Open sky9090 opened 1 year ago
bleve
commented
1 year ago Because you removed parts of ip addresses we can not see any problem. Both of these seem to talk with completely different partner than you expect but it is impossible to verify. Mismatching subnets won't be able to talk so I suspect these talk with different peers.
sky9090
commented
1 year ago Hi @bleve, thank you for checking. I only set up two VPN peer and It should not talk to other different peers. The other configurations are the same, when I switch to ikev2, the connection is immediately disconnected.
This is my current setting for this two ikev1 VPN peers. Please help me to check again why the connection is always up, thank you. Our vpn service wanted to be migrated from strongswan to libreswan, I did some tests on libreswan and found this issue.
VPN-01 leftsubnets=10.240.3.0/24 rightsubnets=192.168.7.0/24
# cat /etc/ipsec.d/ipsec.conf
conn test
authby=secret
ike=aes256-sha256-dh14
keyexchange=ike
ikev2=no
esp=aes256-sha256-dh16
dpdaction=clear
dpddelay=20s
dpdtimeout=40s
pfs=yes
auto=start
type=tunnel
ikelifetime=1600s
salifetime=1300s
left=%defaultroute
leftsubnets=10.240.3.0/24
leftid=150.240.168.34
right=150.240.168.102
rightsubnets=192.168.7.0/24
rightid=150.240.168.102VPN-02: leftsubnets=192.168.8.0/24 rightsubnets=10.240.4.0/24
# cat /etc/ipsec.d/ipsec.conf
#conn peer_150.240.168.34_0711_9e6b7a0e-6286-44b8-8afd-3c9eb4f29814
conn test
authby=secret
ike=aes256-sha256-dh14
keyexchange=ike
ikev2=no
esp=aes256-sha256-dh16
dpdaction=clear
dpddelay=20s
dpdtimeout=40s
pfs=yes
auto=start
type=tunnel
ikelifetime=1600s
salifetime=1300s
left=%defaultroute
leftsubnets=192.168.8.0/24
leftid=150.240.168.102
right=150.240.168.34
rightsubnets=10.240.4.0/24
rightid=150.240.168.34VPN-01 ipsec status:
# ipsec status
000 using kernel interface: xfrm
000
000 interface lo UDP [::1]:4500
000 interface lo UDP [::1]:500
000 interface lo UDP 127.0.0.1:4500
000 interface lo UDP 127.0.0.1:500
000 interface eth0 UDP 10.240.4.11:4500
000 interface eth0 UDP 10.240.4.11:500
000
000 fips mode=disabled;
000 SElinux=disabled
000 seccomp=disabled
000
000 config setup options:
000
000 configdir=/etc, configfile=/etc/ipsec.conf, secrets=/etc/ipsec.secrets, ipsecdir=/etc/ipsec.d
000 nssdir=/var/lib/ipsec/nss, dumpdir=/run/pluto, statsbin=unset
000 dnssec-rootkey-file=/var/lib/unbound/root.key, dnssec-trusted=<unset>
000 sbindir=/usr/sbin, libexecdir=/usr/libexec/ipsec
000 pluto_version=4.9, pluto_vendorid=OE-Libreswan-4.9, audit-log=yes
000 nhelpers=-1, uniqueids=yes, dnssec-enable=yes, logappend=yes, logip=yes, shuntlifetime=900s, xfrmlifetime=30s
000 ddos-cookies-threshold=25000, ddos-max-halfopen=50000, ddos-mode=auto, ikev1-policy=accept
000 ikebuf=0, msg_errqueue=yes, crl-strict=no, crlcheckinterval=0, listen=<any>, nflog-all=0
000 ocsp-enable=no, ocsp-strict=no, ocsp-timeout=2, ocsp-uri=<unset>
000 ocsp-trust-name=<unset>
000 ocsp-cache-size=1000, ocsp-cache-min-age=3600, ocsp-cache-max-age=86400, ocsp-method=get
000 global-redirect=no, global-redirect-to=<unset>
000 secctx-attr-type=32001
000 debug:
000
000 nat-traversal=yes, keep-alive=20, nat-ikeport=4500
000 virtual-private (%priv):
000
000 Kernel algorithms supported:
000
