[strongSwan] Nokia VPN Client & IKEv2

2009-12-18 Thread Robert Markula
Hi, I'm currently banging my head against the wall in trying to get a Nokia E71 (Nokia VPN Client 3.1) connect to strongswan 4.2.9. It fails with the following error on the Symbian VPN Client Log: Error: Failed to activate VPN access point 'VPN nokia', reason code -15 As far as I can see, the tun

Re: [strongSwan] Nokia VPN Client & IKEv2

2009-12-18 Thread Robert Markula
Robert Markula wrote: > And below is the relevant output of /var/log/daemon.log (all IP > addresses and domains are purely fictional) - for better readability > please see http://paste.debian.net/54362/: The link should be without the colon, of course: http://paste.debian.net/54362

Re: [strongSwan] Nokia VPN Client & IKEv2

2009-12-21 Thread sbergman
Hi, It has been a while since I tested Nokia VPN with S60 3.1 phone, but back then I was able to get it work. In this kind of situation, there are few steps I would do: First I would download the latest versions of the Nokia mobile VPN client and the policy tool from: http://europe.nokia.com

Re: [strongSwan] Nokia VPN Client & IKEv2

2009-12-21 Thread Robert Markula
Hi Simo, sberg...@cc.hut.fi wrote: > Hi, > > It has been a while since I tested Nokia VPN with S60 3.1 phone, but > back then I was able to get it work. > > In this kind of situation, there are few steps I would do: > First I would download the latest versions of the Nokia mobile VPN > clien

Re: [strongSwan] Nokia VPN Client & IKEv2

2009-12-22 Thread Thomas Jarosch
Hello Robert, On Tuesday, 22. December 2009 00:26:51 Robert Markula wrote: > Good idea, I just tested it - the PSK authentication works flawlessly. > But as soon as RSA is involved, the phone's VPN client (I use the latest > version) is deaf. > > Some posts on the internet (e.g. [1]) suggest that

Re: [strongSwan] Nokia VPN Client & IKEv2

2009-12-22 Thread sbergman
Hi Robert, I have been using strongSwan and Nokia VPN Client with certs for years now. Sometime the configuration has been bit tricky, but so far I have always been able to get it work at the end. My default check list with certs is: 1. In the phone VPN settings find the poliview and check th

Re: [strongSwan] Nokia VPN Client & IKEv2

2009-12-22 Thread Robert Markula
Hi Thomas, Thomas Jarosch wrote: > On a side note: I had good experiences with the "NCP Security Client > for Symbian" using RSA signatures and strongswan. Though it's IKEv1 only. > There's a third day evaluation version available: > http://www.ncp-e.com/index.php?id=92&L=1 > > Configuration is l

Re: [strongSwan] Nokia VPN Client & IKEv2

2009-12-22 Thread Robert Markula
Hi Simo, sberg...@cc.hut.fi wrote: > I have been using strongSwan and Nokia VPN Client with certs for years > now. Sometime the configuration has been bit tricky, but so far I have > always been able to get it work at the end. Okay, that's reassuring. > My default check list with certs is: >

Re: [strongSwan] Nokia VPN Client & IKEv2

2009-12-22 Thread Andreas Steffen
You should select a Remote ID that is contained in the strongSwan certificate: Either the subject Distinquished Name or a hostname or email address defined as a subjectAltName. In principle you could also put an IP address into a subjectAltName but this is rarely used. Regards Andreas Robert Mar

Re: [strongSwan] Nokia VPN Client & IKEv2

2009-12-22 Thread Robert Markula
Hello Andreas, Andreas Steffen wrote: > You should select a Remote ID that is contained in the strongSwan > certificate: Either the subject Distinquished Name or a hostname > or email address defined as a subjectAltName. In principle you > could also put an IP address into a subjectAltName but thi

Re: [strongSwan] Nokia VPN Client & IKEv2

2009-12-22 Thread Andreas Steffen
Robert Markula wrote: > Hello Andreas, > > Andreas Steffen wrote: >> You should select a Remote ID that is contained in the strongSwan >> certificate: Either the subject Distinquished Name or a hostname >> or email address defined as a subjectAltName. In principle you >> could also put an IP addre

Re: [strongSwan] Nokia VPN Client & IKEv2

2009-12-22 Thread Daniel Mentz
Robert Markula wrote: > If the subjectAltName = DNS:cray.home.ro, this would be "cray.home.ro", > right? Yes > And, one final question: if using the subjectAltName or the Subject DN, > what kind of "Remote ID type" would that be on the client side? > "RCF_822_NAME" or "FQDN"? I guess it's ID_DER