Hello,
I have two OpenBSD 6.1-stable boxes in a CARP cluster. There are 3 carp
interfaces -
carp0 = Internal network (with its own separate ISP)
carp1 = Comcast
carp2 = Verizon
The interfaces are using 3 separate routing domains (the routing tables
below omit entries not of interest):
#####################
[Thu May 25 10:44:43 AM root@backupvpn2 (0 jobs) ~ ]# netstat -rn -f
inet -T0
Routing tables
Internet:
Destination Gateway Flags Refs Use Mtu Prio
Iface
default A.B.224.1 UGS 4295 348966 - 8 em0
A.B.224/21 A.B.226.53 UCn 2 15056641 - 4 em0
A.B.224/21 A.B.226.56 Cn 0 0 - 19 carp0
A.B.224.1 Y:Z:0c:9f:f6:a5 UHLch 3 648556 - 3 em0
######################
[Thu May 25 10:47:36 AM root@backupvpn2 (0 jobs) ~ ]# netstat -rn -f
inet -T1
Routing tables
Internet:
Destination Gateway Flags Refs Use Mtu Prio
Iface
default C.D.173.150 GS 0 17537 - 23 carp1
C.D.173.144/29 C.D.173.146 Cn 1 10932 - 19 carp1
C.D.173.146 W:X:5e:00:01:0a UHLl 0 106 - 1 carp1
C.D.173.150 link#8 HLch 1 6477 - 18 carp1
######################
[Thu May 25 10:47:47 AM root@backupvpn2 (0 jobs) ~ ]# netstat -rn -f
inet -T2
Routing tables
Internet:
Destination Gateway Flags Refs Use Mtu Prio
Iface
default E.F.84.106 GS 0 67568 - 23 carp2
E.F.84.104/29 E.F.84.107 Cn 1 11427 - 19 carp2
E.F.84.106 link#10 HLch 1 6674 - 18 carp2
E.F.84.107 U:V:5e:00:01:14 UHLl 0 1204 - 1 carp2
#######################
I would like to setup an IKEv2 VPN for road warriors, so that they could
get in either via Verizon, or Comcast, whichever one is up.
I've setup the necessary certificates:
[Thu May 25 11:05:04 AM root@backupvpn2 (0 jobs) ~ ]# openssl rsa -in
/etc/iked/private/local.key -noout -check
RSA key ok
[Thu May 25 11:06:04 AM root@backupvpn2 (0 jobs) ~ ]# openssl rsa -in
/etc/iked/private/local.key -noout -modulus | md5
aa8152ada114ff81524dc91acb9dab1a
[Thu May 25 11:40:44 AM root@backupvpn2 (0 jobs) ~ ]# openssl rsa -in
/etc/iked/local.pub -pubin -noout -modulus | md5
aa8152ada114ff81524dc91acb9dab1a
[Thu May 25 11:06:24 AM root@backupvpn2 (0 jobs) ~ ]# openssl x509 -in
/etc/iked/certs/server.crt -noout -modulus | md5
aa8152ada114ff81524dc91acb9dab1a
[Thu May 25 11:07:45 AM root@backupvpn2 (0 jobs) ~ ]# openssl crl -in
/etc/iked/crls/ca-inter-crl.pem -noout -verify -CAfile
/etc/iked/ca/ca-inter-cert.pem
verify OK
[Thu May 25 11:09:11 AM root@backupvpn2 (0 jobs) ~ ]# openssl crl -in
/etc/iked/crls/ca-root-crl.pem -noout -verify -CAfile
/etc/iked/ca/ca-root.pem
verify OK
[Thu May 25 11:33:24 AM root@backupvpn2 (0 jobs) ~ ]# openssl verify
-verbose -x509_strict -CApath /etc/iked/ca /etc/iked/certs/server.crt
/etc/iked/certs/server.crt: OK
[Thu May 25 11:44:56 AM root@backupvpn2 (0 jobs) ~ ]# openssl verify
-verbose -x509_strict -CApath /etc/iked/ca
/usr/local/monitoring/CA/Intermediate/certs/client-cert.pem
/usr/local/monitoring/CA/Intermediate/certs/client-cert.pem: OK
###################
[Thu May 25 12:05:31 PM root@backupvpn2 (2 jobs) /etc/iked ]# pfctl -sr
| egrep "500|4500|ah|esp"
pass in on em1 inet proto udp from any to C.D.173.146 port = 500
pass in on em1 inet proto udp from any to C.D.173.146 port = 4500
pass in on em2 inet proto udp from any to E.F.84.107 port = 500
pass in on em2 inet proto udp from any to E.F.84.107 port = 4500
pass in on em2 inet proto ah from any to E.F.84.107
pass in on em2 inet proto esp from any to E.F.84.107
pass in on em1 inet proto ah from any to C.D.173.146
pass in on em1 inet proto esp from any to C.D.173.146
####################
ikev2 "Comcast" \
passive esp \
from C.D.173.144/29 to 172.17.0.64/26 \
from A.B.0.0/16 to 172.17.0.64/26 \
local C.D.173.146 peer any \
srcid "/C=US/ST=New
Jersey/L=Princeton/O=MYORG/OU=EIS/CN=backupvpn.somedomain.com/emailAddress=network...@domain1.com"
\
config address 172.17.0.65
ikev2 "Verizon" \
passive esp \
from E.F.84.104/29 to 172.17.0.64/26 \
from A.B.0.0/16 to 172.17.0.64/26 \
local E.F.84.107 peer any \
srcid "/C=US/ST=New
Jersey/L=Princeton/O=MYORG/OU=EIS/CN=backupvpn.somedomain.com/emailAddress=network...@domain1.com"
\
config address 172.17.0.65
#####################
route -T2 exec iked -d -vv
....
