[strongSwan] "unable to add pseudo IPIP SA with SPI c1bb6ffe: Invalid argument"
Hi! I was forced by a buggy openswan port to try StrongSwan on OpenWRT Backfire 10.03.01 RC6 (pluto did not receive reply packets, if you care). The server is still using OpenSwan. But even after a lot of fiddling with settings I can't get StrongSwan to connect. Here is the info that hopefully allows somebody who knows StrongSwan well to tell me what I need to do to get this to work. I installed these packages (could do a full install for lack of space): strongswan4 - 4.5.2-1 strongswan4-app-charon - 4.5.2-1 strongswan4-app-pluto - 4.5.2-1 strongswan4-minimal - 4.5.2-1 strongswan4-mod-aes - 4.5.2-1 strongswan4-mod-blowfish - 4.5.2-1 strongswan4-mod-constraints - 4.5.2-1 strongswan4-mod-coupling - 4.5.2-1 strongswan4-mod-des - 4.5.2-1 strongswan4-mod-gmp - 4.5.2-1 strongswan4-mod-hmac - 4.5.2-1 strongswan4-mod-kernel-klips - 4.5.2-1 strongswan4-mod-kernel-netlink - 4.5.2-1 strongswan4-mod-md5 - 4.5.2-1 strongswan4-mod-pem - 4.5.2-1 strongswan4-mod-pkcs1 - 4.5.2-1 strongswan4-mod-pubkey - 4.5.2-1 strongswan4-mod-random - 4.5.2-1 strongswan4-mod-revocation - 4.5.2-1 strongswan4-mod-sha1 - 4.5.2-1 strongswan4-mod-sha2 - 4.5.2-1 strongswan4-mod-socket-default - 4.5.2-1 strongswan4-mod-stroke - 4.5.2-1 strongswan4-mod-updown - 4.5.2-1 strongswan4-mod-x509 - 4.5.2-1 strongswan4-mod-xcbc - 4.5.2-1 strongswan4-utils - 4.5.2-1 = StrongSwan config = config setup plutodebug=control # crlcheckinterval=600 # strictcrlpolicy=yes # cachecrls=yes # nat_traversal=yes # charonstart=no # plutostart=no nat_traversal=yes charonstart=yes plutostart=yes conn openswan-server auto=add authby=rsasig keyexchange=ikev1 right=%defaultroute rightsubnet=192.168.1.0/24 rightcert=/etc/ipsec.d/certs/strongswan-clientCert.pem rightsendcert=always rightrsasigkey=%cert rightid="C=DE, ST=Bavaria, O=My Company, OU=IPSec Clients, CN=strongswan-client.mycompany.de, E=lupe.christ...@mycompany.de" left=SERVERIPADDRESS leftcert=/etc/ipsec.d/certs/openswan-serverCert.pem leftrsasigkey=%cert = Openswan config = conn strongswan-client auto=add right=%any rightsubnet=192.168.1.0/24 rightcert=strongswan-clientCert.pem rightnexthop=%defaultroute left=%defaultroute leftcert=openswan-serverCert.pem leftsendcert=never = Output from ipsec up openswan-server = 002 "openswan-server" #1: initiating Main Mode 102 "openswan-server" #1: STATE_MAIN_I1: initiate 003 "openswan-server" #1: ignoring Vendor ID payload [4f45517b4f7f6e657a7b4351] 003 "openswan-server" #1: received Vendor ID payload [Dead Peer Detection] 003 "openswan-server" #1: received Vendor ID payload [RFC 3947] 002 "openswan-server" #1: enabling possible NAT-traversal with method 3 104 "openswan-server" #1: STATE_MAIN_I2: sent MI2, expecting MR2 003 "openswan-server" #1: NAT-Traversal: Result using RFC 3947: no NAT detected 002 "openswan-server" #1: we have a cert and are sending it 106 "openswan-server" #1: STATE_MAIN_I3: sent MI3, expecting MR3 003 "openswan-server" #1: ignoring Vendor ID payload [494b457632] 002 "openswan-server" #1: Peer ID is ID_DER_ASN1_DN: 'C=DE, ST=Bavaria, O=My Company, OU=IPSec Clients, CN=openswan-server.mycompany.de, E=lutz.christ...@mycompany.de' 002 "openswan-server" #1: ISAKMP SA established 004 "openswan-server" #1: STATE_MAIN_I4: ISAKMP SA established 002 "openswan-server" #2: initiating Quick Mode PUBKEY+ENCRYPT+TUNNEL+PFS+UP {using isakmp#1} 110 "openswan-server" #2: STATE_QUICK_I1: initiate 032 "openswan-server" #2: STATE_QUICK_I1: internal error === syslog === Nov 13 13:28:43 janus authpriv.debug pluto[28210]: | Nov 13 13:28:43 janus authpriv.debug pluto[28210]: | *received whack message Nov 13 13:28:43 janus authpriv.debug pluto[28210]: | creating state object #1 at 0x49bbe0 Nov 13 13:28:43 janus authpriv.debug pluto[28210]: | ICOOKIE: 76 08 08 8a f4 3c 2b 8a Nov 13 13:28:43 janus authpriv.debug pluto[28210]: | RCOOKIE: 00 00 00 00 00 00 00 00 Nov 13 13:28:43 janus authpriv.debug pluto[28210]: | peer: 55 d6 9d b0 Nov 13 13:28:43 janus authpriv.debug pluto[28210]: | state hash entry 11 Nov 13 13:28:43 janus authpriv.debug pluto[28210]: | inserting event EVENT_SO_DISCARD, timeout in 0 seconds for #1 Nov 13 13:28:43 janus authpriv.debug pluto[28210]: | Queuing pending Quick Mode with SERVERIPADDRESS "openswan-server" Nov 13 13:28:43 janus authpriv.warn pluto[28210]: "openswan-server" #1: initiating Main Mode Nov 13 13:28:43 janus authpriv.debug pluto[28210]: | ike proposal: AES_CBC_128/HMAC_SHA1/MODP_2048, 3DES_CBC/HMAC_SHA1/MODP_1536, Nov 13 13:28:43 janus authpriv.debug pluto[28210]: | inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #1 Nov 13 13:28:43 janus authpriv.debug pluto[28210]: | next event EVENT_RETRANSMIT in 10 seconds for #1 Nov 13 13:28:43 janus aut
