> Wed, 2020-03-25 15:08 14[CFG] <3> looking for pre-shared key peer configs > matching x.x.x.x...y.y.y.y[172.20.0.10] > Wed, 2020-03-25 15:08 14[IKE] <3> no peer config found
> rightid=aws Wrong id. The remote peer sends 172.20.0.10 as its own id, not 'aws'. Am 25.03.20 um 16:13 schrieb Dafydd Tomos: > On 25/03/2020 14:50, Noel Kuntze wrote: >>> server-to-aws: 10.100.15.1...y.y.y.y IKEv1, dpddelay=15s >>> I ended up adding an interface for 10.100.15.1 as that what appears to be >>> required. >> The conn is configured for x.x.x.x, not 10.100.15.1. strongSwan doesn't need >> such an address. >> Set left=x.x.x.x. >> > Ah thanks. That's what I did originally in fact. The log now shows it looping > around those proposing traffic selectors. Before this change it was trying to > connect. Now it says 0 connecting. > > Status of IKE charon daemon (strongSwan 5.5.1, Linux 4.9.0-11-amd64, x86_64): > uptime: 5 seconds, since Mar 25 15:07:42 2020 > malloc: sbrk 2297856, mmap 0, used 418656, free 1879200 > worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, > scheduled: 0 > loaded plugins: charon aesni aes rc2 sha2 sha1 md5 random nonce x509 > revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 p > gp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr > kernel-netlink resolve socket-default connmark stroke updown > Listening IP addresses: > x.x.x.x > 10.100.15.1 > Connections: > server-to-aws: x.x.x.x...y.y.y.y IKEv1, dpddelay=15s > server-to-aws: local: [server] uses pre-shared key authentication > server-to-aws: remote: [aws] uses pre-shared key authentication > server-to-aws: child: 10.100.15.0/24 === 172.21.0.0/16 172.22.0.0/16 > TUNNEL, dpdaction=restart > Security Associations (0 up, 0 connecting): > none > > > Wed, 2020-03-25 15:08 13[IKE] <3> y.y.y.y is initiating a Main Mode IKE_SA > Wed, 2020-03-25 15:08 13[IKE] <3> IKE_SA (unnamed)[3] state change: CREATED > => CONNECTING > Wed, 2020-03-25 15:08 13[CFG] <3> selecting proposal: > Wed, 2020-03-25 15:08 13[CFG] <3> proposal matches > Wed, 2020-03-25 15:08 13[CFG] <3> received proposals: > IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536 > Wed, 2020-03-25 15:08 13[CFG] <3> configured proposals: > IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536, IKE:AES_ > CBC_128/AES_CBC_192/AES_CBC_256/AES_CTR_128/AES_CTR_192/AES_CTR_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/3DES_CBC > /HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/HMAC_MD5_96/HMAC_SHA1_96/PRF_AES128_XCBC/PRF_AES > 128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_MD5/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_8192/MODP_2048/MODP_2048_256/MODP_1024, > > IKE:AES_CCM_16_128/AES_CCM_16_192/AES_CCM_16_256/AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/AES_CCM_8_128/AES_CCM_8_192/AES_CCM_8_256/AES_CCM_12_128/AES_CCM_12_192/AES_CCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_MD5/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_8192/MODP_2048/MODP_2048_256/MODP_1024 > Wed, 2020-03-25 15:08 13[CFG] <3> selected proposal: > IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536 > Wed, 2020-03-25 15:08 13[IKE] <3> sending XAuth vendor ID > Wed, 2020-03-25 15:08 13[IKE] <3> sending DPD vendor ID > Wed, 2020-03-25 15:08 13[IKE] <3> sending FRAGMENTATION vendor ID > Wed, 2020-03-25 15:08 13[IKE] <3> sending NAT-T (RFC 3947) vendor ID > Wed, 2020-03-25 15:08 13[ENC] <3> generating ID_PROT response 0 [ SA V V V V ] > Wed, 2020-03-25 15:08 13[NET] <3> sending packet: from x.x.x.x[500] to > y.y.y.y[500] (164 bytes) > Wed, 2020-03-25 15:08 10[NET] <3> received packet: from y.y.y.y[500] to > x.x.x.x[500] (316 bytes) > Wed, 2020-03-25 15:08 10[ENC] <3> parsed ID_PROT request 0 [ KE No NAT-D > NAT-D ] > Wed, 2020-03-25 15:08 10[LIB] <3> size of DH secret exponent: 1535 bits > Wed, 2020-03-25 15:08 10[IKE] <3> remote host is behind NAT > Wed, 2020-03-25 15:08 10[ENC] <3> generating ID_PROT response 0 [ KE No NAT-D > NAT-D ] > Wed, 2020-03-25 15:08 10[NET] <3> sending packet: from x.x.x.x[500] to > y.y.y.y[500] (332 bytes) > Wed, 2020-03-25 15:08 14[NET] <3> received packet: from y.y.y.y[4500] to > x.x.x.x[4500] (108 bytes) > Wed, 2020-03-25 15:08 14[ENC] <3> parsed ID_PROT request 0 [ ID HASH > N(INITIAL_CONTACT) ] > Wed, 2020-03-25 15:08 14[CFG] <3> looking for pre-shared key peer configs > matching x.x.x.x...y.y.y.y[172.20.0.10] > Wed, 2020-03-25 15:08 14[IKE] <3> no peer config found > Wed, 2020-03-25 15:08 14[IKE] <3> queueing INFORMATIONAL task > Wed, 2020-03-25 15:08 14[IKE] <3> activating new tasks > Wed, 2020-03-25 15:08 14[IKE] <3> activating INFORMATIONAL task > Wed, 2020-03-25 15:08 14[ENC] <3> generating INFORMATIONAL_V1 request > 266312254 [ HASH N(AUTH_FAILED) ] > Wed, 2020-03-25 15:08 14[NET] <3> sending packet: from x.x.x.x[4500] to > y.y.y.y[4500] (108 bytes) > Wed, 2020-03-25 15:08 14[IKE] <3> IKE_SA (unnamed)[3] state change: > CONNECTING => DESTROYING > Wed, 2020-03-25 15:08 03[CFG] proposing traffic selectors for us: > Wed, 2020-03-25 15:08 03[CFG] 10.100.15.0/24 > Wed, 2020-03-25 15:08 03[CFG] proposing traffic selectors for other: > Wed, 2020-03-25 15:08 03[CFG] 172.21.0.0/16 > Wed, 2020-03-25 15:08 03[CFG] 172.22.0.0/16 >
signature.asc
Description: OpenPGP digital signature