....
ikev2_recv: IKE_SA_INIT request from initiator <client_ip>:60208 to
E.F.84.107:500 policy 'Verizon' id 0, 528 bytes
ikev2_recv: ispi 0xa37c52d1ac237b2f rspi 0x0000000000000000
ca_x509_name_parse: setting 'C' to 'US'
ca_x509_name_parse: setting 'ST' to 'New Jersey'
ca_x509_name_parse: setting 'L' to 'Princeton'
ca_x509_name_parse: setting 'O' to 'MYORG'
ca_x509_name_parse: setting 'OU' to 'EIS'
ca_x509_name_parse: setting 'CN' to 'backupvpn.somedomain.com'
ca_x509_name_parse: setting 'emailAddress' to 'network...@princeton.edu'
ikev2_policy2id: srcid ASN1_DN//C=US/ST=New
Jersey/L=Princeton/O=MYORG/OU=EIS/CN=backupvpn.somedomain.com/emailAddress=network...@domain1.com
on.EDU length 181
ikev2_pld_parse: header ispi 0xa37c52d1ac237b2f rspi 0x0000000000000000
nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x08 msgid 0
length 528
response 0
ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 256
ikev2_pld_sa: more than one proposal specified
ikev2_pld_sa: more 2 reserved 0 length 40 proposal #1 protoid IKE
spisize 0 xforms 4 spi 0
ikev2_pld_xform: more 3 reserved 0 length 8 type ENCR id 3DES
ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id HMAC_SHA1_96
ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA1
ikev2_pld_xform: more 0 reserved 0 length 8 type DH id MODP_1024
ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 136
ikev2_pld_ke: dh group MODP_1024 reserved 0
ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00 length 52
ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
length 28
ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP
ikev2_nat_detection: peer source 0xa37c52d1ac237b2f 0x0000000000000000
<client_ip>:60208
ikev2_pld_notify: NAT_DETECTION_SOURCE_IP detected NAT, enabling UDP
encapsulation
ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length 28
ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_DESTINATION_IP
ikev2_nat_detection: peer destination 0xa37c52d1ac237b2f
0x0000000000000000 E.F.84.107:500
sa_state: INIT -> SA_INIT
ikev2_sa_negotiate: score 21
sa_stateok: SA_INIT flags 0x0000, require 0x0000
sa_stateflags: 0x0000 -> 0x0020 sa (required 0x0000 )
ikev2_sa_keys: SKEYSEED with 20 bytes
ikev2_sa_keys: S with 96 bytes
ikev2_prfplus: T1 with 20 bytes
ikev2_prfplus: T2 with 20 bytes
ikev2_prfplus: T3 with 20 bytes
ikev2_prfplus: T4 with 20 bytes
ikev2_prfplus: T5 with 20 bytes
ikev2_prfplus: T6 with 20 bytes
ikev2_prfplus: T7 with 20 bytes
ikev2_prfplus: T8 with 20 bytes
ikev2_prfplus: Tn with 160 bytes
ikev2_sa_keys: SK_d with 20 bytes
ikev2_sa_keys: SK_ai with 20 bytes
ikev2_sa_keys: SK_ar with 20 bytes
ikev2_sa_keys: SK_ei with 24 bytes
ikev2_sa_keys: SK_er with 24 bytes
ikev2_sa_keys: SK_pi with 20 bytes
ikev2_sa_keys: SK_pr with 20 bytes
ikev2_add_proposals: length 40
ikev2_next_payload: length 44 nextpayload KE
ikev2_next_payload: length 136 nextpayload NONCE
ikev2_next_payload: length 36 nextpayload NOTIFY
ikev2_nat_detection: local source 0xa37c52d1ac237b2f 0x4dba64f9bb1b69b2
E.F.84.107:500
ikev2_next_payload: length 28 nextpayload NOTIFY
ikev2_nat_detection: local destination 0xa37c52d1ac237b2f
0x4dba64f9bb1b69b2 <client_ip>:60208
ikev2_next_payload: length 28 nextpayload CERTREQ
ikev2_add_certreq: type X509_CERT length 41
ikev2_next_payload: length 45 nextpayload NONE