Re: [strongSwan] "unable to add pseudo IPIP SA with SPI c1bb6ffe: Invalid argument"
Hi, > strongswan4-mod-kernel-klips - 4.5.2-1 Please try to remove this module from your build. The kernel-klips plugin was done for a very specific (and rather old) KLIPS release. And depending on whether your kernel actually includes the KLIPS patch or not might never work. So, do you actually use KLIPS? If so, you might have to go back to a 2.x strongSwan release that supported KLIPS. If not, then just use the kernel-netlink plugin. Regards, Tobias ___ Users mailing list Users@lists.strongswan.org https://lists.strongswan.org/mailman/listinfo/users
Re: [strongSwan] "unable to add pseudo IPIP SA with SPI c1bb6ffe: Invalid argument"
On Monday, 2011-11-14 at 14:39:39 +0100, Tobias Brunner wrote: > > strongswan4-mod-kernel-klips - 4.5.2-1 > Please try to remove this module from your build. The kernel-klips > plugin was done for a very specific (and rather old) KLIPS release. And > depending on whether your kernel actually includes the KLIPS patch or > not might never work. So, do you actually use KLIPS? If so, you might > have to go back to a 2.x strongSwan release that supported KLIPS. If > not, then just use the kernel-netlink plugin. This works: 110 "openswan-server" #2: STATE_QUICK_I1: initiate 002 "openswan-server" #2: sent QI2, IPsec SA established {ESP=>0x83c08d51 <0xccb60e59} 004 "openswan-server" #2: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x83c08d51 <0xccb60e59} But, alas, there is no ipsec0 interface generated. I require an interface for my firewall rules. Marking packets is just to error-prone for my taste. This dismerits of the interfaceless implementation have been discussed to death on many mailing lists, and there is no solution. I left FreeBSD because of the lack of an interface to tack firewall rules to, and it seems StrongSwan is just to weak for me, too. So unless you have a way to make StrongSwan support an interface for tunnelled traffic, I will have to concentrate on getting Openswan going on OpenWRT 10.03.1. Thanks for your effort, Luep Christoph -- | It is a well-known fact in any organisation that, if you want a job| | done, you should give it to someone who is already very busy. | | Terry Pratchett, "Unseen Academicals" | ___ Users mailing list Users@lists.strongswan.org https://lists.strongswan.org/mailman/listinfo/users
Re: [strongSwan] "unable to add pseudo IPIP SA with SPI c1bb6ffe: Invalid argument"
Hello Christoph, it is up to you which IPsec package to use. In our opinion the IPsec policy rules offered by Linux netfilter are powerful enough to bind plaintext traffic coming out or going into an IPsec tunnel to any specific firewall rules. Of course a special interface would be nice but this is not how the netfilter framework is set up. Regards Andreas On 11/20/2011 01:55 PM, Lupe Christoph wrote: > On Monday, 2011-11-14 at 14:39:39 +0100, Tobias Brunner wrote: > >>> strongswan4-mod-kernel-klips - 4.5.2-1 > >> Please try to remove this module from your build. The kernel-klips >> plugin was done for a very specific (and rather old) KLIPS release. And >> depending on whether your kernel actually includes the KLIPS patch or >> not might never work. So, do you actually use KLIPS? If so, you might >> have to go back to a 2.x strongSwan release that supported KLIPS. If >> not, then just use the kernel-netlink plugin. > > This works: > > 110 "openswan-server" #2: STATE_QUICK_I1: initiate > 002 "openswan-server" #2: sent QI2, IPsec SA established {ESP=>0x83c08d51 > <0xccb60e59} > 004 "openswan-server" #2: STATE_QUICK_I2: sent QI2, IPsec SA established > {ESP=>0x83c08d51 <0xccb60e59} > > But, alas, there is no ipsec0 interface generated. I require an > interface for my firewall rules. Marking packets is just to error-prone > for my taste. > > This dismerits of the interfaceless implementation have been discussed > to death on many mailing lists, and there is no solution. I left FreeBSD > because of the lack of an interface to tack firewall rules to, and it > seems StrongSwan is just to weak for me, too. > > So unless you have a way to make StrongSwan support an interface for > tunnelled traffic, I will have to concentrate on getting Openswan going > on OpenWRT 10.03.1. > > Thanks for your effort, > Luep Christoph == Andreas Steffen andreas.stef...@strongswan.org strongSwan - the Linux VPN Solution!www.strongswan.org Institute for Internet Technologies and Applications University of Applied Sciences Rapperswil CH-8640 Rapperswil (Switzerland) ===[ITA-HSR]== ___ Users mailing list Users@lists.strongswan.org https://lists.strongswan.org/mailman/listinfo/users