000 algorithm ESP encrypt: name=3DES_CBC, keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: name=AES_CBC, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CCM_12, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CCM_16, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CCM_8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CTR, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_GCM_12, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_GCM_16, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_GCM_8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=CAMELLIA_CBC, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=CHACHA20_POLY1305, keysizemin=256, keysizemax=256
000 algorithm ESP encrypt: name=NULL, keysizemin=0, keysizemax=0
000 algorithm ESP encrypt: name=NULL_AUTH_AES_GMAC, keysizemin=128, keysizemax=256
000 algorithm AH/ESP auth: name=AES_CMAC_96, key-length=128
000 algorithm AH/ESP auth: name=AES_XCBC_96, key-length=128
000 algorithm AH/ESP auth: name=HMAC_MD5_96, key-length=128
000 algorithm AH/ESP auth: name=HMAC_SHA1_96, key-length=160
000 algorithm AH/ESP auth: name=HMAC_SHA2_256_128, key-length=256
000 algorithm AH/ESP auth: name=HMAC_SHA2_256_TRUNCBUG, key-length=256
000 algorithm AH/ESP auth: name=HMAC_SHA2_384_192, key-length=384
000 algorithm AH/ESP auth: name=HMAC_SHA2_512_256, key-length=512
000 algorithm AH/ESP auth: name=NONE, key-length=0
000
000 IKE algorithms supported:
000
000 algorithm IKE encrypt: v1id=5, v1name=OAKLEY_3DES_CBC, v2id=3, v2name=3DES, blocksize=8, keydeflen=192
000 algorithm IKE encrypt: v1id=8, v1name=OAKLEY_CAMELLIA_CBC, v2id=23, v2name=CAMELLIA_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=20, v2name=AES_GCM_C, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=19, v2name=AES_GCM_B, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=18, v2name=AES_GCM_A, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=13, v1name=OAKLEY_AES_CTR, v2id=13, v2name=AES_CTR, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=7, v1name=OAKLEY_AES_CBC, v2id=12, v2name=AES_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=28, v2name=CHACHA20_POLY1305, blocksize=16, keydeflen=256
000 algorithm IKE PRF: name=HMAC_MD5, hashlen=16
000 algorithm IKE PRF: name=HMAC_SHA1, hashlen=20
000 algorithm IKE PRF: name=HMAC_SHA2_256, hashlen=32
000 algorithm IKE PRF: name=HMAC_SHA2_384, hashlen=48
000 algorithm IKE PRF: name=HMAC_SHA2_512, hashlen=64
000 algorithm IKE PRF: name=AES_XCBC, hashlen=16
000 algorithm IKE DH Key Exchange: name=MODP1536, bits=1536
000 algorithm IKE DH Key Exchange: name=MODP2048, bits=2048
000 algorithm IKE DH Key Exchange: name=MODP3072, bits=3072
000 algorithm IKE DH Key Exchange: name=MODP4096, bits=4096
000 algorithm IKE DH Key Exchange: name=MODP6144, bits=6144
000 algorithm IKE DH Key Exchange: name=MODP8192, bits=8192
000 algorithm IKE DH Key Exchange: name=DH19, bits=512
000 algorithm IKE DH Key Exchange: name=DH20, bits=768
000 algorithm IKE DH Key Exchange: name=DH21, bits=1056
000 algorithm IKE DH Key Exchange: name=DH31, bits=256
000
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,2,64} trans={0,2,2808} attrs={0,2,1872}
000
000 Connection list:
000
000 "test/1x1": 10.240.3.0/24===10.240.4.11[150.240.168.34]---10.240.4.1...150.240.168.102===192.168.7.0/24; erouted; eroute owner: #5
000 "test/1x1": oriented; my_ip=unset; their_ip=unset; my_updown=ipsec _updown;
000 "test/1x1": xauth us:none, xauth them:none, my_username=[any]; their_username=[any]
000 "test/1x1": our auth:secret, their auth:secret, our autheap:none, their autheap:none;
000 "test/1x1": modecfg info: us:none, them:none, modecfg policy:push, dns:unset, domains:unset, cat:unset;
000 "test/1x1": sec_label:unset;
000 "test/1x1": ike_life: 1600s; ipsec_life: 1300s; ipsec_max_bytes: 2^63B; ipsec_max_packets: 2^63; replay_window: 128; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0;
