Hi Tobias, On 03/11/16 10:03, Tobias Brunner wrote: > > One potential issue I hadn't considered so far is that while the client > is asleep the mapping on the NAT router might time out (it probably does > not send keepalives while asleep). So when it reconnects it will do so > from different source ports from the server's point of view. Due to > that the reauthentication detection will not recognize the new SA as > reauthentication attempt and therefore not migrate the previous virtual > IP. So you'd end up in the same situation as before (i.e. the traffic > selectors don't match and the CHILD_SA can't be established). Try to > compare the client's source ports to see if that's what happens here. >
I managed to configure my gateway at home to keep the mapped port number
(UDP) for 24h. This is the code for OpenBSD 5.8 packet filter:
:
pass in quick on intern proto udp from (intern:network) to <peers> port isakmp
tag RED_INET_IPSEC keep state (if-bound, max 256, udp.multiple 86400)
pass in quick on intern proto udp from (intern:network) to <peers> port
ipsec-nat-t tag RED_INET_IPSEC keep state (if-bound, max 256, udp.multiple
86400)
pass out quick on egress tagged RED_INET_IPSEC
:
Maybe 24h is not reasonable, but at least this fixes the lost
UDP port number for now.
Problem is: Now it fails on the left side with "received quick mode
request for unestablished IKE_SA, ignored" (see the attached logfile).
:
Mar 12 11:55:12 srvl047 charon: 26[IKE] authentication of 'gate1.example.com'
(myself) successful
Mar 12 11:55:12 srvl047 charon: 26[IKE] queueing XAUTH task
Mar 12 11:55:12 srvl047 charon: 26[IKE] sending end entity cert "C=DE, ST=NRW,
L=Aachen, O=example AG, CN=gate1.example.com/[email protected]"
Mar 12 11:55:12 srvl047 charon: 26[IKE] sending issuer cert "C=DE, O=example
AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:55:12 srvl047 charon: 26[ENC] generating ID_PROT response 0 [ ID CERT
CERT SIG ]
Mar 12 11:55:12 srvl047 charon: 26[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361] (3708 bytes)
Mar 12 11:55:12 srvl047 charon: 26[IKE] activating new tasks
Mar 12 11:55:12 srvl047 charon: 26[IKE] activating XAUTH task
Mar 12 11:55:12 srvl047 charon: 03[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361]
Mar 12 11:55:12 srvl047 charon: 26[IKE] Hash => 20 bytes @ 0x7f3e1c0069b0
Mar 12 11:55:12 srvl047 charon: 26[IKE] 0: 41 2B 58 8B BA C5 FD 1D B2 8F CC
78 F0 83 D9 39 A+X........x...9
Mar 12 11:55:12 srvl047 charon: 26[IKE] 16: 16 01 44 94
..D.
Mar 12 11:55:12 srvl047 charon: 26[ENC] generating TRANSACTION request 34192379
[ HASH CPRQ(X_USER X_PWD) ]
Mar 12 11:55:12 srvl047 charon: 26[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361] (76 bytes)
Mar 12 11:55:12 srvl047 charon: 03[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361]
Mar 12 11:55:13 srvl047 charon: 02[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500]
Mar 12 11:55:13 srvl047 charon: 02[NET] waiting for data on sockets
Mar 12 11:55:13 srvl047 charon: 20[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500] (300 bytes)
Mar 12 11:55:13 srvl047 charon: 20[ENC] parsed QUICK_MODE request 3495102926 [
HASH SA No ID ID ]
Mar 12 11:55:13 srvl047 charon: 20[IKE] Hash(1) => 20 bytes @ 0x7f3e34010fb0
Mar 12 11:55:13 srvl047 charon: 20[IKE] 0: 49 7A 47 EE F1 2F B4 F7 D2 8A 1D
BB DC 8B CC 9F IzG../..........
Mar 12 11:55:13 srvl047 charon: 20[IKE] 16: C0 D9 32 69
..2i
Mar 12 11:55:13 srvl047 charon: 20[IKE] received quick mode request for
unestablished IKE_SA, ignored
Mar 12 11:55:13 srvl047 charon: 20[IKE] IKE_SA CiscoIPSec[178] state change:
CONNECTING => DESTROYING
I have no idea why the Mac opens a new session now, instead of relying
upon the old IKE_SA, but it seems to me that the Mac missed to send
xauth info. Is this correct?
Every helpful suggestion is highly welcome
Regards
Harri
Mar 12 11:20:37 srvl047 charon: 02[NET] received packet: from
192.168.0.17[53195] to 10.0.0.17[500]
Mar 12 11:20:37 srvl047 charon: 02[NET] waiting for data on sockets
Mar 12 11:20:37 srvl047 charon: 20[NET] received packet: from
192.168.0.17[53195] to 10.0.0.17[500] (668 bytes)
Mar 12 11:20:37 srvl047 charon: 20[ENC] parsed ID_PROT request 0 [ SA V V V V V
V V V V V V V V V ]
Mar 12 11:20:37 srvl047 charon: 20[CFG] looking for an ike config for
10.0.0.17...192.168.0.17
Mar 12 11:20:37 srvl047 charon: 20[CFG] ike config match: 0 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:20:37 srvl047 charon: 20[CFG] ike config match: 0 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:20:37 srvl047 charon: 20[CFG] ike config match: 1052 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:20:37 srvl047 charon: 20[CFG] candidate: gate1.example.com...%any,
prio 1052
Mar 12 11:20:37 srvl047 charon: 20[CFG] ike config match: 1052 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:20:37 srvl047 charon: 20[CFG] candidate: gate1.example.com...%any,
prio 1052
Mar 12 11:20:37 srvl047 charon: 20[CFG] ike config match: 0 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:20:37 srvl047 charon: 20[CFG] found matching ike config:
gate1.example.com...%any with prio 1052
Mar 12 11:20:37 srvl047 charon: 20[IKE] received NAT-T (RFC 3947) vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] received draft-ietf-ipsec-nat-t-ike
vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] received draft-ietf-ipsec-nat-t-ike-08
vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] received draft-ietf-ipsec-nat-t-ike-07
vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] received draft-ietf-ipsec-nat-t-ike-06
vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] received draft-ietf-ipsec-nat-t-ike-05
vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] received draft-ietf-ipsec-nat-t-ike-04
vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] received draft-ietf-ipsec-nat-t-ike-03
vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] received draft-ietf-ipsec-nat-t-ike-02
vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] received
draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] received XAuth vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] received Cisco Unity vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] received FRAGMENTATION vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] received DPD vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] 192.168.0.17 is initiating a Main Mode
IKE_SA
Mar 12 11:20:37 srvl047 charon: 20[IKE] IKE_SA (unnamed)[171] state change:
CREATED => CONNECTING
Mar 12 11:20:37 srvl047 charon: 20[CFG] selecting proposal:
Mar 12 11:20:37 srvl047 charon: 20[CFG] proposal matches
Mar 12 11:20:37 srvl047 charon: 20[CFG] received proposals:
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536,
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024,
IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024,
IKE:AES_CBC_256/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1536,
IKE:AES_CBC_256/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024,
IKE:AES_CBC_128/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024,
IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024,
IKE:3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024,
IKE:DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024,
IKE:DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024
Mar 12 11:20:37 srvl047 charon: 20[CFG] configured proposals:
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
Mar 12 11:20:37 srvl047 charon: 20[CFG] selected proposal:
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
Mar 12 11:20:37 srvl047 charon: 20[IKE] sending strongSwan vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] sending XAuth vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] sending DPD vendor ID
Mar 12 11:20:37 srvl047 charon: 20[IKE] sending NAT-T (RFC 3947) vendor ID
Mar 12 11:20:37 srvl047 charon: 20[ENC] generating ID_PROT response 0 [ SA V V
V V ]
Mar 12 11:20:37 srvl047 charon: 20[NET] sending packet: from 10.0.0.17[500] to
192.168.0.17[53195] (156 bytes)
Mar 12 11:20:37 srvl047 charon: 03[NET] sending packet: from 10.0.0.17[500] to
192.168.0.17[53195]
Mar 12 11:20:37 srvl047 charon: 02[NET] received packet: from
192.168.0.17[53195] to 10.0.0.17[500]
Mar 12 11:20:37 srvl047 charon: 02[NET] waiting for data on sockets
Mar 12 11:20:37 srvl047 charon: 29[NET] received packet: from
192.168.0.17[53195] to 10.0.0.17[500] (292 bytes)
Mar 12 11:20:37 srvl047 charon: 29[ENC] parsed ID_PROT request 0 [ KE No NAT-D
NAT-D ]
Mar 12 11:20:37 srvl047 charon: 29[IKE] natd_chunk => 22 bytes @ 0x7f3e85aadb70
Mar 12 11:20:37 srvl047 charon: 29[IKE] 0: 1F 6A CC 5B 3E A8 17 9B CE 57 96
23 65 F5 9B 9C .j.[>....W.#e...
