Hello,
I am interested in using Libreswan in a project that requires IPsec
tunnels between hosts. Eventually, these tunnels will be based on
certificates, but I wanted to understand the "basics" before going to
the effort of setting up whatever certificate-management infrastructure
I will need.
So, I found an example of a simple case in the Wiki, at
https://libreswan.org/wiki/Host_to_host_VPN. I ran the example on two
hosts, Lampson and Cherry, each running Ubuntu 20.04.6 LTS.
I installed Libreswan on both hosts, using "sudo apt install libreswan".
The resulting version string is:
Linux Libreswan 3.29 (netkey) on 5.15.0-76-generic
I initialized nss, and then used "sudo ipsec newhostkey" to generate RSA
keypairs on each host. Using the host keys, and appropriate IPv4
addresses, I constructed /etc/ipsec.d/LACH.conf on both hosts, making
sure that the host keys were on a single line in the file.
I ran:
sudo ipsec setup start
sudo ipsec auto --add mytunnel
on both hosts, and then ran
sudo ipsec auto --u mytunnel
on Cherry, which resulted in the following output:
dev@Cherry:~$ sudo ipsec auto --add mytunnel
002 "mytunnel": terminating SAs using this connection
002 added connection description "mytunnel"
dev@Cherry:~$ sudo ipsec auto --up mytunnel
002 "mytunnel" #1: initiating v2 parent SA
133 "mytunnel" #1: initiate
002 "mytunnel": constructed local IKE proposals for mytunnel (IKE SA
initiator selecting KE):
1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519
2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519
3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519
4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519
(default)
133 "mytunnel" #1: STATE_PARENT_I1: sent v2I1, expected v2R1
003 "mytunnel" #1: Failed to find our RSA key
After 60 seconds, I get the following additional output:
002 "mytunnel" #3: initiating v2 parent SA to replace #1
133 "mytunnel" #3: STATE_PARENT_I0: initiate, replacing #1
002 "mytunnel" #1: deleting state (STATE_PARENT_I2) aged 60.035s and NOT
sending notification
133 "mytunnel" #3: STATE_PARENT_I1: sent v2I1, expected v2R1
003 "mytunnel" #3: Failed to find our RSA key
This behavior then repeats every 60 seconds.
Can anyone suggest to me what is wrong, and how to go about fixing it?
Bill
--
Dr. J.W. Atwood, Eng. tel: +1 (514) 848-2424 x3046
Distinguished Professor Emeritus fax: +1 (514) 848-2830
Department of Computer Science
and Software Engineering
Concordia University ER 1234 email:[email protected]
1455 de Maisonneuve Blvd. West http://users.encs.concordia.ca/~bill
Montreal, Quebec Canada H3G 1M8
_______________________________________________
Swan mailing list
[email protected]
https://lists.libreswan.org/mailman/listinfo/swan
