, ST=Some-State, O=andy, CN=removed' > >> (myself) > >>> with RSA signature successful > >>> 07[IKE] sending end entity cert "C=DE, ST=Some-State, O=andy, > >> CN=removed" > >>> 07[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ] > >>> 07[NET] sending packet: from removed[4500] to removed[17224] (932 > >> bytes) > >>> 02[JOB] deleting half open IKE_SA after timeout > >>> > >>> The lumia is quitting the job with error message 13801. > >> The Lumia has a problem either with the digital signature, the > server > >> ID, > >> the server certificate or the CA certificate. For the actual reason > you > >> have to look on the Lumia side. Error message 13801 does not really > >> help. > >> > >>> Any hints what I need to do for correction? I am wondering that > >> strongswan > >>> is loggin "id . . . not confirmed by certificate" while starting > and > >> "unable > >>> to resolve %any". > >>> > >>> Thanks for your help! > >>> > >>> Andy > >> > >> Best regards > >> > >> Andreas > >> > >> > ====================================================================== > >> Andreas Steffen > [email protected] > >> strongSwan - the Open Source VPN Solution! > www.strongswan.org > >> Institute for Internet Technologies and Applications > >> University of Applied Sciences Rapperswil > >> CH-8640 Rapperswil (Switzerland) > >> ===========================================================[ITA- > HSR]== > > > > > > _______________________________________________ > > Users mailing list > > [email protected] > > https://lists.strongswan.org/mailman/listinfo/users > > > > -- > ====================================================================== > Andreas Steffen [email protected] > strongSwan - the Open Source VPN Solution! www.strongswan.org > Institute for Internet Technologies and Applications > University of Applied Sciences Rapperswil > CH-8640 Rapperswil (Switzerland) > ===========================================================[ITA-HSR]== _______________________________________________ Users mailing list [email protected] https://lists.strongswan.org/mailman/listinfo/users