Mar 12 11:20:37 srvl047 charon: 29[IKE] 16: 05 91 8E 11 01 F4
......
Mar 12 11:20:37 srvl047 charon: 29[IKE] natd_hash => 20 bytes @ 0x7f3e18004c30
Mar 12 11:20:37 srvl047 charon: 29[IKE] 0: DE 33 B8 01 FB 14 F2 9C 51 69 4C
53 9B CC A8 03 .3......QiLS....
Mar 12 11:20:37 srvl047 charon: 29[IKE] 16: D9 3B 88 F1
.;..
Mar 12 11:20:37 srvl047 charon: 29[IKE] natd_chunk => 22 bytes @ 0x7f3e85aadb70
Mar 12 11:20:37 srvl047 charon: 29[IKE] 0: 1F 6A CC 5B 3E A8 17 9B CE 57 96
23 65 F5 9B 9C .j.[>....W.#e...
Mar 12 11:20:37 srvl047 charon: 29[IKE] 16: D9 EB 92 11 CF CB
......
Mar 12 11:20:37 srvl047 charon: 29[IKE] natd_hash => 20 bytes @ 0x7f3e18004c50
Mar 12 11:20:37 srvl047 charon: 29[IKE] 0: 84 86 EC D6 50 72 C0 B5 3F DA E3
8F 6D D8 59 A8 ....Pr..?...m.Y.
Mar 12 11:20:37 srvl047 charon: 29[IKE] 16: 79 2A 4E 3E
y*N>
Mar 12 11:20:37 srvl047 charon: 29[IKE] precalculated src_hash => 20 bytes @
0x7f3e18004c50
Mar 12 11:20:37 srvl047 charon: 29[IKE] 0: 84 86 EC D6 50 72 C0 B5 3F DA E3
8F 6D D8 59 A8 ....Pr..?...m.Y.
Mar 12 11:20:37 srvl047 charon: 29[IKE] 16: 79 2A 4E 3E
y*N>
Mar 12 11:20:37 srvl047 charon: 29[IKE] precalculated dst_hash => 20 bytes @
0x7f3e18004c30
Mar 12 11:20:37 srvl047 charon: 29[IKE] 0: DE 33 B8 01 FB 14 F2 9C 51 69 4C
53 9B CC A8 03 .3......QiLS....
Mar 12 11:20:37 srvl047 charon: 29[IKE] 16: D9 3B 88 F1
.;..
Mar 12 11:20:37 srvl047 charon: 29[IKE] received dst_hash => 20 bytes @
0x7f3e18000bd0
Mar 12 11:20:37 srvl047 charon: 29[IKE] 0: DE 33 B8 01 FB 14 F2 9C 51 69 4C
53 9B CC A8 03 .3......QiLS....
Mar 12 11:20:37 srvl047 charon: 29[IKE] 16: D9 3B 88 F1
.;..
Mar 12 11:20:37 srvl047 charon: 29[IKE] received src_hash => 20 bytes @
0x7f3e1800a7f0
Mar 12 11:20:37 srvl047 charon: 29[IKE] 0: 01 8F 8D BE B3 A5 E8 11 E1 0F D7
AA 62 D3 4F 1C ............b.O.
Mar 12 11:20:37 srvl047 charon: 29[IKE] 16: D2 1E 98 FC
....
Mar 12 11:20:37 srvl047 charon: 29[IKE] remote host is behind NAT
Mar 12 11:20:37 srvl047 charon: 29[IKE] sending cert request for "C=DE,
O=example AG, OU=example Certificate Authority, CN=example Root CA"
Mar 12 11:20:37 srvl047 charon: 29[IKE] sending cert request for "C=DE, ST=NRW,
L=Aachen, O=example AG, OU=TI, CN=IPsec_ca, [email protected]"
Mar 12 11:20:37 srvl047 charon: 29[IKE] sending cert request for "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:20:37 srvl047 charon: 29[IKE] natd_chunk => 22 bytes @ 0x7f3e85aadb90
Mar 12 11:20:37 srvl047 charon: 29[IKE] 0: 1F 6A CC 5B 3E A8 17 9B CE 57 96
23 65 F5 9B 9C .j.[>....W.#e...
Mar 12 11:20:37 srvl047 charon: 29[IKE] 16: D9 EB 92 11 CF CB
......
Mar 12 11:20:37 srvl047 charon: 29[IKE] natd_hash => 20 bytes @ 0x7f3e1800a790
Mar 12 11:20:37 srvl047 charon: 29[IKE] 0: 84 86 EC D6 50 72 C0 B5 3F DA E3
8F 6D D8 59 A8 ....Pr..?...m.Y.
Mar 12 11:20:37 srvl047 charon: 29[IKE] 16: 79 2A 4E 3E
y*N>
Mar 12 11:20:37 srvl047 charon: 29[IKE] natd_chunk => 22 bytes @ 0x7f3e85aadb90
Mar 12 11:20:37 srvl047 charon: 29[IKE] 0: 1F 6A CC 5B 3E A8 17 9B CE 57 96
23 65 F5 9B 9C .j.[>....W.#e...
Mar 12 11:20:37 srvl047 charon: 29[IKE] 16: 05 91 8E 11 01 F4
......
Mar 12 11:20:37 srvl047 charon: 29[IKE] natd_hash => 20 bytes @ 0x7f3e18002c60
Mar 12 11:20:37 srvl047 charon: 29[IKE] 0: DE 33 B8 01 FB 14 F2 9C 51 69 4C
53 9B CC A8 03 .3......QiLS....
Mar 12 11:20:37 srvl047 charon: 29[IKE] 16: D9 3B 88 F1
.;..
