On Fri, Mar 25, 2022 at 12:23:45PM -0500, rea...@catastrophe.net wrote: > The setup is two gateways with IPsec channels setup in tunnel mode > to bridge networks 10.255.255.0/24 and 10.254.255.0/24. Traffic from > server-east:enc0 does not match a SA in place when trying to connect to > httpd on server-west. > > Setup in ASCII art: > > em0:203.0.113.50 -~-~- ipsec tunnel -~-~-~- vio0:100.64.1.92 > | SERVER-WEST | | SERVER-EAST | > enc0:10.255.255.1/24 enc0:10.254.255.1/24 > > When traffic sources from 10.254.255.1 to server-west's httpd, the initial > SYN goes out 100.64.1.92 and does not match the ipsec SA in place: > > flow esp out from 10.254.255.0/24 to 10.255.255.0/24 peer 203.0.113.50 srcid > FQDN/server-east.example.com dstid FQDN/server-west.example.com type require > > However, return traffic on server-west matches an SA already in place and is > sent back over the tunnel to server-east. Here is a pcap from server-west > showing the initial connection; the second packet is the response from > server-west to server-east over the tunnel, etc. > > 11:15:07.595477 100.64.1.92.53545 > 203.0.113.50.80: SWE > 466527235:466527235(0) win 16384 <mss 1460,nop,nop,sackOK,nop,wscale > 6,nop,nop,timestamp 3005156378 0> (DF) > 11:15:07.641673 203.0.113.50 > 100.64.1.92: esp spi 0x5787a1ca seq 1 len 80 > (DF) > 11:15:07.641901 100.64.1.92 > 203.0.113.50: esp spi 0x9a987eb3 seq 1 len 76 > 11:15:11.959583 100.64.1.92.63317 > 203.0.113.50.80: SWE > 321626718:321626718(0) win 16384 <mss 1460,nop,nop,sackOK,nop,wscale > 6,nop,nop,timestamp 891794631 0> (DF) > 11:15:12.005730 203.0.113.50 > 100.64.1.92: esp spi 0x5787a1ca seq 2 len 80 > (DF) > > The SA being match on server-west is: > > esp tunnel from 203.0.113.50 to 100.64.1.92 spi 0x5787a1ca enc aes-256-gcm > > Is something missing in my configs or does anything look obviously broken?
It looks like synproxy in your pf.conf might be the problem. You could try adding a "from 10.254.255.1/24 to 203.0.113.50" flow to your iked config and see if that catches the initial syn or remove the synproxy option in pf to test how that works. > > Many thanks in advance for any help. > > > PF RULES > ======== > > # server-west pf > match in all scrub (no-df random-id max-mss 1440) > match out on em0 inet from 10.255.255.0/24 to any nat-to (em0) round-robin > block drop in log on ! em0 inet from 203.0.113.48/30 to any > block drop log all > pass out proto tcp all modulate state > pass out proto udp from any to any port = 500 > pass out proto udp from any to any port = 4500 > pass out proto esp all > pass out proto ah all > pass out all modulate state > block drop in log from urpf-failed to any label "uRPF" > block drop in log from no-route to any > pass in proto udp from any to 203.0.113.50 port = 500 keep state > pass in proto udp from any to 203.0.113.50 port = 4500 keep state > pass in proto esp from any to 203.0.113.50 > pass in proto ah from any to 203.0.113.50 > pass in inet proto tcp from any to 203.0.113.50 port = 80 flags S/SA synproxy > state (source-track rule, max-src-conn 256, max-src-conn-rate 40/2, overload > <abusive> flush, src.track 2) > pass in inet proto tcp from 100.64.1.92 to 203.0.113.50 port = 5201 flags S/SA > > # server-east pf > match in all scrub (no-df random-id max-mss 1440) > match out on vio0 inet from 10.254.255.0/24 to any nat-to (vio0) round-robin > block drop in log on ! vio0 inet from 100.64.0.0/23 to any > block drop log all > pass out proto tcp all modulate state > pass out proto udp from any to any port = 500 > pass out proto udp from any to any port = 4500 > pass out proto esp all > pass out proto ah all > pass out all modulate state > block drop in log from urpf-failed to any label "uRPF" > block drop in log from no-route to any > pass in inet proto udp from any to 100.64.1.92 port = 500 keep state > pass in inet proto udp from any to 100.64.1.92 port = 4500 keep state > pass in inet proto esp from any to 100.64.1.92 > pass in inet proto ah from any to 100.64.1.92 > pass on enc0 all flags S/SA modulate state (if-bound) tagged VPN.SERVER-WEST > pass on enc0 all flags S/SA modulate state (if-bound) > pass in inet proto tcp from any to 100.64.1.92 port = 80 flags S/SA synproxy > state (source-track rule, max-src-conn 256, max-src-conn-rate 40/2, overload > <abusive> flush, src.track 2) > pass in inet proto tcp from 203.0.113.50 to 100.64.1.92 port = 5201 flags S/SA > > IPSEC FLOWS > =========== > > # server-west flows > FLOWS: > flow esp in from 10.254.255.0/24 to 10.255.255.0/24 peer 100.64.1.92 srcid > FQDN/server-west.example.com dstid FQDN/server-east.example.com type require > flow esp in from 100.64.1.92 to 203.0.113.50 peer 100.64.1.92 srcid > FQDN/server-west.example.com dstid FQDN/server-east.example.com type require > flow esp out from 10.255.255.0/24 to 10.254.255.0/24 peer 100.64.1.92 srcid > FQDN/server-west.example.com dstid FQDN/server-east.example.com type require > flow esp out from 203.0.113.50 to 100.64.1.92 peer 100.64.1.92 srcid > FQDN/server-west.example.com dstid FQDN/server-east.example.com type require > > SAD: > esp tunnel from 203.0.113.50 to 100.64.1.92 spi 0x5787a1ca enc aes-256-gcm > esp tunnel from 100.64.1.92 to 203.0.113.50 spi 0x9a987eb3 enc aes-256-gcm > > # server-east flows > FLOWS: > flow esp in from 10.255.255.0/24 to 10.254.255.0/24 peer 203.0.113.50 srcid > FQDN/server-east.example.com dstid FQDN/server-west.example.com type require > flow esp in from 203.0.113.50 to 100.64.1.92 peer 203.0.113.50 srcid > FQDN/server-east.example.com dstid FQDN/server-west.example.com type require > flow esp out from 10.254.255.0/24 to 10.255.255.0/24 peer 203.0.113.50 srcid > FQDN/server-east.example.com dstid FQDN/server-west.example.com type require > flow esp out from 100.64.1.92 to 203.0.113.50 peer 203.0.113.50 srcid > FQDN/server-east.example.com dstid FQDN/server-west.example.com type require > > SAD: > esp tunnel from 203.0.113.50 to 100.64.1.92 spi 0x5787a1ca enc aes-256-gcm > esp tunnel from 100.64.1.92 to 203.0.113.50 spi 0x9a987eb3 enc aes-256-gcm > > > IKED OUTPUT > =========== > > # server-west `iked -dvv` > create_ike: using unknown for peer server-east.example.com > ikev2 "SERVER-EAST_INET4_NETS" active tunnel esp inet from 10.255.255.0/24 to > 10.254.255.0/24 from 203.0.113.50 to 100.64.1.92 local 203.0.113.50 peer > 100.64.1.92 ikesa enc aes-256-gcm-12 prf hmac-sha2-512 group ecp521 childsa > enc aes-256-gcm group ecp521 esn noesn srcid server-west.example.com dstid > server-east.example.com lifetime 14400 bytes 4294967296 psk > 0x4935535056446657336c2f4643625779364c7075414b764f526a4146545a763332562b79787058657a78454e314d6b34737a6c53434b3863522f3564686b68486443534369445145694d6a756b6f646153654f594c766755427479664c495550 > tag "VPN.ORD" > /etc/iked.conf: loaded 1 configuration rules > ca_privkey_serialize: type RSA_KEY length 1192 > ca_pubkey_serialize: type RSA_KEY length 270 > ca_privkey_to_method: type RSA_KEY method RSA_SIG > ca_getkey: received private key type RSA_KEY length 1192 > ca_getkey: received public key type RSA_KEY length 270 > ca_dispatch_parent: config reset > ca_reload: loaded cert file server-west.example.com.crt > ca_validate_cert: > /C=XX/ST=XXXXXXX/L=XXXXX/O=ANYORG/OU=NA/CN=server-west.example.com/emailAddress=r...@example.com > unable to get local issuer certificate > ca_reload: local cert type RSA_KEY > config_getocsp: ocsp_url none tolerate 0 maxage -1 > ikev2_dispatch_cert: updated local CERTREQ type RSA_KEY length 0 > config_getpolicy: received policy > config_getpfkey: received pfkey fd 3 > config_getcompile: compilation done > config_getsocket: received socket fd 4 > config_getsocket: received socket fd 5 > config_getsocket: received socket fd 6 > config_getsocket: received socket fd 7 > config_getstatic: dpd_check_interval 60 > config_getstatic: no enforcesingleikesa > config_getstatic: no fragmentation > config_getstatic: mobike > config_getstatic: nattport 4500 > config_getstatic: no stickyaddress > policy_lookup: setting policy 'SERVER-EAST_INET4_NETS' > spi=0x128173a042dfdc03: recv IKE_SA_INIT req 0 peer 100.64.1.92:500 local > 203.0.113.50:500, 314 bytes, policy 