000 "test/1x1": retransmit-interval: 500ms; retransmit-timeout: 60s; iketcp:no; iketcp-port:4500;
000 "test/1x1": initial-contact:no; cisco-unity:no; fake-strongswan:no; send-vendorid:no; send-no-esp-tfc:no;
000 "test/1x1": policy: IKEv1+PSK+ENCRYPT+TUNNEL+PFS+UP+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
000 "test/1x1": conn_prio: 24,24; interface: eth0; metric: 0; mtu: unset; sa_prio:auto; sa_tfc:none;
000 "test/1x1": nflog-group: unset; mark: unset; vti-iface:unset; vti-routing:no; vti-shared:no; nic-offload:auto;
000 "test/1x1": our idtype: ID_IPV4_ADDR; our id=150.240.168.34; their idtype: ID_IPV4_ADDR; their id=150.240.168.102
000 "test/1x1": dpd: active; action:clear; delay:20s; timeout:40s
000 "test/1x1": nat-traversal: encaps:auto; keepalive:20s; ikev1-method:rfc+drafts
000 "test/1x1": newest ISAKMP SA: #4; newest IPsec SA: #5; conn serial: $1;
000 "test/1x1": aliases: test
000 "test/1x1": IKE algorithms: AES_CBC_256-HMAC_SHA2_256-MODP2048
000 "test/1x1": IKEv1 algorithm newest: AES_CBC_256-HMAC_SHA2_256-MODP2048
000 "test/1x1": ESP algorithms: AES_CBC_256-HMAC_SHA2_256_128-MODP4096
000 "test/1x1": ESP algorithm newest: AES_CBC_256-HMAC_SHA2_256_128; pfsgroup=MODP4096
000
000 Total IPsec connections: loaded 1, active 1
000
000 State Information: DDoS cookies not required, Accepting new IKE connections
000 IKE SAs: total(2), half-open(0), open(0), authenticated(2), anonymous(0)
000 IPsec SAs: total(2), authenticated(2), anonymous(0)
000
000 #2: "test/1x1":4500 STATE_MAIN_R3 (IKE SA established); REPLACE in 1239s; lastdpd=-1s(seq in:0 out:0); idle;
000 #3: "test/1x1":4500 STATE_QUICK_R2 (IPsec SA established); REPLACE in 939s; ISAKMP SA #2; idle;
000 #3: "test/1x1" esp.ed45209d@150.240.168.102 esp.da125fea@10.240.4.11 tun.0@150.240.168.102 tun.0@10.240.4.11 Traffic: ESPin=0B ESPout=0B ESPmax=2^63B
000 #4: "test/1x1":4500 STATE_MAIN_I4 (IKE SA established); REPLACE in 508s; newest; lastdpd=11s(seq in:27502 out:0); idle;
000 #5: "test/1x1":4500 STATE_QUICK_I2 (IPsec SA established); REPLACE in 397s; newest; eroute owner; ISAKMP SA #4; idle;
000 #5: "test/1x1" esp.9b8d6e1a@150.240.168.102 esp.e46dcd16@10.240.4.11 tun.0@150.240.168.102 tun.0@10.240.4.11 Traffic: ESPin=0B ESPout=0B ESPmax=2^63B
000
000 Bare Shunt list:
000VPN-02 ipsec status:
# ipsec status
000 using kernel interface: xfrm
000
000 interface lo UDP [::1]:4500
000 interface lo UDP [::1]:500
000 interface lo UDP 127.0.0.1:4500
000 interface lo UDP 127.0.0.1:500
000 interface eth0 UDP 192.168.8.7:4500
000 interface eth0 UDP 192.168.8.7:500
000
000 fips mode=disabled;
000 SElinux=disabled
000 seccomp=disabled
000
000 config setup options:
000
000 configdir=/etc, configfile=/etc/ipsec.conf, secrets=/etc/ipsec.secrets, ipsecdir=/etc/ipsec.d
000 nssdir=/var/lib/ipsec/nss, dumpdir=/run/pluto, statsbin=unset
000 dnssec-rootkey-file=/var/lib/unbound/root.key, dnssec-trusted=<unset>
000 sbindir=/usr/sbin, libexecdir=/usr/libexec/ipsec
000 pluto_version=4.9, pluto_vendorid=OE-Libreswan-4.9, audit-log=yes
000 nhelpers=-1, uniqueids=yes, dnssec-enable=yes, logappend=yes, logip=yes, shuntlifetime=900s, xfrmlifetime=30s
000 ddos-cookies-threshold=25000, ddos-max-halfopen=50000, ddos-mode=auto, ikev1-policy=accept
000 ikebuf=0, msg_errqueue=yes, crl-strict=no, crlcheckinterval=0, listen=<any>, nflog-all=0
000 ocsp-enable=no, ocsp-strict=no, ocsp-timeout=2, ocsp-uri=<unset>
000 ocsp-trust-name=<unset>
