try:
remote_peer_type=cisco
esp=aes-sha1;modp1024
Paul
Hey Paul,
Thanks so much for your continued help with this. Unfortunately, I
continue to struggle. I found what I believe is an acceptable phase 2
proposal in 3des-sha1, discovered by reviewing the debug logs from a
successful tunnel connection from vpnc.
I've tried migrating the configs into two different boxes; a RHEL 6.4
system running openswan-2.6.32-19.el6_3 and a Fedora 20 Live USB running
libreswan-3.6-1.fc20. The RHEL box crashes pluto with a signal 11
(again! - even though I think we have an acceptable proposal) and the
Fedora 20 box doesn't die, complains of a duplicate packet during quick
mode. Oddly enough I end up with an updated /etc/resolv.conf but no IP
alias and no routes added.
RHEL logs (this is /var/log/secure and /var/log/messages together so the
ipsec messages and daemon crash are shown together timing-wise):
Jul 9 20:15:04 bentz pluto[18134]: "conn" #1: XAUTH: Successfully
Authenticated
Jul 9 20:15:04 bentz pluto[18134]: "conn" #1: transition from state
STATE_XAUTH_I0 to state STATE_XAUTH_I1
Jul 9 20:15:04 bentz pluto[18134]: "conn" #1: STATE_XAUTH_I1: XAUTH
client - awaiting CFG_set
Jul 9 20:15:04 bentz pluto[18134]: "conn" #1: modecfg: Sending IP
request (MODECFG_I1)
Jul 9 20:15:05 bentz pluto[18134]: "conn" #1: received mode cfg reply
Jul 9 20:15:05 bentz pluto[18134]: "conn" #1: setting client address to
192.168.0.79/32
Jul 9 20:15:05 bentz pluto[18134]: "conn" #1: setting ip source address
to 192.168.0.79/32
Jul 9 20:15:05 bentz pluto[18134]: "conn" #1: Received IP4 NETMASK
255.255.255.0
Jul 9 20:15:05 bentz pluto[18134]: "conn" #1: Received DNS 10.0.0.20,
len=10
Jul 9 20:15:05 bentz pluto[18134]: | Cisco DNS info: 10.0.0.20, len=10
Jul 9 20:15:05 bentz pluto[18134]: "conn" #1: Received DNS 10.0.0.240,
len=10
Jul 9 20:15:05 bentz pluto[18134]: | Cisco DNS info: 10.0.0.20
10.0.0.240, len=21
Jul 9 20:15:05 bentz pluto[18134]: "conn" #1: transition from state
STATE_MODE_CFG_I1 to state STATE_MAIN_I4
Jul 9 20:15:05 bentz pluto[18134]: "conn" #1: STATE_MAIN_I4: ISAKMP SA
established
Jul 9 20:15:05 bentz pluto[18134]: "conn" #2: initiating Quick Mode
PSK+ENCRYPT+TUNNEL+DONTREKEY+UP+AGGRESSIVE {using isakmp#1
msgid:d45f73bf proposal=3DES(3)_192-SHA1(2)_160 pfsgroup=no-pfs}
Jul 9 20:15:05 bentz ipsec__plutorun: /usr/libexec/ipsec/_plutorun:
line 250: 18134 Segmentation fault /usr/libexec/ipsec/pluto
--nofork --secretsfile /etc/ipsec.secrets --ipsecdir /etc/ipsec.d
--use-netkey --uniqueids --nat_traversal --virtual_private oe=off
Jul 9 20:15:05 bentz ipsec__plutorun: !pluto failure!: exited with
error status 139 (signal 11)
Jul 9 20:15:05 bentz ipsec__plutorun: restarting IPsec after pause...
Jul 9 20:15:15 bentz ipsec_setup: Stopping Openswan IPsec...
Jul 9 20:15:15 bentz ipsec_setup: Removing orphaned
/var/run/pluto/pluto.pid:
Jul 9 20:15:15 bentz ipsec_setup: ...Openswan IPsec stopped
Jul 9 20:15:15 bentz ipsec_setup: Starting Openswan IPsec
U2.6.32/K2.6.32-358.el6.x86_64...
Jul 9 20:15:15 bentz ipsec_setup: Using NETKEY(XFRM) stack
Jul 9 20:15:15 bentz ipsec_setup: /usr/libexec/ipsec/addconn Non-fips
mode set in /proc/sys/crypto/fips_enabled
Jul 9 20:15:15 bentz ipsec__plutorun: Starting Pluto subsystem...