Mar 12 11:20:37 srvl047 charon: 29[ENC] generating ID_PROT response 0 [ KE No
CERTREQ CERTREQ CERTREQ NAT-D NAT-D ]
Mar 12 11:20:37 srvl047 charon: 29[NET] sending packet: from 10.0.0.17[500] to
192.168.0.17[53195] (653 bytes)
Mar 12 11:20:37 srvl047 charon: 03[NET] sending packet: from 10.0.0.17[500] to
192.168.0.17[53195]
Mar 12 11:20:37 srvl047 charon: 02[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500]
Mar 12 11:20:37 srvl047 charon: 02[NET] waiting for data on sockets
Mar 12 11:20:37 srvl047 charon: 26[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500] (2236 bytes)
Mar 12 11:20:37 srvl047 charon: 26[ENC] parsed ID_PROT request 0 [ ID CERT SIG
CERTREQ N(INITIAL_CONTACT) ]
Mar 12 11:20:37 srvl047 charon: 26[IKE] ignoring certificate request without
data
Mar 12 11:20:37 srvl047 charon: 26[IKE] received end entity cert "C=DE,
O=example AG, OU=TI, CN=ppcm018.ws.example.com"
Mar 12 11:20:37 srvl047 charon: 26[CFG] looking for XAuthInitRSA peer configs
matching 10.0.0.17...192.168.0.17[C=DE, O=example AG, OU=TI,
CN=ppcm018.ws.example.com]
Mar 12 11:20:37 srvl047 charon: 26[CFG] peer config match local: 1 (ID_ANY)
Mar 12 11:20:37 srvl047 charon: 26[CFG] peer config match remote: 1
(ID_DER_ASN1_DN ->
30:4d:31:0b:30:09:06:03:55:04:06:13:02:44:45:31:12:30:10:06:03:55:04:0a:13:09:61:69:78:69:67:6f:20:41:47:31:0b:30:09:06:03:55:04:0b:13:02:54:49:31:1d:30:1b:06:03:55:04:03:13:14:70:70:63:6d:30:31:38:2e:77:73:2e:61:69:78:69:67:6f:2e:64:65)
Mar 12 11:20:37 srvl047 charon: 26[CFG] ike config match: 0 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:20:37 srvl047 charon: 26[CFG] peer config match local: 1 (ID_ANY)
Mar 12 11:20:37 srvl047 charon: 26[CFG] peer config match remote: 1
(ID_DER_ASN1_DN ->
30:4d:31:0b:30:09:06:03:55:04:06:13:02:44:45:31:12:30:10:06:03:55:04:0a:13:09:61:69:78:69:67:6f:20:41:47:31:0b:30:09:06:03:55:04:0b:13:02:54:49:31:1d:30:1b:06:03:55:04:03:13:14:70:70:63:6d:30:31:38:2e:77:73:2e:61:69:78:69:67:6f:2e:64:65)
Mar 12 11:20:37 srvl047 charon: 26[CFG] ike config match: 0 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:20:37 srvl047 charon: 26[CFG] peer config match local: 1 (ID_ANY)
Mar 12 11:20:37 srvl047 charon: 26[CFG] peer config match remote: 1
(ID_DER_ASN1_DN ->
30:4d:31:0b:30:09:06:03:55:04:06:13:02:44:45:31:12:30:10:06:03:55:04:0a:13:09:61:69:78:69:67:6f:20:41:47:31:0b:30:09:06:03:55:04:0b:13:02:54:49:31:1d:30:1b:06:03:55:04:03:13:14:70:70:63:6d:30:31:38:2e:77:73:2e:61:69:78:69:67:6f:2e:64:65)
Mar 12 11:20:37 srvl047 charon: 26[CFG] ike config match: 1052 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:20:37 srvl047 charon: 26[CFG] candidate "CiscoIPSec", match:
1/1/1052 (me/other/ike)
Mar 12 11:20:37 srvl047 charon: 26[CFG] peer config match local: 1 (ID_ANY)
Mar 12 11:20:37 srvl047 charon: 26[CFG] peer config match remote: 1
(ID_DER_ASN1_DN ->
30:4d:31:0b:30:09:06:03:55:04:06:13:02:44:45:31:12:30:10:06:03:55:04:0a:13:09:61:69:78:69:67:6f:20:41:47:31:0b:30:09:06:03:55:04:0b:13:02:54:49:31:1d:30:1b:06:03:55:04:03:13:14:70:70:63:6d:30:31:38:2e:77:73:2e:61:69:78:69:67:6f:2e:64:65)
Mar 12 11:20:37 srvl047 charon: 26[CFG] ike config match: 1052 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:20:37 srvl047 charon: 26[CFG] candidate "CiscoIPSec-pam", match:
1/1/1052 (me/other/ike)
Mar 12 11:20:37 srvl047 charon: 26[CFG] peer config match local: 1 (ID_ANY)
Mar 12 11:20:37 srvl047 charon: 26[CFG] peer config match remote: 0
(ID_DER_ASN1_DN ->
30:4d:31:0b:30:09:06:03:55:04:06:13:02:44:45:31:12:30:10:06:03:55:04:0a:13:09:61:69:78:69:67:6f:20:41:47:31:0b:30:09:06:03:55:04:0b:13:02:54:49:31:1d:30:1b:06:03:55:04:03:13:14:70:70:63:6d:30:31:38:2e:77:73:2e:61:69:78:69:67:6f:2e:64:65)
Mar 12 11:20:37 srvl047 charon: 26[CFG] ike config match: 0 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:20:37 srvl047 charon: 26[CFG] selected peer config "CiscoIPSec"
Mar 12 11:20:37 srvl047 charon: 26[IKE] HASH_I data => 843 bytes @
0x7f3e1c0094f0
Mar 12 11:20:37 srvl047 charon: 26[IKE] 0: 59 72 C8 3F 62 C4 89 19 52 23 61
C6 D3 D6 3A D1 Yr.?b...R#a...:.
Mar 12 11:20:37 srvl047 charon: 26[IKE] 16: 08 30 6F E1 9A F7 3C FA 1D 9A 74
34 83 3E 12 7A .0o...<...t4.>.z
:
:
Mar 12 11:20:37 srvl047 charon: 26[IKE] 816: 06 03 55 04 03 13 14 70 70 63 6D
30 31 38 2E 77 ..U....ppcm018.w
Mar 12 11:20:37 srvl047 charon: 26[IKE] 832: 73 2E 61 69 78 69 67 6F 2E 64 65
s.example.com
Mar 12 11:20:37 srvl047 charon: 26[IKE] HASH_I => 20 bytes @ 0x7f3e1c008f10
Mar 12 11:20:37 srvl047 charon: 26[IKE] 0: ED FD E4 91 CE FF 03 D8 5A 78 A6
13 1E 8B FA 70 ........Zx.....p
Mar 12 11:20:37 srvl047 charon: 26[IKE] 16: 55 2A B4 9F
U*..
Mar 12 11:20:37 srvl047 charon: 26[CFG] using certificate "C=DE, O=example
AG, OU=TI, CN=ppcm018.ws.example.com"
Mar 12 11:20:37 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=TI, CN=ppcm018.ws.example.com" key: 2048 bit RSA
Mar 12 11:20:37 srvl047 charon: 26[CFG] using trusted intermediate ca
certificate "C=DE, O=example AG, OU=example Certificate Authority,
CN=ws-example-CA"
Mar 12 11:20:37 srvl047 charon: 26[CFG] checking certificate status of "C=DE,
O=example AG, OU=TI, CN=ppcm018.ws.example.com"
Mar 12 11:20:37 srvl047 charon: 26[CFG] ocsp check skipped, no ocsp found
Mar 12 11:20:37 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=ws-example-CA" key: 4096 bit RSA
Mar 12 11:20:37 srvl047 charon: 26[CFG] using trusted ca certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=example Root CA"
Mar 12 11:20:37 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=example Root CA" key: 4096 bit RSA
Mar 12 11:20:37 srvl047 charon: 26[CFG] reached self-signed root ca with a
path length of 0
Mar 12 11:20:37 srvl047 charon: 26[CFG] using trusted certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:20:37 srvl047 charon: 26[CFG] crl correctly signed by "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:20:37 srvl047 charon: 26[CFG] crl is valid: until Mar 15 08:42:47
2016
Mar 12 11:20:37 srvl047 charon: 26[CFG] using cached crl
Mar 12 11:20:37 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=ws-example-CA" key: 4096 bit RSA
Mar 12 11:20:37 srvl047 charon: 26[CFG] using trusted ca certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=example Root CA"
Mar 12 11:20:37 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=example Root CA" key: 4096 bit RSA
Mar 12 11:20:37 srvl047 charon: 26[CFG] reached self-signed root ca with a
path length of 0
Mar 12 11:20:37 srvl047 charon: 26[CFG] using trusted certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:20:37 srvl047 charon: 26[CFG] crl correctly signed by "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:20:37 srvl047 charon: 26[CFG] crl is stale: since Mar 12 08:42:47
2016
Mar 12 11:20:37 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=ws-example-CA" key: 4096 bit RSA
Mar 12 11:20:37 srvl047 charon: 26[CFG] using trusted ca certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=example Root CA"
Mar 12 11:20:37 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=example Root CA" key: 4096 bit RSA
Mar 12 11:20:37 srvl047 charon: 26[CFG] reached self-signed root ca with a
path length of 0
Mar 12 11:20:37 srvl047 charon: 26[CFG] using trusted certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:20:37 srvl047 charon: 26[CFG] crl correctly signed by "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:20:37 srvl047 charon: 26[LIB] crl #01:2d is newer - existing crl
#01:2c replaced
Mar 12 11:20:37 srvl047 charon: 26[CFG] crl is valid: until Mar 13 08:42:47
2016
Mar 12 11:20:37 srvl047 charon: 26[CFG] using cached crl
Mar 12 11:20:37 srvl047 charon: 26[CFG] certificate status is good
Mar 12 11:20:37 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=ws-example-CA" key: 4096 bit RSA
Mar 12 11:20:37 srvl047 charon: 26[CFG] using trusted ca certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=example Root CA"
Mar 12 11:20:37 srvl047 charon: 26[CFG] checking certificate status of "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:20:37 srvl047 charon: 26[CFG] ocsp check skipped, no ocsp found
Mar 12 11:20:37 srvl047 charon: 26[CFG] using trusted certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=example Root CA"
Mar 12 11:20:37 srvl047 charon: 26[CFG] crl correctly signed by "C=DE,
O=example AG, OU=example Certificate Authority, CN=example Root CA"
Mar 12 11:20:37 srvl047 charon: 26[CFG] crl is valid: until Dec 20 11:33:09
2045
Mar 12 11:20:37 srvl047 charon: 26[CFG] using cached crl
Mar 12 11:20:37 srvl047 charon: 26[CFG] certificate status is good
Mar 12 11:20:37 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=example Root CA" key: 4096 bit RSA
Mar 12 11:20:37 srvl047 charon: 26[CFG] reached self-signed root ca with a
path length of 1
Mar 12 11:20:37 srvl047 charon: 26[IKE] authentication of 'C=DE, O=example AG,
OU=TI, CN=ppcm018.ws.example.com' with RSA successful
Mar 12 11:20:37 srvl047 charon: 26[IKE] HASH_R data => 783 bytes @
0x7f3e1c00a090
Mar 12 11:20:37 srvl047 charon: 26[IKE] 0: F2 C3 44 93 31 64 9E 73 35 AA C8
E2 16 AB 45 23 ..D.1d.s5.....E#
Mar 12 11:20:37 srvl047 charon: 26[IKE] 16: 14 3F 04 56 8E D3 6C 82 CE FF 81
A7 F2 A4 F9 48 .?.V..l........H
:
:
Mar 12 11:20:37 srvl047 charon: 26[IKE] 752: 80 02 00 01 80 04 00 02 02 00 00
00 73 74 61 72 ............gate
Mar 12 11:20:37 srvl047 charon: 26[IKE] 768: 67 61 74 65 2E 61 69 78 69 67 6F
2E 63 6F 6D 1.example.com
Mar 12 11:20:37 srvl047 charon: 26[IKE] HASH_R => 20 bytes @ 0x7f3e1c0019a0
Mar 12 11:20:37 srvl047 charon: 26[IKE] 0: A3 18 80 DF 71 4C 2C 92 80 85 ED
DA 15 48 AF 32 ....qL,......H.2
Mar 12 11:20:37 srvl047 charon: 26[IKE] 16: 69 E3 5F F4
i._.