000 ocsp-cache-size=1000, ocsp-cache-min-age=3600, ocsp-cache-max-age=86400, ocsp-method=get
000 global-redirect=no, global-redirect-to=<unset>
000 secctx-attr-type=32001
000 debug:
000
000 nat-traversal=yes, keep-alive=20, nat-ikeport=4500
000 virtual-private (%priv):
000
000 Kernel algorithms supported:
000
000 algorithm ESP encrypt: name=3DES_CBC, keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: name=AES_CBC, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CCM_12, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CCM_16, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CCM_8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CTR, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_GCM_12, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_GCM_16, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_GCM_8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=CAMELLIA_CBC, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=CHACHA20_POLY1305, keysizemin=256, keysizemax=256
000 algorithm ESP encrypt: name=NULL, keysizemin=0, keysizemax=0
000 algorithm ESP encrypt: name=NULL_AUTH_AES_GMAC, keysizemin=128, keysizemax=256
000 algorithm AH/ESP auth: name=AES_CMAC_96, key-length=128
000 algorithm AH/ESP auth: name=AES_XCBC_96, key-length=128
000 algorithm AH/ESP auth: name=HMAC_MD5_96, key-length=128
000 algorithm AH/ESP auth: name=HMAC_SHA1_96, key-length=160
000 algorithm AH/ESP auth: name=HMAC_SHA2_256_128, key-length=256
000 algorithm AH/ESP auth: name=HMAC_SHA2_256_TRUNCBUG, key-length=256
000 algorithm AH/ESP auth: name=HMAC_SHA2_384_192, key-length=384
000 algorithm AH/ESP auth: name=HMAC_SHA2_512_256, key-length=512
000 algorithm AH/ESP auth: name=NONE, key-length=0
000
000 IKE algorithms supported:
000
000 algorithm IKE encrypt: v1id=5, v1name=OAKLEY_3DES_CBC, v2id=3, v2name=3DES, blocksize=8, keydeflen=192
000 algorithm IKE encrypt: v1id=8, v1name=OAKLEY_CAMELLIA_CBC, v2id=23, v2name=CAMELLIA_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=20, v2name=AES_GCM_C, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=19, v2name=AES_GCM_B, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=18, v2name=AES_GCM_A, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=13, v1name=OAKLEY_AES_CTR, v2id=13, v2name=AES_CTR, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=7, v1name=OAKLEY_AES_CBC, v2id=12, v2name=AES_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=28, v2name=CHACHA20_POLY1305, blocksize=16, keydeflen=256
000 algorithm IKE PRF: name=HMAC_MD5, hashlen=16
000 algorithm IKE PRF: name=HMAC_SHA1, hashlen=20
000 algorithm IKE PRF: name=HMAC_SHA2_256, hashlen=32
000 algorithm IKE PRF: name=HMAC_SHA2_384, hashlen=48
000 algorithm IKE PRF: name=HMAC_SHA2_512, hashlen=64
000 algorithm IKE PRF: name=AES_XCBC, hashlen=16
000 algorithm IKE DH Key Exchange: name=MODP1536, bits=1536
000 algorithm IKE DH Key Exchange: name=MODP2048, bits=2048
000 algorithm IKE DH Key Exchange: name=MODP3072, bits=3072
000 algorithm IKE DH Key Exchange: name=MODP4096, bits=4096
000 algorithm IKE DH Key Exchange: name=MODP6144, bits=6144
000 algorithm IKE DH Key Exchange: name=MODP8192, bits=8192
000 algorithm IKE DH Key Exchange: name=DH19, bits=512
000 algorithm IKE DH Key Exchange: name=DH20, bits=768
000 algorithm IKE DH Key Exchange: name=DH21, bits=1056
000 algorithm IKE DH Key Exchange: name=DH31, bits=256
000
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,2,64} trans={0,2,2808} attrs={0,2,1872}
000
000 Connection list:
000
