I'm trying to build IPsec tunnel between my Strongswan cloud instance to the Cisco CSR 1000V which is from ISP.
According to the form given to me, I have to configure with the following factors in mind Phase 1 Authentication Method: PSK Encryption Scheme: IKEv1 DH Group: Group 2 Encryption Algorithm: AES-256 Hashing Algorithm: SHA1 Main or Aggressive: Main Lifetime for renegotiation: 28800
Phase 2 ESP/AH: ESP Encryption: AES-256 Authentication Algorithm: SHA1 PFS: Group 2(no PFS) Lifetime (for renegotiation): 3600 Lifesize in KB(for renegotiation): Not used
This is my ipsec.conf file config
# ipsec.conf - strongSwan IPsec configuration file
# basic configuration
config setup
# strictcrlpolicy=yes
charondebug="ike 1, knl 1, cfg 0"
uniqueids=no
# Add connections here.
# Sample VPN connections
conn c2c-vpn
type=tunnel
keyexchange=ikev1
left=X.X.X.X
leftid=X.X.X.X
leftsubnet=172.31.8.0/24
leftauth=secret
leftfirewall=no
right=Y.Y.Y.Y
rightid=Y.Y.Y.Y
rightsubnet=10.0.0.0/16
rightauth=secret
rightfirewall=yes
ike=aes256-sha1-modp1024!
esp=aes256-sha1
aggressive=no
fragmentation=yes
ikelifetime=288000s
lifetime=3600s
keyingtries=%forever
dpddelay=30s
dpdtimeout=120s
dpdaction=restart
auto=start
X.X.X.X would be my side public ip and Y.Y.Y.Y would be the other side public IP (I'm aware that the keys I'm using are weak. But for now, I just want the tunnel to be up.)
This is my ipsec.secrets
X.X.X.X Y.Y.Y.Y : PSK "<MyPSK>"
I'm not sure it's important but this is strongswan.conf
charon {
load_modular = yes
plugins {
include strongswan.d/charon/*.conf
}
max_ikev1_exchanges=100
}
And this is the corresponding log from charon after I restarted ipsec
Jul 04 17:23:49 uvmuk charon[14906]: 00[LIB] dropped capabilities, running as uid 0, gid 0
Jul 04 17:23:49 uvmuk charon[14906]: 00[JOB] spawning 16 worker threads
Jul 04 17:23:49 uvmuk ipsec_starter[14905]: charon (14906) started after 40 ms
Jul 04 17:23:49 uvmuk charon[14906]: 07[IKE] initiating Main Mode IKE_SA mpt-to-melo-vpn[1] to Y.Y.Y.Y
Jul 04 17:23:49 uvmuk charon[14906]: 07[IKE] initiating Main Mode IKE_SA mpt-to-melo-vpn[1] to Y.Y.Y.Y
Jul 04 17:23:49 uvmuk charon[14906]: 07[ENC] generating ID_PROT request 0 [ SA V V V V V ]
Jul 04 17:23:49 uvmuk charon[14906]: 07[NET] sending packet: from X.X.X.X[500] to Y.Y.Y.Y[500] (184 bytes)
Jul 04 17:23:49 uvmuk charon[14906]: 09[NET] received packet: from Y.Y.Y.Y[500] to X.X.X.X[500] (108 bytes)
Jul 04 17:23:49 uvmuk charon[14906]: 09[ENC] parsed ID_PROT response 0 [ SA V ]
Jul 04 17:23:49 uvmuk charon[14906]: 09[IKE] received NAT-T (RFC 3947) vendor ID
Jul 04 17:23:49 uvmuk charon[14906]: 09[ENC] generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
Jul 04 17:23:49 uvmuk charon[14906]: 09[NET] sending packet: from X.X.X.X[500] to Y.Y.Y.Y[500] (244 bytes)
Jul 04 17:23:49 uvmuk charon[14906]: 10[NET] received packet: from Y.Y.Y.Y[500] to X.X.X.X[500] (304 bytes)
Jul 04 17:23:49 uvmuk charon[14906]: 10[ENC] parsed ID_PROT response 0 [ KE No V V V V NAT-D NAT-D ]
Jul 04 17:23:49 uvmuk charon[14906]: 10[IKE] received Cisco Unity vendor ID
Jul 04 17:23:49 uvmuk charon[14906]: 10[IKE] received DPD vendor ID
Jul 04 17:23:49 uvmuk charon[14906]: 10[ENC] received unknown vendor ID: 41:45:bc:50:b1:fa:91:a8:72:57:6f:4e:4e:e2:17:29
Jul 04 17:23:49 uvmuk charon[14906]: 10[IKE] received XAuth vendor ID
Jul 04 17:23:49 uvmuk charon[14906]: 10[IKE] remote host is behind NAT
Jul 04 17:23:49 uvmuk charon[14906]: 10[ENC] generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
Jul 04 17:23:49 uvmuk charon[14906]: 10[NET] sending packet: from X.X.X.X[4500] to Y.Y.Y.Y[4500] (108 bytes)
Jul 04 17:23:49 uvmuk charon[14906]: 11[NET] received packet: from Y.Y.Y.Y[4500] to X.X.X.X[4500] (92 bytes)
Jul 04 17:23:49 uvmuk charon[14906]: 11[ENC] invalid HASH_V1 payload length, decryption failed?
Jul 04 17:23:49 uvmuk charon[14906]: 11[ENC] could not decrypt payloads
Jul 04 17:23:49 uvmuk charon[14906]: 11[IKE] message parsing failed
Jul 04 17:23:49 uvmuk charon[14906]: 11[IKE] ignore malformed INFORMATIONAL request
Jul 04 17:23:49 uvmuk charon[14906]: 11[IKE] INFORMATIONAL_V1 request with message ID 4053640584 processing failed
Jul 04 17:23:49 uvmuk charon[14906]: 12[NET] received packet: from Y.Y.Y.Y[4500] to X.X.X.X[4500] (76 bytes)
Jul 04 17:23:49 uvmuk charon[14906]: 12[ENC] parsed ID_PROT response 0 [ ID HASH ]
Jul 04 17:23:49 uvmuk charon[14906]: 12[IKE] IDir '10.0.1.189' does not match to 'Y.Y.Y.Y'
Jul 04 17:23:49 uvmuk charon[14906]: 12[IKE] deleting IKE_SA c2c-vpn[1] between X.X.X.X[X.X.X.X]...Y.Y.Y.Y[%any]
Jul 04 17:23:49 uvmuk charon[14906]: 12[IKE] deleting IKE_SA c2c-vpn[1] between X.X.X.X[X.X.X.X]...Y.Y.Y.Y[%any]
Jul 04 17:23:49 uvmuk charon[14906]: 12[IKE] sending DELETE for IKE_SA c2c-vpn[1]
Jul 04 17:23:49 uvmuk charon[14906]: 12[ENC] generating INFORMATIONAL_V1 request 4232678559 [ HASH D ]
Jul 04 17:23:49 uvmuk charon[14906]: 12[NET] sending packet: from X.X.X.X[4500] to Y.Y.Y.Y[4500] (92 bytes)
I'm relatively new with strongswan and IPsec configurations in general but I'm sure the phase 1 tunnel isn't established because of "deleting IKE_SA" line. I've tried to find solutions from multiple forums already, hoping someone had the same problem as me but I'm stuck. Help.