Mar 12 11:20:37 srvl047 charon: 26[IKE] authentication of 'gate1.example.com'
(myself) successful
Mar 12 11:20:37 srvl047 charon: 26[IKE] queueing XAUTH task
Mar 12 11:20:37 srvl047 charon: 26[IKE] sending end entity cert "C=DE, ST=NRW,
L=Aachen, O=example AG, CN=gate1.example.com/[email protected]"
Mar 12 11:20:37 srvl047 charon: 26[IKE] sending issuer cert "C=DE, O=example
AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:20:37 srvl047 charon: 26[ENC] generating ID_PROT response 0 [ ID CERT
CERT SIG ]
Mar 12 11:20:37 srvl047 charon: 26[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361] (3708 bytes)
Mar 12 11:20:37 srvl047 charon: 26[IKE] activating new tasks
Mar 12 11:20:37 srvl047 charon: 26[IKE] activating XAUTH task
Mar 12 11:20:37 srvl047 charon: 03[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361]
Mar 12 11:20:37 srvl047 charon: 26[IKE] Hash => 20 bytes @ 0x7f3e1c003c80
Mar 12 11:20:37 srvl047 charon: 26[IKE] 0: 15 E7 87 CD 6B 1D 67 11 2D 7C 26
74 32 11 A9 5F ....k.g.-|&t2.._
Mar 12 11:20:37 srvl047 charon: 26[IKE] 16: DC C5 3E E5
..>.
Mar 12 11:20:37 srvl047 charon: 26[ENC] generating TRANSACTION request
2917824958 [ HASH CPRQ(X_USER X_PWD) ]
Mar 12 11:20:37 srvl047 charon: 26[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361] (76 bytes)
Mar 12 11:20:37 srvl047 charon: 03[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361]
Mar 12 11:20:37 srvl047 charon: 02[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500]
Mar 12 11:20:37 srvl047 charon: 02[NET] waiting for data on sockets
Mar 12 11:20:37 srvl047 charon: 19[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500] (92 bytes)
Mar 12 11:20:37 srvl047 charon: 19[ENC] parsed TRANSACTION response 2917824958
[ HASH CPRP(X_USER X_PWD) ]
Mar 12 11:20:37 srvl047 charon: 19[IKE] Hash => 20 bytes @ 0x7f3e40001980
Mar 12 11:20:37 srvl047 charon: 19[IKE] 0: EB C0 B5 BE 1B 2D B6 65 C3 0F E8
45 D8 13 CE 84 .....-.e...E....
Mar 12 11:20:37 srvl047 charon: 19[IKE] 16: 13 D5 0F B0
....
Mar 12 11:20:37 srvl047 charon: 19[IKE] XAuth authentication of 'ppcm018'
successful
Mar 12 11:20:37 srvl047 charon: 19[IKE] reinitiating already active tasks
Mar 12 11:20:37 srvl047 charon: 19[IKE] XAUTH task
Mar 12 11:20:37 srvl047 charon: 19[IKE] Hash => 20 bytes @ 0x7f3e40000b70
Mar 12 11:20:37 srvl047 charon: 19[IKE] 0: 05 04 9E 93 74 64 B5 E7 2B CB DB
86 25 8F 01 3E ....td..+...%..>
Mar 12 11:20:37 srvl047 charon: 19[IKE] 16: BD 5D 33 56
.]3V
Mar 12 11:20:37 srvl047 charon: 19[ENC] generating TRANSACTION request
1618005064 [ HASH CPS(X_STATUS) ]
Mar 12 11:20:37 srvl047 charon: 19[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361] (76 bytes)
Mar 12 11:20:37 srvl047 charon: 03[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361]
Mar 12 11:20:37 srvl047 charon: 02[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500]
Mar 12 11:20:37 srvl047 charon: 02[NET] waiting for data on sockets
Mar 12 11:20:37 srvl047 charon: 13[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500] (76 bytes)
Mar 12 11:20:37 srvl047 charon: 13[ENC] parsed TRANSACTION response 1618005064
[ HASH CPA(X_STATUS) ]
Mar 12 11:20:37 srvl047 charon: 13[IKE] Hash => 20 bytes @ 0x7f3e58004420
Mar 12 11:20:37 srvl047 charon: 13[IKE] 0: 85 F7 8F C4 AB 1E A5 B1 EA 4A 3D
7F AE E5 9F D4 .........J=.....
Mar 12 11:20:37 srvl047 charon: 13[IKE] 16: 0D 04 EB 53
...S
Mar 12 11:20:37 srvl047 charon: 13[IKE] IKE_SA CiscoIPSec[171] established
between 10.0.0.17[gate1.example.com]...192.168.0.17[C=DE, O=example AG, OU=TI,
CN=ppcm018.ws.example.com]
Mar 12 11:20:37 srvl047 charon: 13[IKE] IKE_SA CiscoIPSec[171] state change:
CONNECTING => ESTABLISHED
Mar 12 11:20:37 srvl047 charon: 13[IKE] scheduling reauthentication in 10004s
Mar 12 11:20:37 srvl047 charon: 13[IKE] maximum IKE_SA lifetime 10544s
Mar 12 11:20:37 srvl047 charon: 13[IKE] activating new tasks
Mar 12 11:20:37 srvl047 charon: 13[IKE] nothing to initiate
Mar 12 11:20:37 srvl047 charon: 02[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500]
Mar 12 11:20:37 srvl047 charon: 02[NET] waiting for data on sockets
Mar 12 11:20:37 srvl047 charon: 28[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500] (172 bytes)
Mar 12 11:20:37 srvl047 charon: 28[ENC] unknown attribute type (28683)
Mar 12 11:20:37 srvl047 charon: 28[ENC] parsed TRANSACTION request 2316792513 [
HASH CPRQ(ADDR MASK DNS NBNS EXP VER U_BANNER U_DEFDOM U_SPLITDNS U_SPLITINC
U_LOCALLAN U_PFS U_SAVEPWD U_FWTYPE U_BKPSRV (28683)) ]