000 "test/1x1": 192.168.8.0/24===192.168.8.7[150.240.168.102]---192.168.8.1...150.240.168.34===10.240.4.0/24; erouted; eroute owner: #4
000 "test/1x1": oriented; my_ip=unset; their_ip=unset; my_updown=ipsec _updown;
000 "test/1x1": xauth us:none, xauth them:none, my_username=[any]; their_username=[any]
000 "test/1x1": our auth:secret, their auth:secret, our autheap:none, their autheap:none;
000 "test/1x1": modecfg info: us:none, them:none, modecfg policy:push, dns:unset, domains:unset, cat:unset;
000 "test/1x1": sec_label:unset;
000 "test/1x1": ike_life: 1600s; ipsec_life: 1300s; ipsec_max_bytes: 2^63B; ipsec_max_packets: 2^63; replay_window: 128; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0;
000 "test/1x1": retransmit-interval: 500ms; retransmit-timeout: 60s; iketcp:no; iketcp-port:4500;
000 "test/1x1": initial-contact:no; cisco-unity:no; fake-strongswan:no; send-vendorid:no; send-no-esp-tfc:no;
000 "test/1x1": policy: IKEv1+PSK+ENCRYPT+TUNNEL+PFS+UP+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
000 "test/1x1": conn_prio: 24,24; interface: eth0; metric: 0; mtu: unset; sa_prio:auto; sa_tfc:none;
000 "test/1x1": nflog-group: unset; mark: unset; vti-iface:unset; vti-routing:no; vti-shared:no; nic-offload:auto;
000 "test/1x1": our idtype: ID_IPV4_ADDR; our id=150.240.168.102; their idtype: ID_IPV4_ADDR; their id=150.240.168.34
000 "test/1x1": dpd: active; action:clear; delay:20s; timeout:40s
000 "test/1x1": nat-traversal: encaps:auto; keepalive:20s; ikev1-method:rfc+drafts
000 "test/1x1": newest ISAKMP SA: #3; newest IPsec SA: #4; conn serial: $1;
000 "test/1x1": aliases: test
000 "test/1x1": IKE algorithms: AES_CBC_256-HMAC_SHA2_256-MODP2048
000 "test/1x1": IKEv1 algorithm newest: AES_CBC_256-HMAC_SHA2_256-MODP2048
000 "test/1x1": ESP algorithms: AES_CBC_256-HMAC_SHA2_256_128-MODP4096
000 "test/1x1": ESP algorithm newest: AES_CBC_256-HMAC_SHA2_256_128; pfsgroup=MODP4096
000
000 Total IPsec connections: loaded 1, active 1
000
000 State Information: DDoS cookies not required, Accepting new IKE connections
000 IKE SAs: total(2), half-open(0), open(0), authenticated(2), anonymous(0)
000 IPsec SAs: total(2), authenticated(2), anonymous(0)
000
000 #1: "test/1x1":4500 STATE_MAIN_I4 (IKE SA established); REPLACE in 394s; lastdpd=-1s(seq in:0 out:0); idle;
000 #2: "test/1x1":4500 STATE_QUICK_I2 (IPsec SA established); REPLACE in 89s; ISAKMP SA #1; idle;
000 #2: "test/1x1" esp.da125fea@150.240.168.34 esp.ed45209d@192.168.8.7 tun.0@150.240.168.34 tun.0@192.168.8.7 Traffic: ESPin=0B ESPout=0B ESPmax=2^63B
000 #3: "test/1x1":4500 STATE_MAIN_R3 (IKE SA established); REPLACE in 1217s; newest; lastdpd=12s(seq in:7512 out:0); idle;
000 #4: "test/1x1":4500 STATE_QUICK_R2 (IPsec SA established); REPLACE in 917s; newest; eroute owner; ISAKMP SA #3; idle;
000 #4: "test/1x1" esp.e46dcd16@150.240.168.34 esp.9b8d6e1a@192.168.8.7 tun.0@150.240.168.34 tun.0@192.168.8.7 Traffic: ESPin=0B ESPout=0B ESPmax=2^63B
000
000 Bare Shunt list:
000@bleve do you have any advice on this?
sky9090
commented
1 year ago @bleve @letoams do you have time to look at this issue and help check that my configuration is set up correctly?
bleve
commented
1 year ago It looks like you have a configuration issue. With single subnet you should have leftsubnet and rightsubnet, not plural.
cagney
commented
1 year ago Instead of auto=start, could you please paste the output from bringing it up manually.
sky9090
commented
1 year ago It looks like you have a configuration issue. With single subnet you should have leftsubnet and rightsubnet, not plural.
