0

I have successfully created IKEv2 connection between Mikrotik routerboard with LTE module and Strongswan server. Mikrotik has non-public dynamic IP address assigned by SIM card.

Strongswan:

config setup
   charondebug="all"
   uniqueids=yes
   strictcrlpolicy=no

conn %default
keyexchange=ikev2

conn tunnel 
   reauth=no
   rightsendcert=never
   left=87.236.194.196
   leftsubnet=192.168.80.0/24
   right=%any
   rightsubnet=0.0.0.0/0
   keyingtries=0
   ikelifetime=1h
   lifetime=8h
   dpddelay=30
   dpdtimeout=120
   dpdaction=clear
   authby=secret
   auto=route
   type=tunnel

Mikrotik:

/ip ipsec proposal set [ find default=yes ] enc-algorithms=aes-128-   cbc lifetime=1h pfs-group=none
/ip ipsec peer add address=89.187.144.196/32 dh-group=modp1024 enc-algorithm=aes-256 exchange-mode=ike2 lifetime=8h secret=XYZ
/ip ipsec policy add dst-address=192.168.80.0/24 sa-dst-address=89.187.144.196 sa-src-address=0.0.0.0 src-address=192.168.40.0/24 tunnel=yes

Everything works fine when reauthentication is disabled in conn section. When reauthentication is enabled (by default) reauthentication breaks the IPsec tunnel and connection is re-established.

May 14 10:05:50 mvvk4-1 charon: 05[IKE] initiator did not reauthenticate as requested
May 14 10:05:50 mvvk4-1 charon: 05[IKE] reauthenticating IKE_SA tunnel[137] actively
May 14 10:05:50 mvvk4-1 charon: 05[IKE] deleting IKE_SA tunnel[137] between 87.236.194.196[87.236.194.196]...89.24.32.111[100.111.170.80]
May 14 10:05:50 mvvk4-1 charon: 05[IKE] sending DELETE for IKE_SA tunnel[137]
May 14 10:05:50 mvvk4-1 charon: 05[ENC] generating INFORMATIONAL request 34 [ D ]
May 14 10:05:50 mvvk4-1 charon: 05[NET] sending packet: from 87.236.194.196[4500] to 89.24.32.111[61529] (76 bytes)
May 14 10:05:50 mvvk4-1 charon: 13[NET] received packet: from 89.24.32.111[61529] to 87.236.194.196[4500] (92 bytes)
May 14 10:05:50 mvvk4-1 charon: 13[ENC] parsed INFORMATIONAL response 34 [ ]
May 14 10:05:50 mvvk4-1 charon: 13[IKE] IKE_SA deleted
May 14 10:05:50 mvvk4-1 charon: 13[IKE] restarting CHILD_SA tunnel
May 14 10:05:50 mvvk4-1 charon: 13[IKE] unable to resolve %any, initiate aborted
May 14 10:05:50 mvvk4-1 charon: 13[MGR] tried to check-in and delete nonexisting IKE_SA
May 14 10:05:50 mvvk4-1 charon: 13[IKE] reauthenticating IKE_SA failed
May 14 10:05:53 mvvk4-1 charon: 05[NET] received packet: from    89.24.32.111[61529] to 87.236.194.196[4500] (296 bytes)
May 14 10:05:53 mvvk4-1 charon: 05[ENC] parsed IKE_SA_INIT request 0 [ N(NATD_D_IP) N(NATD_S_IP) No KE SA ]
May 14 10:05:53 mvvk4-1 charon: 05[IKE] 89.24.32.111 is initiating an IKE_SA
May 14 10:05:53 mvvk4-1 charon: 05[IKE] remote host is behind NAT
May 14 10:05:53 mvvk4-1 charon: 05[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
May 14 10:05:53 mvvk4-1 charon: 05[NET] sending packet: from 87.236.194.196[4500] to 89.24.32.111[61529] (312 bytes)
May 14 10:05:53 mvvk4-1 charon: 14[NET] received packet: from 89.24.32.111[61529] to 87.236.194.196[4500] (316 bytes)
May 14 10:05:53 mvvk4-1 charon: 14[ENC] parsed IKE_AUTH request 1 [ IDi AUTH N(INIT_CONTACT) SA TSi TSr ]
May 14 10:05:53 mvvk4-1 charon: 14[CFG] looking for peer configs matching 87.236.194.196[%any]...89.24.32.111[100.111.170.80]
May 14 10:05:53 mvvk4-1 charon: 14[CFG] selected peer config 'tunnel'
May 14 10:05:53 mvvk4-1 charon: 14[IKE] authentication of '100.111.170.80' with pre-shared key successful
May 14 10:05:53 mvvk4-1 charon: 14[IKE] authentication of '87.236.194.196' (myself) with pre-shared key
May 14 10:05:53 mvvk4-1 charon: 14[IKE] IKE_SA tunnel[144] established between 87.236.194.196[87.236.194.196]...89.24.32.111[100.111.170.80]
May 14 10:05:53 mvvk4-1 charon: 14[IKE] scheduling reauthentication in 3346s
May 14 10:05:53 mvvk4-1 charon: 14[IKE] maximum IKE_SA lifetime 3526s
May 14 10:05:53 mvvk4-1 charon: 14[IKE] CHILD_SA tunnel{126} established with SPIs c1db676c_i 09f7b444_o and TS 192.168.80.0/24 === 192.168.88.0/24
May 14 10:05:53 mvvk4-1 charon: 14[ENC] generating IKE_AUTH response 1 [ IDr AUTH SA TSi TSr N(AUTH_LFT) ]
May 14 10:05:53 mvvk4-1 charon: 14[NET] sending packet: from 87.236.194.196[4500] to 89.24.32.111[61529] (220 bytes)
May 14 10:06:23 mvvk4-1 charon: 04[IKE] sending DPD request
May 14 10:06:23 mvvk4-1 charon: 04[ENC] generating INFORMATIONAL request 0 [ ]
May 14 10:06:23 mvvk4-1 charon: 04[NET] sending packet: from 87.236.194.196[4500] to 89.24.32.111[61529] (76 bytes)