Mar 12 11:20:37 srvl047 charon: 28[IKE] Hash => 20 bytes @ 0x7f3e14002b00
Mar 12 11:20:37 srvl047 charon: 28[IKE] 0: D7 F1 44 2B A8 12 ED FF B2 F8 63
83 F4 26 FC 9D ..D+......c..&..
Mar 12 11:20:37 srvl047 charon: 28[IKE] 16: 08 33 79 7B
.3y{
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing INTERNAL_IP4_ADDRESS
attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing INTERNAL_IP4_NETMASK
attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing INTERNAL_IP4_DNS attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing INTERNAL_IP4_NBNS attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing INTERNAL_ADDRESS_EXPIRY
attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing APPLICATION_VERSION attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing UNITY_BANNER attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing UNITY_DEF_DOMAIN attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing UNITY_SPLITDNS_NAME attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing UNITY_SPLIT_INCLUDE attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing UNITY_LOCAL_LAN attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing UNITY_PFS attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing UNITY_SAVE_PASSWD attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing UNITY_FW_TYPE attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing UNITY_BACKUP_SERVERS
attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] processing (28683) attribute
Mar 12 11:20:37 srvl047 charon: 28[IKE] peer requested virtual IP %any
Mar 12 11:20:37 srvl047 charon: 28[CFG] sending DHCP DISCOVER to 255.255.255.255
Mar 12 11:20:37 srvl047 charon: 15[CFG] received DHCP OFFER 172.19.97.68 from
172.19.96.123
Mar 12 11:20:37 srvl047 charon: 28[CFG] sending DHCP REQUEST for 172.19.97.68
to 172.19.96.123
Mar 12 11:20:37 srvl047 charon: 28[CFG] sending DHCP REQUEST for 172.19.97.68
to 172.19.96.123
Mar 12 11:20:37 srvl047 charon: 14[CFG] received DHCP ACK for 172.19.97.68
Mar 12 11:20:37 srvl047 charon: 28[IKE] assigning virtual IP 172.19.97.68 to
peer 'ppcm018'
Mar 12 11:20:37 srvl047 charon: 28[CFG] proposing traffic selectors for us:
Mar 12 11:20:37 srvl047 charon: 28[CFG] 172.19.96.0/19
Mar 12 11:20:37 srvl047 charon: 28[CFG] sending UNITY_SPLIT_INCLUDE:
172.19.96.0/19
Mar 12 11:20:37 srvl047 charon: 28[IKE] Hash => 20 bytes @ 0x7f3e14005c40
Mar 12 11:20:37 srvl047 charon: 28[IKE] 0: 80 BE FD 51 5A 78 15 50 D9 9B 2F
70 91 1F DD 42 ...QZx.P../p...B
Mar 12 11:20:37 srvl047 charon: 28[IKE] 16: 78 91 AD D6
x...
Mar 12 11:20:37 srvl047 charon: 28[ENC] generating TRANSACTION response
2316792513 [ HASH CPRP(ADDR DNS NBNS U_DEFDOM U_SPLITDNS DNS DNS NBNS
U_SPLITINC) ]
Mar 12 11:20:37 srvl047 charon: 28[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361] (316 bytes)
Mar 12 11:20:37 srvl047 charon: 03[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361]
Mar 12 11:20:38 srvl047 charon: 02[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500]
Mar 12 11:20:38 srvl047 charon: 02[NET] waiting for data on sockets
Mar 12 11:20:38 srvl047 charon: 08[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500] (300 bytes)
Mar 12 11:20:38 srvl047 charon: 08[ENC] parsed QUICK_MODE request 4269954720 [
HASH SA No ID ID ]
Mar 12 11:20:38 srvl047 charon: 08[IKE] Hash(1) => 20 bytes @ 0x7f3e08001a70
Mar 12 11:20:38 srvl047 charon: 08[IKE] 0: 58 C9 04 87 1A 99 4C 7C A6 F3 5B
4D D5 33 D4 B9 X.....L|..[M.3..
Mar 12 11:20:38 srvl047 charon: 08[IKE] 16: 8F ED F8 6F
...o
Mar 12 11:20:38 srvl047 charon: 08[CFG] looking for a child config for
172.19.96.0/19 === 172.19.97.68/32
Mar 12 11:20:38 srvl047 charon: 08[CFG] proposing traffic selectors for us:
Mar 12 11:20:38 srvl047 charon: 08[CFG] 172.19.96.0/19
Mar 12 11:20:38 srvl047 charon: 08[CFG] proposing traffic selectors for other:
Mar 12 11:20:38 srvl047 charon: 08[CFG] 172.19.97.68/32
Mar 12 11:20:38 srvl047 charon: 08[CFG] candidate "CiscoIPSec" with prio 5+5
Mar 12 11:20:38 srvl047 charon: 08[CFG] found matching child config
"CiscoIPSec" with prio 10
Mar 12 11:20:38 srvl047 charon: 08[CFG] selecting traffic selectors for other:
Mar 12 11:20:38 srvl047 charon: 08[CFG] config: 172.19.97.68/32, received:
172.19.97.68/32 => match: 172.19.97.68/32
Mar 12 11:20:38 srvl047 charon: 08[CFG] selecting traffic selectors for us:
Mar 12 11:20:38 srvl047 charon: 08[CFG] config: 172.19.96.0/19, received:
172.19.96.0/19 => match: 172.19.96.0/19
Mar 12 11:20:38 srvl047 charon: 08[CFG] selecting proposal:
Mar 12 11:20:38 srvl047 charon: 08[CFG] proposal matches
Mar 12 11:20:38 srvl047 charon: 08[CFG] received proposals:
ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ,
ESP:AES_CBC_256/HMAC_MD5_96/NO_EXT_SEQ,
ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ,
ESP:AES_CBC_128/HMAC_MD5_96/NO_EXT_SEQ, ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ,
ESP:3DES_CBC/HMAC_MD5_96/NO_EXT_SEQ
Mar 12 11:20:38 srvl047 charon: 08[CFG] configured proposals:
ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ
Mar 12 11:20:38 srvl047 charon: 08[CFG] selected proposal:
ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ
Mar 12 11:20:38 srvl047 charon: 08[IKE] Hash(2) => 20 bytes @ 0x7f3e08005a60
Mar 12 11:20:38 srvl047 charon: 08[IKE] 0: 5F C7 2C 3F 72 12 AC DC C7 49 4D
53 4B 79 5E 67 _.,?r....IMSKy^g
Mar 12 11:20:38 srvl047 charon: 08[IKE] 16: 64 83 0F 38
d..8
Mar 12 11:20:38 srvl047 charon: 08[ENC] generating QUICK_MODE response
4269954720 [ HASH SA No ID ID ]
Mar 12 11:20:38 srvl047 charon: 08[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361] (172 bytes)
Mar 12 11:20:38 srvl047 charon: 03[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361]
Mar 12 11:20:38 srvl047 charon: 02[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500]
Mar 12 11:20:38 srvl047 charon: 02[NET] waiting for data on sockets
Mar 12 11:20:38 srvl047 charon: 07[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500] (60 bytes)
Mar 12 11:20:38 srvl047 charon: 07[ENC] parsed QUICK_MODE request 4269954720 [
HASH ]
Mar 12 11:20:38 srvl047 charon: 07[IKE] Hash(3) => 20 bytes @ 0x7f3e60002130
Mar 12 11:20:38 srvl047 charon: 07[IKE] 0: 40 CE D2 81 1B BC BB 99 5E 29 BE
6D 5A C8 50 D2 @.......^).mZ.P.
Mar 12 11:20:38 srvl047 charon: 07[IKE] 16: EF 1C C6 E5
....