@cagney, I replaced leftsubnets/rightsubnets with leftsubnet/rightsubnet, and the connection is still up.
sky9090
commented
1 year ago Instead of auto=start, could you please paste the output from bringing it up manually.
I replace auto=start with auto=ondemand, and use the "ipsec auto --up \<conn name>" command to manually start the connection, and the connection is still up. The output logs are as follows:
VPN-01:
# ipsec auto --up test
002 "test" #1: initiating IKEv1 Main Mode connection
102 "test" #1: sent Main Mode request
002 "test" #1: WARNING: connection test PSK length of 6 bytes is too short for HMAC_SHA2_256 PRF in FIPS mode (16 bytes required)
104 "test" #1: sent Main Mode I2
106 "test" #1: sent Main Mode I3
002 "test" #1: Peer ID is ID_IPV4_ADDR: '150.240.168.102'
004 "test" #1: IKE SA established {auth=PRESHARED_KEY cipher=AES_CBC_256 integ=HMAC_SHA2_256 group=MODP2048}
002 "test" #2: initiating Quick Mode IKEv1+PSK+ENCRYPT+TUNNEL+PFS+UP+IKE_FRAG_ALLOW+ESN_NO {using isakmp#1 msgid:f1d8e974 proposal=AES_CBC_256-HMAC_SHA2_256_128-MODP4096 pfsgroup=MODP4096}
115 "test" #2: sent Quick Mode request
004 "test" #2: IPsec SA established tunnel mode {ESPinUDP=>0x882753b2 <0x20bebe22 xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATOA=none NATD=150.240.168.102:4500 DPD=active}# ipsec showstates
000 #1: "test":4500 STATE_MAIN_I4 (IKE SA established); REPLACE in 27253s; newest ISAKMP; lastdpd=8s(seq in:4275 out:0); idle;
000 #2: "test":4500 STATE_QUICK_I2 (IPsec SA established); REPLACE in 2294s; isakmp#1; idle;
000 #2: "test" esp.882753b2@150.240.168.102 esp.20bebe22@10.240.4.36 tun.0@150.240.168.102 tun.0@10.240.4.36 Traffic: ESPin=0B ESPout=0B ESPmax=4194303B
000 #3: "test":4500 STATE_QUICK_R2 (IPsec SA established); REPLACE in 2781s; newest IPSEC; eroute owner; isakmp#1; idle;
000 #3: "test" esp.e15847f0@150.240.168.102 esp.a8d26398@10.240.4.36 tun.0@150.240.168.102 tun.0@10.240.4.36 Traffic: ESPin=0B ESPout=0B ESPmax=4194303BVPN-02:
# ipsec auto --up test
002 "test" #3: initiating Quick Mode IKEv1+PSK+ENCRYPT+TUNNEL+PFS+UP+IKE_FRAG_ALLOW+ESN_NO {using isakmp#1 msgid:e4fa3c2f proposal=AES_CBC_256-HMAC_SHA2_256_128-MODP4096 pfsgroup=MODP4096}
115 "test" #3: sent Quick Mode request
004 "test" #3: IPsec SA established tunnel mode {ESPinUDP=>0xa8d26398 <0xe15847f0 xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATOA=none NATD=150.240.168.34:4500 DPD=active}# ipsec showstates
000 #1: "test":4500 STATE_MAIN_R3 (IKE SA established); REPLACE in 28384s; newest ISAKMP; lastdpd=19s(seq in:7064 out:0); idle;
000 #2: "test":4500 STATE_QUICK_R2 (IPsec SA established); REPLACE in 3184s; isakmp#1; idle;
000 #2: "test" esp.20bebe22@150.240.168.34 esp.882753b2@192.168.8.22 tun.0@150.240.168.34 tun.0@192.168.8.22 Traffic: ESPin=0B ESPout=0B ESPmax=4194303B
000 #3: "test":4500 STATE_QUICK_I2 (IPsec SA established); REPLACE in 2467s; newest IPSEC; eroute owner; isakmp#1; idle;
000 #3: "test" esp.a8d26398@150.240.168.34 esp.e15847f0@192.168.8.22 tun.0@150.240.168.34 tun.0@192.168.8.22 Traffic: ESPin=0B ESPout=0B ESPmax=4194303BYou should be seeing something like:
"east"[1] 192.1.3.209 #1: responding to Main Mode from unknown peer 192.1.3.209:500
"east"[1] 192.1.3.209 #1: sent Main Mode R1