There is no problem with rekeying.

I would like to ask you where could be the problem - on Mikrotik side, on server side or it is connect with NAT? Thank you.

Petr W.
  • 23
  • 1
  • 8
  • Why do you believe there is a problem? Rekeying is better then reauthentication, which as you say breaks the tunnel, and you say the rekeying works. – Gerrit May 21 '18 at 20:22
  • I agree with you but I would like to know why in this case the tunnel is breaked even if charon.make_before_break in strongswan.conf is set. – Petr W. May 21 '18 at 20:36
  • Maybe this? IKEv2 There is one important aspect that affects IKEv2. The keys for the CHILD_SA that's implicitly created with the IKE_AUTH exchange will always be derived from the IKE keys even if PFS is configured. So if the peers disagree on whether to use PFS or not (or on the DH groups) it will not be known until the CHILD_SA is first rekeyed (and fails). – Gerrit May 21 '18 at 20:58
  • But more likely, the Mikrotik router is not handling a make-before-break scheme well. The first log line mentions `initiator did not reauthenticate as requested`. That is suggestive of a compatibility problem. Would the Mikrotik router not be assuming rekeying instead of reauthentication? – Gerrit May 21 '18 at 21:02
  • In my opinion it is probably the compatibility problem, I haven't found anything regarding the IKEv2 reauthentication on Mikrotik pages so I should contact their support. – Petr W. May 21 '18 at 21:13
  • So, now it is clear. Here is answer from Mikrotik: Hello, Thanks, at the moment we do not support rfc4478. You must disable reauth on strong swan. Best regards, Maris B. -- MikroTik.com – Petr W. May 23 '18 at 10:20
  • That is a clear answer. But do they not support IKEv2 rekeying either? Or does your Strongswan version not support it? https://tools.ietf.org/html/rfc5996#section-1.3 – Gerrit May 23 '18 at 11:09
  • As I wrote in my query - rekeying between Mikrotik and Strongswan works like a charm. So, based on my experience RFC4478 reauthentication works only on Juniper devices and not in their default setting. – Petr W. May 23 '18 at 11:27
  • In that sense StrongSwan is a great tool, you can test almost any ipsec function. Their wiki mentions Windows 7 clients also having problems with reauthentication. I guess you can answer your own question now. – Gerrit May 23 '18 at 11:31

0 Answers0