Jul 9 20:15:15 bentz ipsec_setup: ...Openswan IPsec started
Jul 9 20:15:15 bentz ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d
Jul 9 20:15:15 bentz pluto: adjusting ipsec.d to /etc/ipsec.d
Jul 9 20:15:15 bentz ipsec__plutorun: /usr/libexec/ipsec/addconn
Non-fips mode set in /proc/sys/crypto/fips_enabled
Jul 9 20:15:15 bentz ipsec__plutorun: /usr/libexec/ipsec/addconn
Non-fips mode set in /proc/sys/crypto/fips_enabled
Jul 9 20:15:15 bentz ipsec__plutorun: /usr/libexec/ipsec/addconn
Non-fips mode set in /proc/sys/crypto/fips_enabled
Jul 9 20:15:16 bentz pluto[18353]: nss directory plutomain: /etc/ipsec.d
Jul 9 20:15:16 bentz pluto[18353]: NSS Initialized
Jul 9 20:15:16 bentz pluto[18353]: Non-fips mode set in
/proc/sys/crypto/fips_enabled
Jul 9 20:15:16 bentz pluto[18353]: Starting Pluto (Openswan Version
2.6.32; Vendor ID OEhyLdACecfa) pid:18353
Here's the Fedora journalctl -f output:
Jul 09 20:37:26 localhost pluto[2804]: "conn" #1: XAUTH: Successfully
Authenticated
Jul 09 20:37:26 localhost pluto[2804]: "conn" #1: transition from state
STATE_XAUTH_I0 to state STATE_XAUTH_I1
Jul 09 20:37:26 localhost pluto[2804]: "conn" #1: STATE_XAUTH_I1: XAUTH
client - awaiting CFG_set
Jul 09 20:37:26 localhost pluto[2804]: "conn" #1: modecfg: Sending IP
request (MODECFG_I1)
Jul 09 20:37:26 localhost pluto[2804]: "conn" #1: received mode cfg reply
Jul 09 20:37:26 localhost pluto[2804]: "conn" #1: Received IPv4 address:
192.168.0.38/32
Jul 09 20:37:26 localhost pluto[2804]: "conn" #1: setting ip source
address to 192.168.0.38/32
Jul 09 20:37:26 localhost pluto[2804]: "conn" #1: Received IP4 NETMASK
255.255.255.0
Jul 09 20:37:26 localhost pluto[2804]: "conn" #1: Received DNS 10.0.0.20
Jul 09 20:37:26 localhost pluto[2804]: | ModeCFG DNS info: 10.0.0.20, len=10
Jul 09 20:37:26 localhost pluto[2804]: "conn" #1: Received DNS 10.0.0.240
Jul 09 20:37:26 localhost pluto[2804]: | ModeCFG DNS info: 10.0.0.20
10.0.0.240, len=21
Jul 09 20:37:26 localhost pluto[2804]: "conn" #1: Received Cisco ModeCFG
Domain: conn.com
Jul 09 20:37:26 localhost pluto[2804]: "conn" #1: Received Domain: conn.com
Jul 09 20:37:26 localhost pluto[2804]: "conn" #1: transition from state
STATE_MODE_CFG_I1 to state STATE_MAIN_I4
Jul 09 20:37:26 localhost pluto[2804]: "conn" #1: STATE_MAIN_I4: ISAKMP
SA established
Jul 09 20:37:26 localhost pluto[2804]: "conn" #2: initiating Quick Mode
PSK+ENCRYPT+TUNNEL+UP+XAUTH+MODECFGPULL+AGGRESSIVE+IKE_FRAG {using
isakmp#1 msgid:2886c6de proposal=3DES(3)_192-SHA1(2)_1...fsgroup=no-pfs}
Jul 09 20:37:26 localhost pluto[2804]: "conn" #2: up-client output:
updating resolvconf
Jul 09 20:37:26 localhost pluto[2804]: "conn" #2: up-client output:
Current resolv.conf is generated by Libreswan, and backup resolv.conf
already exists, so doing nothing
Jul 09 20:37:26 localhost pluto[2804]: "conn" #2: up-client command
exited with status 1
Jul 09 20:37:34 localhost pluto[2804]: "conn" #2: discarding duplicate
packet; already STATE_QUICK_I1
Jul 09 20:37:36 localhost pluto[2804]: "conn" #2: discarding duplicate
packet; already STATE_QUICK_I1
Jul 09 20:37:44 localhost pluto[2804]: "conn" #2: discarding duplicate
packet; already STATE_QUICK_I1
Jul 09 20:37:52 localhost pluto[2804]: "conn" #1: ignoring Delete SA
payload: PROTO_IPSEC_ESP SA(0x8603a62d) not found (maybe expired)
Jul 09 20:37:52 localhost pluto[2804]: "conn" #1: received and ignored
empty informational notification payload
Jul 09 20:37:52 localhost pluto[2804]: "conn" #1: received Delete SA
payload: deleting ISAKMP State #1
Jul 09 20:37:52 localhost pluto[2804]: packet from 198.185.66.15:4500:
received and ignored empty informational notification payload
I read that leftxauthserver means rekey=no, so I did add that but it
didn't seem to make a difference (it just doesn't 'try' as hard).
My config is (scrubbed):
conn conn
auto=start
authby=secret
left=%defaultroute
leftid=@vpnusers
leftxauthclient=yes
leftmodecfgclient=yes
leftxauthusername=blentz
right=1.2.3.4
rightxauthserver=yes
rightmodecfgserver=yes
modecfgpull=yes
ike=3des-md5;modp1536
esp=3des-sha1
rekey=no
remote_peer_type=cisco
aggrmode=yes
pfs=no
ikev2=no
sareftrack=no
esp=3des-sha1 appears to have gotten me around the NO_PROPOSAL_CHOSEN
problem but I didn't get a whole lot further. It feels like I'm 98%
there but this last 2% is kicking my butt.
I saw there was a release today, I might try pulling that down onto the
Fedora 20 Live USB system to see if there's something in there that's
fixed that I could benefit from.
Any more ideas?
_______________________________________________
Swan-dev mailing list
[email protected]
https://lists.libreswan.org/mailman/listinfo/swan-dev