'SERVER-EAST_INET4_NETS' > ikev2_recv: ispi 0x128173a042dfdc03 rspi 0x0000000000000000 > ikev2_policy2id: srcid FQDN/server-west.example.com length 23 > ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x0000000000000000 > nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x08 msgid 0 length > 314 response 0 > ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 40 > ikev2_pld_sa: more 0 reserved 0 length 36 proposal #1 protoid IKE spisize 0 > xforms 3 spi 0 > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12 > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_521 > ikev2_pld_xform: more 0 reserved 0 length 8 type PRF id HMAC_SHA2_512 > ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 140 > ikev2_pld_ke: dh group ECP_521 reserved 0 > ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00 length 36 > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP > ikev2_nat_detection: peer source 0x128173a042dfdc03 0x0000000000000000 > 100.64.1.92:500 > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_DESTINATION_IP > ikev2_nat_detection: peer destination 0x128173a042dfdc03 0x0000000000000000 > 203.0.113.50:500 > ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length 14 > ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS > ikev2_pld_notify: signature hash SHA2_256 (2) > ikev2_pld_notify: signature hash SHA2_384 (3) > ikev2_pld_notify: signature hash SHA2_512 (4) > proposals_negotiate: score 3 > policy_lookup: setting policy 'SERVER-EAST_INET4_NETS' > spi=0x128173a042dfdc03: sa_state: INIT -> SA_INIT > proposals_negotiate: score 3 > sa_stateok: SA_INIT flags 0x0000, require 0x0000 > sa_stateflags: 0x0000 -> 0x0020 sa (required 0x0000 ) > spi=0x128173a042dfdc03: ikev2_sa_keys: DHSECRET with 66 bytes > ikev2_sa_keys: SKEYSEED with 64 bytes > spi=0x128173a042dfdc03: ikev2_sa_keys: S with 80 bytes > ikev2_prfplus: T1 with 64 bytes > ikev2_prfplus: T2 with 64 bytes > ikev2_prfplus: T3 with 64 bytes > ikev2_prfplus: T4 with 64 bytes > ikev2_prfplus: T5 with 64 bytes > ikev2_prfplus: Tn with 320 bytes > ikev2_sa_keys: SK_d with 64 bytes > ikev2_sa_keys: SK_ei with 36 bytes > ikev2_sa_keys: SK_er with 36 bytes > ikev2_sa_keys: SK_pi with 64 bytes > ikev2_sa_keys: SK_pr with 64 bytes > ikev2_add_proposals: length 36 > ikev2_next_payload: length 40 nextpayload KE > ikev2_next_payload: length 140 nextpayload NONCE > ikev2_next_payload: length 36 nextpayload NOTIFY > ikev2_nat_detection: local source 0x128173a042dfdc03 0x22c5f5ccef9637bf > 203.0.113.50:500 > ikev2_next_payload: length 28 nextpayload NOTIFY > ikev2_nat_detection: local destination 0x128173a042dfdc03 0x22c5f5ccef9637bf > 100.64.1.92:500 > ikev2_next_payload: length 28 nextpayload NOTIFY > ikev2_next_payload: length 14 nextpayload NONE > ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf > nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x20 msgid 0 length > 314 response 1 > ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 40 > ikev2_pld_sa: more 0 reserved 0 length 36 proposal #1 protoid IKE spisize 0 > xforms 3 spi 0 > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12 > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_512 > ikev2_pld_xform: more 0 reserved 0 length 8 type DH id ECP_521 > ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 140 > ikev2_pld_ke: dh group ECP_521 reserved 0 > ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00 length 36 > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_DESTINATION_IP > ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length 14 > ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS > spi=0x128173a042dfdc03: send IKE_SA_INIT res 0 peer 100.64.1.92:500 local > 203.0.113.50:500, 314 bytes > config_free_proposals: free 0xbfa96fa9580 > spi=0x128173a042dfdc03: recv IKE_AUTH req 1 peer 100.64.1.92:500 local > 203.0.113.50:500, 276 bytes, policy 'SERVER-EAST_INET4_NETS' > ikev2_recv: ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf > ikev2_recv: updated SA to peer 100.64.1.92:500 local 203.0.113.50:500 > ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf > nextpayload SK version 0x20 exchange IKE_AUTH flags 0x08 msgid 1 length 276 > response 0 > ikev2_pld_payloads: payload SK nextpayload IDi critical 0x00 length 248 > ikev2_msg_decrypt: IV length 8 > ikev2_msg_decrypt: encrypted payload length 224 > ikev2_msg_decrypt: integrity checksum length 12 > ikev2_msg_decrypt: AAD length 32 > ikev2_msg_decrypt: decrypted payload length 224/224 padding 0 > ikev2_pld_payloads: decrypted payload IDi nextpayload AUTH critical 0x00 > length 27 > ikev2_pld_id: id FQDN/server-east.example.com length 23 > ikev2_pld_payloads: decrypted payload AUTH nextpayload SA critical 0x00 > length 72 > ikev2_pld_auth: method SHARED_KEY_MIC length 64 > ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00 length > 44 > ikev2_pld_sa: more 0 reserved 0 length 40 proposal #1 protoid ESP spisize 4 > xforms 3 spi 0x5787a1ca > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_16 > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 > ikev2_pld_xform: more 3 reserved 0 length 8 type ESN id ESN > ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id NONE > ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00 > length 40 > ikev2_pld_tss: count 2 length 32 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 10.254.255.0 end 10.254.255.255 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 100.64.1.92 end 100.64.1.92 > ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00 > length 40 > ikev2_pld_tss: count 2 length 32 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 10.255.255.0 end 10.255.255.255 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 203.0.113.50 end 203.0.113.50 > sa_stateok: SA_INIT flags 0x0000, require 0x0000 > spi=0x128173a042dfdc03: sa_state: SA_INIT -> AUTH_REQUEST > policy_lookup: peerid 'server-east.example.com' > proposals_negotiate: score 3 > policy_lookup: setting policy 'SERVER-EAST_INET4_NETS' > ikev2_msg_auth: responder auth data length 410 > proposals_negotiate: score 2 > sa_stateflags: 0x0028 -> 0x0028 auth,sa (required 0x0038 auth,authvalid,sa) > ikev2_msg_auth: initiator auth data length 410 > ikev2_msg_authverify: method SHARED_KEY_MIC keylen 64 type NONE > ikev2_msg_authverify: authentication successful > spi=0x128173a042dfdc03: sa_state: AUTH_REQUEST -> AUTH_SUCCESS > sa_stateflags: 0x0028 -> 0x0038 auth,authvalid,sa (required 0x0038 > auth,authvalid,sa) > sa_stateok: VALID flags 0x0038, require 0x0038 auth,authvalid,sa > spi=0x128173a042dfdc03: sa_state: AUTH_SUCCESS -> VALID > sa_stateok: VALID flags 0x0038, require 0x0038 auth,authvalid,sa > sa_stateok: VALID flags 0x0038, require 0x0038 auth,authvalid,sa > ikev2_sa_tag: VPN.ORD (7) > ikev2_childsa_negotiate: proposal 1 > ikev2_childsa_negotiate: key material length 72 > ikev2_prfplus: T1 with 64 bytes > ikev2_prfplus: T2 with 64 bytes > ikev2_prfplus: Tn with 128 bytes > pfkey_sa_getspi: spi 0x9a987eb3 > pfkey_sa_init: new spi 0x9a987eb3 > ikev2_next_payload: length 27 nextpayload AUTH > ikev2_next_payload: length 72 nextpayload SA > ikev2_add_proposals: length 32 > ikev2_next_payload: length 36 nextpayload TSi > ikev2_next_payload: length 40 nextpayload TSr > ikev2_next_payload: length 40 nextpayload NONE > ikev2_next_payload: length 240 nextpayload IDr > ikev2_msg_encrypt: decrypted length 215 > ikev2_msg_encrypt: padded length 216 > ikev2_msg_encrypt: length 216, padding 0, output length 236 > ikev2_msg_integr: message length 268 > ikev2_msg_integr: integrity checksum length 12 > ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf > nextpayload SK version 0x20 exchange IKE_AUTH flags 0x20 msgid 1 length 268 > response 1 > ikev2_pld_payloads: payload SK nextpayload IDr critical 0x00 length 240 > ikev2_msg_decrypt: IV length 8 > ikev2_msg_decrypt: encrypted payload length 216 > ikev2_msg_decrypt: integrity checksum length 12 > ikev2_msg_decrypt: AAD length 32 > ikev2_msg_decrypt: decrypted payload length 216/216 padding 0 > ikev2_pld_payloads: decrypted payload IDr nextpayload AUTH critical 0x00 > length 27 > ikev2_pld_id: id FQDN/server-west.example.com length 23 > ikev2_pld_payloads: decrypted payload AUTH nextpayload SA critical 0x00 > length 72 > ikev2_pld_auth: method SHARED_KEY_MIC length 64 > ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00 length > 36 > ikev2_pld_sa: more 0 reserved 0 length 32 proposal #1 protoid ESP spisize 4 > xforms 2 spi 0x9a987eb3 > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_16 > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 > ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id ESN > ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00 > length 40 > ikev2_pld_tss: count 2 length 32 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 10.254.255.0 end 10.254.255.255 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 100.64.1.92 end 100.64.1.92 > ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00 > length 40 > ikev2_pld_tss: count 2 length 32 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 10.255.255.0 end 10.255.255.255 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 203.0.113.50 end 203.0.113.50 > spi=0x128173a042dfdc03: send IKE_AUTH res 1 peer 100.64.1.92:500 local > 203.0.113.50:500, 268 bytes > pfkey_sa_add: update spi 0x9a987eb3 > ikev2_childsa_enable: loaded CHILD SA spi 0x9a987eb3 > pfkey_sa_add: add spi 0x5787a1ca > ikev2_childsa_enable: loaded CHILD SA spi 0x5787a1ca > ikev2_childsa_enable: loaded flow 0xbfa96fb1800 > ikev2_childsa_enable: loaded flow 0xbfa96fc1c00 > ikev2_childsa_enable: loaded flow 0xbfa96fb3c00 > ikev2_childsa_enable: loaded flow 0xbfa96fc1000 > ikev2_childsa_enable: remember SA peer 100.64.1.92:500 > spi=0x128173a042dfdc03: ikev2_childsa_enable: loaded SPIs: 0x9a987eb3, > 0x5787a1ca (enc aes-256-gcm esn) > spi=0x128173a042dfdc03: ikev2_childsa_enable: loaded flows: > ESP-10.255.255.0/24=10.254.255.0/24(0), ESP-203.0.113.50/32=100.64.1.92/32(0) > spi=0x128173a042dfdc03: sa_state: VALID -> ESTABLISHED from 100.64.1.92:500 > to 203.0.113.50:500 policy 'SERVER-EAST_INET4_NETS' > spi=0x128173a042dfdc03: established peer > 100.64.1.92:500[FQDN/server-east.example.com] local > 203.0.113.50:500[FQDN/server-west.example.com] policy > 'SERVER-EAST_INET4_NETS' as responder (enc aes-256-gcm-12 group ecp521 prf > hmac-sha2-512) > config_free_proposals: free 0xbfa96fa9a00 > ikev2_init_ike_sa: "SERVER-EAST_INET4_NETS" is already active > config_doreset: flushing policies > config_doreset: flushing SAs > config_free_proposals: free 0xbfa96fd5180 > config_free_proposals: free 0xbfa96fd9200 > config_free_childsas: free 0xbfa96fa0600 > config_free_childsas: free 0xbfa96fa1800 > sa_free_flows: free 0xbfa96fb1800 > sa_free_flows: free 0xbfa96fc1c00 > sa_free_flows: free 0xbfa96fb3c00 > sa_free_flows: free 0xbfa96fc1000 > config_free_proposals: free 0xbfa96fa9600 > config_free_proposals: free 0xbfa96fa9080 > config_free_flows: free 0xbfa96fd7400 > config_free_flows: free 0xbfa96fd7000 > ca exiting, pid 22311 > control exiting, pid 78978 > config_doreset: flushing users > ikev2 exiting, pid 37133 > parent terminating > > # server-east `iked -dvv` > create_ike: using unknown for peer server-west.example.com > ikev2 "SERVER-WEST_INET4_NETS" active tunnel esp inet from 10.254.255.0/24 to > 10.255.255.0/24 from 100.64.1.92 to 203.0.113.50 local 100.64.1.92 peer > 203.0.113.50 ikesa enc aes-256-gcm-12 prf hmac-sha2-512 group ecp521 childsa > enc aes-256-gcm group ecp521 esn noesn srcid server-east.example.com dstid > SERVER-WEST.example.com lifetime 14400 bytes 4294967296 psk > 0x4935535056446657336c2f4643625779364c7075414b764f526a4146545a763332562b79787058657a78454e314d6b34737a6c53434b3863522f3564686b68486443534369445145694d6a756b6f646153654f594c766755427479664c495550 > tag "VPN.SERVER-WEST" > /etc/iked.conf: loaded 1 configuration rules > ca_privkey_serialize: type RSA_KEY length 1191 > ca_pubkey_serialize: type RSA_KEY length 270 > ca_privkey_to_method: type RSA_KEY method RSA_SIG > ca_getkey: received private key type RSA_KEY length 1191 > ca_getkey: received public key type RSA_KEY length 270 > ca_dispatch_parent: config reset > ca_reload: local cert type RSA_KEY > config_getocsp: ocsp_url