Mar 12 11:20:38 srvl047 charon: 07[CHD] using AES_CBC for encryption
Mar 12 11:20:38 srvl047 charon: 07[CHD] using HMAC_SHA1_96 for integrity
Mar 12 11:20:38 srvl047 charon: 07[CHD] adding inbound ESP SA
Mar 12 11:20:38 srvl047 charon: 07[CHD] SPI 0xc3fcc6a3, src 192.168.0.17 dst
10.0.0.17
Mar 12 11:20:38 srvl047 charon: 07[CHD] adding outbound ESP SA
Mar 12 11:20:38 srvl047 charon: 07[CHD] SPI 0x0f18953b, src 10.0.0.17 dst
192.168.0.17
Mar 12 11:20:38 srvl047 charon: 07[IKE] CHILD_SA CiscoIPSec{406} established
with SPIs c3fcc6a3_i 0f18953b_o and TS 172.19.96.0/19 === 172.19.97.68/32
# gotosleep
:
:
# wakeup
Mar 12 11:55:12 srvl047 charon: 02[NET] received packet: from
192.168.0.17[53195] to 10.0.0.17[500]
Mar 12 11:55:12 srvl047 charon: 02[NET] waiting for data on sockets
Mar 12 11:55:12 srvl047 charon: 04[NET] received packet: from
192.168.0.17[53195] to 10.0.0.17[500] (668 bytes)
Mar 12 11:55:12 srvl047 charon: 04[ENC] parsed ID_PROT request 0 [ SA V V V V V
V V V V V V V V V ]
Mar 12 11:55:12 srvl047 charon: 04[CFG] looking for an ike config for
10.0.0.17...192.168.0.17
Mar 12 11:55:12 srvl047 charon: 04[CFG] ike config match: 0 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:55:12 srvl047 charon: 04[CFG] ike config match: 0 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:55:12 srvl047 charon: 04[CFG] ike config match: 1052 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:55:12 srvl047 charon: 04[CFG] candidate: gate1.example.com...%any,
prio 1052
Mar 12 11:55:12 srvl047 charon: 04[CFG] ike config match: 1052 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:55:12 srvl047 charon: 04[CFG] candidate: gate1.example.com...%any,
prio 1052
Mar 12 11:55:12 srvl047 charon: 04[CFG] ike config match: 0 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:55:12 srvl047 charon: 04[CFG] found matching ike config:
gate1.example.com...%any with prio 1052
Mar 12 11:55:12 srvl047 charon: 04[IKE] received NAT-T (RFC 3947) vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] received draft-ietf-ipsec-nat-t-ike
vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] received draft-ietf-ipsec-nat-t-ike-08
vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] received draft-ietf-ipsec-nat-t-ike-07
vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] received draft-ietf-ipsec-nat-t-ike-06
vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] received draft-ietf-ipsec-nat-t-ike-05
vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] received draft-ietf-ipsec-nat-t-ike-04
vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] received draft-ietf-ipsec-nat-t-ike-03
vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] received draft-ietf-ipsec-nat-t-ike-02
vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] received
draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] received XAuth vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] received Cisco Unity vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] received FRAGMENTATION vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] received DPD vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] 192.168.0.17 is initiating a Main Mode
IKE_SA
Mar 12 11:55:12 srvl047 charon: 04[IKE] IKE_SA (unnamed)[178] state change:
CREATED => CONNECTING
Mar 12 11:55:12 srvl047 charon: 04[CFG] selecting proposal:
Mar 12 11:55:12 srvl047 charon: 04[CFG] proposal matches
Mar 12 11:55:12 srvl047 charon: 04[CFG] received proposals:
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536,
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024,
IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024,
IKE:AES_CBC_256/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1536,
IKE:AES_CBC_256/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024,
IKE:AES_CBC_128/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024,
IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024,
IKE:3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024,
IKE:DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024,
IKE:DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024
Mar 12 11:55:12 srvl047 charon: 04[CFG] configured proposals:
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
Mar 12 11:55:12 srvl047 charon: 04[CFG] selected proposal:
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
Mar 12 11:55:12 srvl047 charon: 04[IKE] sending strongSwan vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] sending XAuth vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] sending DPD vendor ID
Mar 12 11:55:12 srvl047 charon: 04[IKE] sending NAT-T (RFC 3947) vendor ID
Mar 12 11:55:12 srvl047 charon: 04[ENC] generating ID_PROT response 0 [ SA V V
V V ]
Mar 12 11:55:12 srvl047 charon: 04[NET] sending packet: from 10.0.0.17[500] to
192.168.0.17[53195] (156 bytes)
Mar 12 11:55:12 srvl047 charon: 03[NET] sending packet: from 10.0.0.17[500] to
192.168.0.17[53195]
Mar 12 11:55:12 srvl047 charon: 02[NET] received packet: from
192.168.0.17[53195] to 10.0.0.17[500]
Mar 12 11:55:12 srvl047 charon: 02[NET] waiting for data on sockets
Mar 12 11:55:12 srvl047 charon: 06[NET] received packet: from
192.168.0.17[53195] to 10.0.0.17[500] (292 bytes)
Mar 12 11:55:12 srvl047 charon: 06[ENC] parsed ID_PROT request 0 [ KE No NAT-D
NAT-D ]
Mar 12 11:55:12 srvl047 charon: 06[IKE] natd_chunk => 22 bytes @ 0x7f3e912c4b70
Mar 12 11:55:12 srvl047 charon: 06[IKE] 0: 0C 6D E9 A3 61 46 3A 33 61 2F 07
6C D8 C7 0C D6 .m..aF:3a/.l....
Mar 12 11:55:12 srvl047 charon: 06[IKE] 16: 05 91 8E 11 01 F4
......
Mar 12 11:55:12 srvl047 charon: 06[IKE] natd_hash => 20 bytes @ 0x7f3e68008be0
Mar 12 11:55:12 srvl047 charon: 06[IKE] 0: 1E A0 6D 59 1E D3 0E 41 91 99 EA
E9 96 8C 47 1E ..mY...A......G.
Mar 12 11:55:12 srvl047 charon: 06[IKE] 16: E5 43 5D 49
.C]I
Mar 12 11:55:12 srvl047 charon: 06[IKE] natd_chunk => 22 bytes @ 0x7f3e912c4b70
Mar 12 11:55:12 srvl047 charon: 06[IKE] 0: 0C 6D E9 A3 61 46 3A 33 61 2F 07
6C D8 C7 0C D6 .m..aF:3a/.l....
Mar 12 11:55:12 srvl047 charon: 06[IKE] 16: D9 EB 92 11 CF CB
......
Mar 12 11:55:12 srvl047 charon: 06[IKE] natd_hash => 20 bytes @ 0x7f3e68008c00
Mar 12 11:55:12 srvl047 charon: 06[IKE] 0: 29 05 8F 04 03 7B F7 D1 B1 73 D9
86 2D 19 F4 06 )....{...s..-...
Mar 12 11:55:12 srvl047 charon: 06[IKE] 16: 62 F2 27 88
b.'.
Mar 12 11:55:12 srvl047 charon: 06[IKE] precalculated src_hash => 20 bytes @
0x7f3e68008c00
Mar 12 11:55:12 srvl047 charon: 06[IKE] 0: 29 05 8F 04 03 7B F7 D1 B1 73 D9
86 2D 19 F4 06 )....{...s..-...
Mar 12 11:55:12 srvl047 charon: 06[IKE] 16: 62 F2 27 88
b.'.
Mar 12 11:55:12 srvl047 charon: 06[IKE] precalculated dst_hash => 20 bytes @
0x7f3e68008be0
Mar 12 11:55:12 srvl047 charon: 06[IKE] 0: 1E A0 6D 59 1E D3 0E 41 91 99 EA
E9 96 8C 47 1E ..mY...A......G.
Mar 12 11:55:12 srvl047 charon: 06[IKE] 16: E5 43 5D 49
.C]I
Mar 12 11:55:12 srvl047 charon: 06[IKE] received dst_hash => 20 bytes @
0x7f3e68006c80
Mar 12 11:55:12 srvl047 charon: 06[IKE] 0: 1E A0 6D 59 1E D3 0E 41 91 99 EA
E9 96 8C 47 1E ..mY...A......G.
Mar 12 11:55:12 srvl047 charon: 06[IKE] 16: E5 43 5D 49
.C]I
Mar 12 11:55:12 srvl047 charon: 06[IKE] received src_hash => 20 bytes @
0x7f3e68002d40
Mar 12 11:55:12 srvl047 charon: 06[IKE] 0: E7 75 05 46 3D 2E 7C 5F 26 0E 8A
25 D1 DF 4B 10 .u.F=.|_&..%..K.
Mar 12 11:55:12 srvl047 charon: 06[IKE] 16: C4 D0 1D 65
...e
Mar 12 11:55:12 srvl047 charon: 06[IKE] remote host is behind NAT
Mar 12 11:55:12 srvl047 charon: 06[IKE] sending cert request for "C=DE,
O=example AG, OU=example Certificate Authority, CN=example Root CA"
Mar 12 11:55:12 srvl047 charon: 06[IKE] sending cert request for "C=DE, ST=NRW,
L=Aachen, O=example AG, OU=TI, CN=IPsec_ca, [email protected]"
Mar 12 11:55:12 srvl047 charon: 06[IKE] sending cert request for "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:55:12 srvl047 charon: 06[IKE] natd_chunk => 22 bytes @ 0x7f3e912c4b90
Mar 12 11:55:12 srvl047 charon: 06[IKE] 0: 0C 6D E9 A3 61 46 3A 33 61 2F 07
6C D8 C7 0C D6 .m..aF:3a/.l....
Mar 12 11:55:12 srvl047 charon: 06[IKE] 16: D9 EB 92 11 CF CB
......
Mar 12 11:55:12 srvl047 charon: 06[IKE] natd_hash => 20 bytes @ 0x7f3e68005530
Mar 12 11:55:12 srvl047 charon: 06[IKE] 0: 29 05 8F 04 03 7B F7 D1 B1 73 D9
86 2D 19 F4 06 )....{...s..-...
Mar 12 11:55:12 srvl047 charon: 06[IKE] 16: 62 F2 27 88
b.'.