ikev2_pld_parse: header ispi 0xa37c52d1ac237b2f rspi 0x4dba64f9bb1b69b2
nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x20 msgid 0
length 345
response 1
ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 44
ikev2_pld_sa: more 0 reserved 0 length 40 proposal #1 protoid IKE
spisize 0 xforms 4 spi 0
ikev2_pld_xform: more 3 reserved 0 length 8 type ENCR id 3DES
ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA1
ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id HMAC_SHA1_96
ikev2_pld_xform: more 0 reserved 0 length 8 type DH id MODP_1024
ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 136
ikev2_pld_ke: dh group MODP_1024 reserved 0
ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00 length 36
ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
length 28
ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP
ikev2_pld_payloads: payload NOTIFY nextpayload CERTREQ critical 0x00
length 28
ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_DESTINATION_IP
ikev2_pld_payloads: payload CERTREQ nextpayload NONE critical 0x00 length 45
ikev2_pld_certreq: type X509_CERT length 40
ikev2_msg_send: IKE_SA_INIT response from E.F.84.107:500 to
<client_ip>:60208 msgid 0, 345 bytes
config_free_proposals: free 0x1aecbd748000
ikev2_recv: IKE_AUTH request from initiator <client_ip>:50552 to
E.F.84.107:4500 policy 'Verizon' id 1, 4132 bytes
ikev2_recv: ispi 0xa37c52d1ac237b2f rspi 0x4dba64f9bb1b69b2
ikev2_recv: updated SA to peer <client_ip>:50552 local E.F.84.107:4500
ikev2_pld_parse: header ispi 0xa37c52d1ac237b2f rspi 0x4dba64f9bb1b69b2
nextpayload SK version 0x20 exchange IKE_AUTH flags 0x08 msgid 1 length
4132 response 0
ikev2_pld_payloads: payload SK nextpayload IDi critical 0x00 length 4104
ikev2_msg_decrypt: IV length 8
ikev2_msg_decrypt: encrypted payload length 4080
ikev2_msg_decrypt: integrity checksum length 12
ikev2_msg_decrypt: integrity check succeeded
ikev2_msg_decrypt: decrypted payload length 4080/4080 padding 2
ikev2_pld_payloads: decrypted payload IDi nextpayload CERT critical 0x00
length 170
ikev2_pld_id: id ASN1_DN//C=US/ST=New
Jersey/L=Princeton/O=MYORG/OU=EIS/CN=client/emailAddress=network...@domain1.com
length 166
ikev2_pld_payloads: decrypted payload CERT nextpayload CERT critical
0x00 length 1173
ikev2_pld_cert: type X509_CERT length 1168
ikev2_pld_payloads: decrypted payload CERT nextpayload CERTREQ critical
0x00 length 1373
ikev2_pld_cert: type X509_CERT length 1368
*ikev2_pld_cert: duplicate cert payload**
**ikev2_resp_recv: failed to parse message*
ikev2_recv: IKE_AUTH request from initiator <client_ip>:50552 to
E.F.84.107:4500 policy 'Verizon' id 1, 4132 bytes
ikev2_recv: ispi 0xa37c52d1ac237b2f rspi 0x4dba64f9bb1b69b2
ikev2_recv: IKE_AUTH request from initiator <client_ip>:50552 to
E.F.84.107:4500 policy 'Verizon' id 1, 4132 bytes
ikev2_recv: ispi 0xa37c52d1ac237b2f rspi 0x4dba64f9bb1b69b2
ikev2_init_ike_sa_timeout: ispi 0xa37c52d1ac237b2f rspi 0x4dba64f9bb1b69b2
sa_free: ispi 0xa37c52d1ac237b2f rspi 0x4dba64f9bb1b69b2
config_free_proposals: free 0x1aecbd748b80
################
The client is Windows 7. I've inserted the certificate authorities, and
the client cert/key in the certificates mmc.
The client is configured as "IKEv2", certificate only.
Could someone please shed some light on why the IPSec negotiation is not
working?
Many thanks,
- Igor