none tolerate 0 maxage -1 > ikev2_dispatch_cert: updated local CERTREQ type RSA_KEY length 0 > config_getpolicy: received policy > config_getpfkey: received pfkey fd 3 > config_getcompile: compilation done > config_getsocket: received socket fd 4 > config_getsocket: received socket fd 5 > config_getsocket: received socket fd 6 > config_getsocket: received socket fd 7 > config_getstatic: dpd_check_interval 60 > config_getstatic: no enforcesingleikesa > config_getstatic: no fragmentation > config_getstatic: mobike > config_getstatic: nattport 4500 > config_getstatic: no stickyaddress > ikev2_init_ike_sa: initiating "SERVER-WEST_INET4_NETS" > ikev2_policy2id: srcid FQDN/server-east.example.com length 23 > ikev2_add_proposals: length 36 > ikev2_next_payload: length 40 nextpayload KE > ikev2_next_payload: length 140 nextpayload NONCE > ikev2_next_payload: length 36 nextpayload NOTIFY > ikev2_nat_detection: local source 0x128173a042dfdc03 0x0000000000000000 > 100.64.1.92:500 > ikev2_next_payload: length 28 nextpayload NOTIFY > ikev2_nat_detection: local destination 0x128173a042dfdc03 0x0000000000000000 > 203.0.113.50:500 > ikev2_next_payload: length 28 nextpayload NOTIFY > ikev2_next_payload: length 14 nextpayload NONE > ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x0000000000000000 > nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x08 msgid 0 length > 314 response 0 > ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 40 > ikev2_pld_sa: more 0 reserved 0 length 36 proposal #1 protoid IKE spisize 0 > xforms 3 spi 0 > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12 > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_521 > ikev2_pld_xform: more 0 reserved 0 length 8 type PRF id HMAC_SHA2_512 > ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 140 > ikev2_pld_ke: dh group ECP_521 reserved 0 > ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00 length 36 > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_DESTINATION_IP > ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length 14 > ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS > spi=0x128173a042dfdc03: send IKE_SA_INIT req 0 peer 203.0.113.50:500 local > 100.64.1.92:500, 314 bytes > spi=0x128173a042dfdc03: sa_state: INIT -> SA_INIT > spi=0x128173a042dfdc03: retransmit 1 IKE_SA_INIT req 0 peer 203.0.113.50:500 > local 100.64.1.92:500 > spi=0x128173a042dfdc03: retransmit 2 IKE_SA_INIT req 0 peer 203.0.113.50:500 > local 100.64.1.92:500 > spi=0x128173a042dfdc03: recv IKE_SA_INIT res 0 peer 203.0.113.50:500 local > 100.64.1.92:500, 314 bytes, policy 'SERVER-WEST_INET4_NETS' > ikev2_recv: ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf > ikev2_recv: updated SA to peer 203.0.113.50:500 local 100.64.1.92:500 > ikev2_policy2id: srcid FQDN/server-east.example.com length 23 > ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf > nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x20 msgid 0 length > 314 response 1 > ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 40 > ikev2_pld_sa: more 0 reserved 0 length 36 proposal #1 protoid IKE spisize 0 > xforms 3 spi 0 > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12 > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_512 > ikev2_pld_xform: more 0 reserved 0 length 8 type DH id ECP_521 > ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 140 > ikev2_pld_ke: dh group ECP_521 reserved 0 > ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00 length 36 > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP > ikev2_nat_detection: peer source 0x128173a042dfdc03 0x22c5f5ccef9637bf > 203.0.113.50:500 > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_DESTINATION_IP > ikev2_nat_detection: peer destination 0x128173a042dfdc03 0x22c5f5ccef9637bf > 100.64.1.92:500 > ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length 14 > ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS > ikev2_pld_notify: signature hash SHA2_256 (2) > ikev2_pld_notify: signature hash SHA2_384 (3) > ikev2_pld_notify: signature hash SHA2_512 (4) > proposals_negotiate: score 3 > sa_stateok: SA_INIT flags 0x0000, require 0x0008 auth > spi=0x128173a042dfdc03: ikev2_sa_keys: DHSECRET with 66 bytes > ikev2_sa_keys: SKEYSEED with 64 bytes > spi=0x128173a042dfdc03: ikev2_sa_keys: S with 80 bytes > ikev2_prfplus: T1 with 64 bytes > ikev2_prfplus: T2 with 64 bytes > ikev2_prfplus: T3 with 64 bytes > ikev2_prfplus: T4 with 64 bytes > ikev2_prfplus: T5 with 64 bytes > ikev2_prfplus: Tn with 320 bytes > ikev2_sa_keys: SK_d with 64 bytes > ikev2_sa_keys: SK_ei with 36 bytes > ikev2_sa_keys: SK_er with 36 bytes > ikev2_sa_keys: SK_pi with 64 bytes > ikev2_sa_keys: SK_pr with 64 bytes > ikev2_msg_auth: initiator auth data length 410 > sa_stateok: SA_INIT flags 0x0008, require 0x0008 auth > ikev2_next_payload: length 27 nextpayload AUTH > spi=0x128173a042dfdc03: ikev2_cp_request_configured: no > ikev2_next_payload: length 72 nextpayload SA > pfkey_sa_getspi: spi 0x5787a1ca > pfkey_sa_init: new spi 0x5787a1ca > ikev2_add_proposals: length 40 > ikev2_next_payload: length 44 nextpayload TSi > ikev2_next_payload: length 40 nextpayload TSr > ikev2_next_payload: length 40 nextpayload NONE > ikev2_next_payload: length 248 nextpayload IDi > ikev2_msg_encrypt: decrypted length 223 > ikev2_msg_encrypt: padded length 224 > ikev2_msg_encrypt: length 224, padding 0, output length 244 > ikev2_msg_integr: message length 276 > ikev2_msg_integr: integrity checksum length 12 > ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf > nextpayload SK version 0x20 exchange IKE_AUTH flags 0x08 msgid 1 length 276 > response 0 > ikev2_pld_payloads: payload SK nextpayload IDi critical 0x00 length 248 > ikev2_msg_decrypt: IV length 8 > ikev2_msg_decrypt: encrypted payload length 224 > ikev2_msg_decrypt: integrity checksum length 12 > ikev2_msg_decrypt: AAD length 32 > ikev2_msg_decrypt: decrypted payload length 224/224 padding 0 > ikev2_pld_payloads: decrypted payload IDi nextpayload AUTH critical 0x00 > length 27 > ikev2_pld_id: id FQDN/server-east.example.com length 23 > ikev2_pld_payloads: decrypted payload AUTH nextpayload SA critical 0x00 > length 72 > ikev2_pld_auth: method SHARED_KEY_MIC length 64 > ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00 length > 44 > ikev2_pld_sa: more 0 reserved 0 length 40 proposal #1 protoid ESP spisize 4 > xforms 3 spi 0x5787a1ca > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_16 > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 > ikev2_pld_xform: more 3 reserved 0 length 8 type ESN id ESN > ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id NONE > ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00 > length 40 > ikev2_pld_tss: count 2 length 32 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 10.254.255.0 end 10.254.255.255 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 100.64.1.92 end 100.64.1.92 > ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00 > length 40 > ikev2_pld_tss: count 2 length 32 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 10.255.255.0 end 10.255.255.255 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 203.0.113.50 end 203.0.113.50 > spi=0x128173a042dfdc03: send IKE_AUTH req 1 peer 203.0.113.50:500 local > 100.64.1.92:500, 276 bytes > config_free_proposals: free 0xd12437e8780 > spi=0x128173a042dfdc03: recv IKE_AUTH res 1 peer 203.0.113.50:500 local > 100.64.1.92:500, 268 bytes, policy 'SERVER-WEST_INET4_NETS' > ikev2_recv: ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf > ikev2_recv: updated SA to peer 203.0.113.50:500 local 100.64.1.92:500 > ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf > nextpayload SK version 0x20 exchange IKE_AUTH flags 0x20 msgid 1 length 268 > response 1 > ikev2_pld_payloads: payload SK nextpayload IDr critical 0x00 length 240 > ikev2_msg_decrypt: IV length 8 > ikev2_msg_decrypt: encrypted payload length 216 > ikev2_msg_decrypt: integrity checksum length 12 > ikev2_msg_decrypt: AAD length 32 > ikev2_msg_decrypt: decrypted payload length 216/216 padding 0 > ikev2_pld_payloads: decrypted payload IDr nextpayload AUTH critical 0x00 > length 27 > ikev2_pld_id: id