Mar 12 11:55:12 srvl047 charon: 06[IKE] natd_chunk => 22 bytes @ 0x7f3e912c4b90
Mar 12 11:55:12 srvl047 charon: 06[IKE] 0: 0C 6D E9 A3 61 46 3A 33 61 2F 07
6C D8 C7 0C D6 .m..aF:3a/.l....
Mar 12 11:55:12 srvl047 charon: 06[IKE] 16: 05 91 8E 11 01 F4
......
Mar 12 11:55:12 srvl047 charon: 06[IKE] natd_hash => 20 bytes @ 0x7f3e680083f0
Mar 12 11:55:12 srvl047 charon: 06[IKE] 0: 1E A0 6D 59 1E D3 0E 41 91 99 EA
E9 96 8C 47 1E ..mY...A......G.
Mar 12 11:55:12 srvl047 charon: 06[IKE] 16: E5 43 5D 49
.C]I
Mar 12 11:55:12 srvl047 charon: 06[ENC] generating ID_PROT response 0 [ KE No
CERTREQ CERTREQ CERTREQ NAT-D NAT-D ]
Mar 12 11:55:12 srvl047 charon: 06[NET] sending packet: from 10.0.0.17[500] to
192.168.0.17[53195] (653 bytes)
Mar 12 11:55:12 srvl047 charon: 03[NET] sending packet: from 10.0.0.17[500] to
192.168.0.17[53195]
Mar 12 11:55:12 srvl047 charon: 02[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500]
Mar 12 11:55:12 srvl047 charon: 02[NET] waiting for data on sockets
Mar 12 11:55:12 srvl047 charon: 26[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500] (2220 bytes)
Mar 12 11:55:12 srvl047 charon: 26[ENC] parsed ID_PROT request 0 [ ID CERT SIG
CERTREQ ]
Mar 12 11:55:12 srvl047 charon: 26[IKE] ignoring certificate request without
data
Mar 12 11:55:12 srvl047 charon: 26[IKE] received end entity cert "C=DE,
O=example AG, OU=TI, CN=ppcm018.ws.example.com"
Mar 12 11:55:12 srvl047 charon: 26[CFG] looking for XAuthInitRSA peer configs
matching 10.0.0.17...192.168.0.17[C=DE, O=example AG, OU=TI,
CN=ppcm018.ws.example.com]
Mar 12 11:55:12 srvl047 charon: 26[CFG] peer config match local: 1 (ID_ANY)
Mar 12 11:55:12 srvl047 charon: 26[CFG] peer config match remote: 1
(ID_DER_ASN1_DN ->
30:4d:31:0b:30:09:06:03:55:04:06:13:02:44:45:31:12:30:10:06:03:55:04:0a:13:09:61:69:78:69:67:6f:20:41:47:31:0b:30:09:06:03:55:04:0b:13:02:54:49:31:1d:30:1b:06:03:55:04:03:13:14:70:70:63:6d:30:31:38:2e:77:73:2e:61:69:78:69:67:6f:2e:64:65)
Mar 12 11:55:12 srvl047 charon: 26[CFG] ike config match: 0 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:55:12 srvl047 charon: 26[CFG] peer config match local: 1 (ID_ANY)
Mar 12 11:55:12 srvl047 charon: 26[CFG] peer config match remote: 1
(ID_DER_ASN1_DN ->
30:4d:31:0b:30:09:06:03:55:04:06:13:02:44:45:31:12:30:10:06:03:55:04:0a:13:09:61:69:78:69:67:6f:20:41:47:31:0b:30:09:06:03:55:04:0b:13:02:54:49:31:1d:30:1b:06:03:55:04:03:13:14:70:70:63:6d:30:31:38:2e:77:73:2e:61:69:78:69:67:6f:2e:64:65)
Mar 12 11:55:12 srvl047 charon: 26[CFG] ike config match: 0 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:55:12 srvl047 charon: 26[CFG] peer config match local: 1 (ID_ANY)
Mar 12 11:55:12 srvl047 charon: 26[CFG] peer config match remote: 1
(ID_DER_ASN1_DN ->
30:4d:31:0b:30:09:06:03:55:04:06:13:02:44:45:31:12:30:10:06:03:55:04:0a:13:09:61:69:78:69:67:6f:20:41:47:31:0b:30:09:06:03:55:04:0b:13:02:54:49:31:1d:30:1b:06:03:55:04:03:13:14:70:70:63:6d:30:31:38:2e:77:73:2e:61:69:78:69:67:6f:2e:64:65)
Mar 12 11:55:12 srvl047 charon: 26[CFG] ike config match: 1052 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:55:12 srvl047 charon: 26[CFG] candidate "CiscoIPSec", match:
1/1/1052 (me/other/ike)
Mar 12 11:55:12 srvl047 charon: 26[CFG] peer config match local: 1 (ID_ANY)
Mar 12 11:55:12 srvl047 charon: 26[CFG] peer config match remote: 1
(ID_DER_ASN1_DN ->
30:4d:31:0b:30:09:06:03:55:04:06:13:02:44:45:31:12:30:10:06:03:55:04:0a:13:09:61:69:78:69:67:6f:20:41:47:31:0b:30:09:06:03:55:04:0b:13:02:54:49:31:1d:30:1b:06:03:55:04:03:13:14:70:70:63:6d:30:31:38:2e:77:73:2e:61:69:78:69:67:6f:2e:64:65)
Mar 12 11:55:12 srvl047 charon: 26[CFG] ike config match: 1052 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:55:12 srvl047 charon: 26[CFG] candidate "CiscoIPSec-pam", match:
1/1/1052 (me/other/ike)
Mar 12 11:55:12 srvl047 charon: 26[CFG] peer config match local: 1 (ID_ANY)
Mar 12 11:55:12 srvl047 charon: 26[CFG] peer config match remote: 0
(ID_DER_ASN1_DN ->
30:4d:31:0b:30:09:06:03:55:04:06:13:02:44:45:31:12:30:10:06:03:55:04:0a:13:09:61:69:78:69:67:6f:20:41:47:31:0b:30:09:06:03:55:04:0b:13:02:54:49:31:1d:30:1b:06:03:55:04:03:13:14:70:70:63:6d:30:31:38:2e:77:73:2e:61:69:78:69:67:6f:2e:64:65)
Mar 12 11:55:12 srvl047 charon: 26[CFG] ike config match: 0 (10.0.0.17
192.168.0.17 IKEv1)
Mar 12 11:55:12 srvl047 charon: 26[CFG] selected peer config "CiscoIPSec"
Mar 12 11:55:12 srvl047 charon: 26[IKE] HASH_I data => 843 bytes @
0x7f3e1c0044f0
Mar 12 11:55:12 srvl047 charon: 26[IKE] 0: 57 F0 D4 99 6A 6C 8D AB 7F 6F C5
30 49 B7 E5 ED W...jl...o.0I...
Mar 12 11:55:12 srvl047 charon: 26[IKE] 16: 8D CC FF 56 93 A1 DE B9 49 D4 7E
83 A0 C2 4B 09 ...V....I.~...K.
:
:
Mar 12 11:55:12 srvl047 charon: 26[IKE] 816: 06 03 55 04 03 13 14 70 70 63 6D
30 31 38 2E 77 ..U....ppcm018.w
Mar 12 11:55:12 srvl047 charon: 26[IKE] 832: 73 2E 61 69 78 69 67 6F 2E 64 65
s.example.com
Mar 12 11:55:12 srvl047 charon: 26[IKE] HASH_I => 20 bytes @ 0x7f3e1c00a4b0
Mar 12 11:55:12 srvl047 charon: 26[IKE] 0: 80 3C 34 4C DB 2A 29 15 32 EA 23
A4 3F 10 B7 1F .<4L.*).2.#.?...