FQDN/SERVER-WEST.example.com length 23 > ikev2_pld_payloads: decrypted payload AUTH nextpayload SA critical 0x00 > length 72 > ikev2_pld_auth: method SHARED_KEY_MIC length 64 > ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00 length > 36 > ikev2_pld_sa: more 0 reserved 0 length 32 proposal #1 protoid ESP spisize 4 > xforms 2 spi 0x9a987eb3 > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_16 > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 > ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id ESN > ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00 > length 40 > ikev2_pld_tss: count 2 length 32 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 10.254.255.0 end 10.254.255.255 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 100.64.1.92 end 100.64.1.92 > ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00 > length 40 > ikev2_pld_tss: count 2 length 32 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 10.255.255.0 end 10.255.255.255 > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport > 65535 > ikev2_pld_ts: start 203.0.113.50 end 203.0.113.50 > spi=0x128173a042dfdc03: sa_state: SA_INIT -> AUTH_REQUEST > policy_lookup: peerid 'SERVER-WEST.example.com' > proposals_negotiate: score 3 > policy_lookup: setting policy 'SERVER-WEST_INET4_NETS' > proposals_negotiate: score 2 > sa_stateflags: 0x0008 -> 0x0028 auth,sa (required 0x0030 authvalid,sa) > ikev2_msg_auth: responder auth data length 410 > ikev2_msg_authverify: method SHARED_KEY_MIC keylen 64 type NONE > ikev2_msg_authverify: authentication successful > spi=0x128173a042dfdc03: sa_state: AUTH_REQUEST -> AUTH_SUCCESS > sa_stateflags: 0x0028 -> 0x0038 auth,authvalid,sa (required 0x0030 > authvalid,sa) > sa_stateok: VALID flags 0x0030, require 0x0030 authvalid,sa > spi=0x128173a042dfdc03: sa_state: AUTH_SUCCESS -> VALID > sa_stateok: VALID flags 0x0030, require 0x0030 authvalid,sa > sa_stateok: VALID flags 0x0030, require 0x0030 authvalid,sa > ikev2_sa_tag: VPN.SERVER-WEST (7) > ikev2_childsa_negotiate: proposal 1 > ikev2_childsa_negotiate: key material length 72 > ikev2_prfplus: T1 with 64 bytes > ikev2_prfplus: T2 with 64 bytes > ikev2_prfplus: Tn with 128 bytes > pfkey_sa_add: add spi 0x9a987eb3 > ikev2_childsa_enable: loaded CHILD SA spi 0x9a987eb3 > pfkey_sa_add: update spi 0x5787a1ca > ikev2_childsa_enable: loaded CHILD SA spi 0x5787a1ca > ikev2_childsa_enable: loaded flow 0xd12437cd800 > ikev2_childsa_enable: loaded flow 0xd12437cd000 > ikev2_childsa_enable: loaded flow 0xd12437d4000 > ikev2_childsa_enable: loaded flow 0xd12437cd400 > ikev2_childsa_enable: remember SA peer 203.0.113.50:500 > spi=0x128173a042dfdc03: ikev2_childsa_enable: loaded SPIs: 0x9a987eb3, > 0x5787a1ca (enc aes-256-gcm esn) > spi=0x128173a042dfdc03: ikev2_childsa_enable: loaded flows: > ESP-10.254.255.0/24=10.255.255.0/24(0), ESP-100.64.1.92/32=203.0.113.50/32(0) > spi=0x128173a042dfdc03: sa_state: VALID -> ESTABLISHED from 203.0.113.50:500 > to 100.64.1.92:500 policy 'SERVER-WEST_INET4_NETS' > spi=0x128173a042dfdc03: established peer > 203.0.113.50:500[FQDN/SERVER-WEST.example.com] local > 100.64.1.92:500[FQDN/server-east.example.com] policy 'SERVER-WEST_INET4_NETS' > as initiator (enc aes-256-gcm-12 group ecp521 prf hmac-sha2-512) > config_free_proposals: free 0xd12437d7a80 > config_doreset: flushing policies > config_doreset: flushing SAs > config_free_proposals: free 0xd12437e8c80 > config_free_proposals: free 0xd12437d7680 > config_free_childsas: free 0xd1243801d00 > ca exiting, pid 82293 > control exiting, pid 62242 > config_free_childsas: free 0xd12437f0800 > sa_free_flows: free 0xd12437cd800 > pfkey_reply: not found > sa_free_flows: free 0xd12437cd000 > pfkey_reply: not found > sa_free_flows: free 0xd12437d4000 > pfkey_reply: not found > sa_free_flows: free 0xd12437cd400 > pfkey_reply: not found > config_free_proposals: free 0xd12437e8900 > config_free_proposals: free 0xd12437e6000 > config_free_flows: free 0xd12437f1000 > config_free_flows: free 0xd12437f1c00 > config_doreset: flushing users > ikev2 exiting, pid 56694 > parent terminating >