Mar 12 11:55:12 srvl047 charon: 26[IKE] 16: FC 8C E7 63
...c
Mar 12 11:55:12 srvl047 charon: 26[CFG] using certificate "C=DE, O=example
AG, OU=TI, CN=ppcm018.ws.example.com"
Mar 12 11:55:12 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=TI, CN=ppcm018.ws.example.com" key: 2048 bit RSA
Mar 12 11:55:12 srvl047 charon: 26[CFG] using trusted intermediate ca
certificate "C=DE, O=example AG, OU=example Certificate Authority,
CN=ws-example-CA"
Mar 12 11:55:12 srvl047 charon: 26[CFG] checking certificate status of "C=DE,
O=example AG, OU=TI, CN=ppcm018.ws.example.com"
Mar 12 11:55:12 srvl047 charon: 26[CFG] ocsp check skipped, no ocsp found
Mar 12 11:55:12 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=ws-example-CA" key: 4096 bit RSA
Mar 12 11:55:12 srvl047 charon: 26[CFG] using trusted ca certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=example Root CA"
Mar 12 11:55:12 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=example Root CA" key: 4096 bit RSA
Mar 12 11:55:12 srvl047 charon: 26[CFG] reached self-signed root ca with a
path length of 0
Mar 12 11:55:12 srvl047 charon: 26[CFG] using trusted certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:55:12 srvl047 charon: 26[CFG] crl correctly signed by "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:55:12 srvl047 charon: 26[CFG] crl is valid: until Mar 15 08:42:47
2016
Mar 12 11:55:12 srvl047 charon: 26[CFG] using cached crl
Mar 12 11:55:12 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=ws-example-CA" key: 4096 bit RSA
Mar 12 11:55:12 srvl047 charon: 26[CFG] using trusted ca certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=example Root CA"
Mar 12 11:55:12 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=example Root CA" key: 4096 bit RSA
Mar 12 11:55:12 srvl047 charon: 26[CFG] reached self-signed root ca with a
path length of 0
Mar 12 11:55:12 srvl047 charon: 26[CFG] using trusted certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:55:12 srvl047 charon: 26[CFG] crl correctly signed by "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:55:12 srvl047 charon: 26[CFG] crl is stale: since Mar 12 08:42:47
2016
Mar 12 11:55:12 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=ws-example-CA" key: 4096 bit RSA
Mar 12 11:55:12 srvl047 charon: 26[CFG] using trusted ca certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=example Root CA"
Mar 12 11:55:12 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=example Root CA" key: 4096 bit RSA
Mar 12 11:55:12 srvl047 charon: 26[CFG] reached self-signed root ca with a
path length of 0
Mar 12 11:55:12 srvl047 charon: 26[CFG] using trusted certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:55:12 srvl047 charon: 26[CFG] crl correctly signed by "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:55:12 srvl047 charon: 26[LIB] crl #01:2d is newer - existing crl
#01:2c replaced
Mar 12 11:55:12 srvl047 charon: 26[CFG] crl is valid: until Mar 13 08:42:47
2016
Mar 12 11:55:12 srvl047 charon: 26[CFG] using cached crl
Mar 12 11:55:12 srvl047 charon: 26[CFG] certificate status is good
Mar 12 11:55:12 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=ws-example-CA" key: 4096 bit RSA
Mar 12 11:55:12 srvl047 charon: 26[CFG] using trusted ca certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=example Root CA"
Mar 12 11:55:12 srvl047 charon: 26[CFG] checking certificate status of "C=DE,
O=example AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:55:12 srvl047 charon: 26[CFG] ocsp check skipped, no ocsp found
Mar 12 11:55:12 srvl047 charon: 26[CFG] using trusted certificate "C=DE,
O=example AG, OU=example Certificate Authority, CN=example Root CA"
Mar 12 11:55:12 srvl047 charon: 26[CFG] crl correctly signed by "C=DE,
O=example AG, OU=example Certificate Authority, CN=example Root CA"
Mar 12 11:55:12 srvl047 charon: 26[CFG] crl is valid: until Dec 20 11:33:09
2045
Mar 12 11:55:12 srvl047 charon: 26[CFG] using cached crl
Mar 12 11:55:12 srvl047 charon: 26[CFG] certificate status is good
Mar 12 11:55:12 srvl047 charon: 26[CFG] certificate "C=DE, O=example AG,
OU=example Certificate Authority, CN=example Root CA" key: 4096 bit RSA
Mar 12 11:55:12 srvl047 charon: 26[CFG] reached self-signed root ca with a
path length of 1
Mar 12 11:55:12 srvl047 charon: 26[IKE] authentication of 'C=DE, O=example AG,
OU=TI, CN=ppcm018.ws.example.com' with RSA successful
Mar 12 11:55:12 srvl047 charon: 26[IKE] HASH_R data => 783 bytes @
0x7f3e1c008900
Mar 12 11:55:12 srvl047 charon: 26[IKE] 0: 59 45 B2 EF 4D FC 9A D2 7F CB E0
C1 45 5F 1A A2 YE..M.......E_..
Mar 12 11:55:12 srvl047 charon: 26[IKE] 16: D5 5E 18 CF BB 81 3D CF B3 F3 2A
92 48 6B D5 DC .^....=...*.Hk..
:
:
Mar 12 11:55:12 srvl047 charon: 26[IKE] 736: 80 0B 00 01 80 0C 0E 10 80 01 00
01 80 03 FD ED ................
Mar 12 11:55:12 srvl047 charon: 26[IKE] 752: 80 02 00 01 80 04 00 02 02 00 00
00 73 74 61 72 ............gate
Mar 12 11:55:12 srvl047 charon: 26[IKE] 768: 67 61 74 65 2E 61 69 78 69 67 6F
2E 63 6F 6D 1.example.com
Mar 12 11:55:12 srvl047 charon: 26[IKE] HASH_R => 20 bytes @ 0x7f3e1c0017f0
Mar 12 11:55:12 srvl047 charon: 26[IKE] 0: 44 B6 1F C4 82 22 F7 47 77 D2 4E
57 36 6D F0 59 D....".Gw.NW6m.Y
Mar 12 11:55:12 srvl047 charon: 26[IKE] 16: 18 BD E9 21
...!
Mar 12 11:55:12 srvl047 charon: 26[IKE] authentication of 'gate1.example.com'
(myself) successful
Mar 12 11:55:12 srvl047 charon: 26[IKE] queueing XAUTH task
Mar 12 11:55:12 srvl047 charon: 26[IKE] sending end entity cert "C=DE, ST=NRW,
L=Aachen, O=example AG, CN=gate1.example.com/[email protected]"
Mar 12 11:55:12 srvl047 charon: 26[IKE] sending issuer cert "C=DE, O=example
AG, OU=example Certificate Authority, CN=ws-example-CA"
Mar 12 11:55:12 srvl047 charon: 26[ENC] generating ID_PROT response 0 [ ID CERT
CERT SIG ]
Mar 12 11:55:12 srvl047 charon: 26[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361] (3708 bytes)
Mar 12 11:55:12 srvl047 charon: 26[IKE] activating new tasks
Mar 12 11:55:12 srvl047 charon: 26[IKE] activating XAUTH task
Mar 12 11:55:12 srvl047 charon: 03[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361]
Mar 12 11:55:12 srvl047 charon: 26[IKE] Hash => 20 bytes @ 0x7f3e1c0069b0
Mar 12 11:55:12 srvl047 charon: 26[IKE] 0: 41 2B 58 8B BA C5 FD 1D B2 8F CC
78 F0 83 D9 39 A+X........x...9
Mar 12 11:55:12 srvl047 charon: 26[IKE] 16: 16 01 44 94
..D.
Mar 12 11:55:12 srvl047 charon: 26[ENC] generating TRANSACTION request 34192379
[ HASH CPRQ(X_USER X_PWD) ]
Mar 12 11:55:12 srvl047 charon: 26[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361] (76 bytes)
Mar 12 11:55:12 srvl047 charon: 03[NET] sending packet: from 10.0.0.17[4500] to
192.168.0.17[60361]
Mar 12 11:55:13 srvl047 charon: 02[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500]
Mar 12 11:55:13 srvl047 charon: 02[NET] waiting for data on sockets
Mar 12 11:55:13 srvl047 charon: 20[NET] received packet: from
192.168.0.17[60361] to 10.0.0.17[4500] (300 bytes)
Mar 12 11:55:13 srvl047 charon: 20[ENC] parsed QUICK_MODE request 3495102926 [
HASH SA No ID ID ]
Mar 12 11:55:13 srvl047 charon: 20[IKE] Hash(1) => 20 bytes @ 0x7f3e34010fb0
Mar 12 11:55:13 srvl047 charon: 20[IKE] 0: 49 7A 47 EE F1 2F B4 F7 D2 8A 1D
BB DC 8B CC 9F IzG../..........
Mar 12 11:55:13 srvl047 charon: 20[IKE] 16: C0 D9 32 69
..2i
Mar 12 11:55:13 srvl047 charon: 20[IKE] received quick mode request for
unestablished IKE_SA, ignored
Mar 12 11:55:13 srvl047 charon: 20[IKE] IKE_SA CiscoIPSec[178] state change:
CONNECTING => DESTROYING
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Users mailing list [email protected] https://lists.strongswan.org/mailman/listinfo/users