"east"[1] 192.1.3.209 #1: sent Main Mode R2
"east"[1] 192.1.3.209 #1: Peer ID is ID_IPV4_ADDR: '192.1.3.174'
"east"[1] 192.1.3.209 #1: IKE SA established {auth=PRESHARED_KEY cipher=3DES_CBC_192 integ=HMAC_SHA1 group=MODP2048}
"east"[1] 192.1.3.209 #1: the peer proposed: 192.0.2.128/30->192.0.1.128/30
"east"[1] 192.1.3.209 #1: cannot respond to IPsec SA request because no connection is known for 192.0.2.128/30===192.1.2.23[@east]...192.1.3.209[192.1.3.174]===192.0.1.128/30@cagney I don't see this output. Which version of ipsec did you use for this test? What is the ipsec configuration? I don't know why I keep having this problem?
cagney
commented
1 year ago @sky9090 it was with 4.11 - the only difference is security updates
I've put the config I used when trying to reproduce the problem in testing/pluto/github-1210-ikev1-quick-mismatch. Presumably it needs further work.
sky9090
commented
1 year ago Ok, I'll try to use libreswan 4.11 for some testing.
sky9090
commented
1 year ago @cagney I used libreswan 4.11 for testing, but still encountered this issue.I have libreswan 4.11 installed on RHEL8 and I would like to know what OS you use for testing?
cagney
commented
1 year ago Fedora 36 and mainline https://testing.libreswan.org/v4.9-2103-g46f9d0758f-main/github-1210-ikev1-quick-mismatch I also tried the test with v4.12 and Fedora 35.
Presumably there is some sort of functional difference between the configuration of the above test and your scenario.
sky9090
commented
1 year ago @cagney I check the output in the /var/log/pluto.log file, why was the confirmation sent when the cidr clearly did not match between these two VPN peers.
Aug 9 04:37:30.735851: "west" #21: IKE SA established {auth=PRESHARED_KEY cipher=3DES_CBC_192 integ=HMAC_SHA1 group=MODP2048}
Aug 9 04:37:30.737812: "west" #21: the peer proposed: 12.167.9.0/24 -
bleve
commented
1 year ago This log file is mangled - we can't verify from this log snippet. Please edit with correct log as a code block so it won't get mangled so badly.
I guess you have 192.168.9.0/24 --> 10.240.3.0/24 on second log line before editing - which exactly matches expected .
sky9090
commented
1 year ago @cagney I have posted more logs of these two peers, please help to check, thank you.
Aug 9 22:28:29.556714: "west": added IKEv1 connection
Aug 9 22:28:29.556899: listening for IKE messages
Aug 9 22:28:29.557293: Kernel supports NIC esp-hw-offload
Aug 9 22:28:29.557448: adding UDP interface eth0 192.168.9.5:500
Aug 9 22:28:29.557617: adding UDP interface eth0 192.168.9.5:4500
Aug 9 22:28:29.557691: adding UDP interface lo 127.0.0.1:500
Aug 9 22:28:29.557740: adding UDP interface lo 127.0.0.1:4500
Aug 9 22:28:29.557799: adding UDP interface lo [::1]:500
Aug 9 22:28:29.557903: adding UDP interface lo [::1]:4500
Aug 9 22:28:29.560382: loading secrets from "/etc/ipsec.secrets"
Aug 9 22:28:29.560465: loading secrets from "/etc/ipsec.d/test.secrets"
Aug 9 22:28:29.561021: initiating all conns with alias='base'
Aug 9 22:28:29.561107: no connection named "base"
Aug 9 22:28:29.561339: "west" #1: initiating IKEv1 Main Mode connection
Aug 9 22:28:29.561469: "west" #1: sent Main Mode request
Aug 9 22:28:29.564419: "west" #1: sent Main Mode I2
Aug 9 22:28:29.567372: "west" #1: sent Main Mode I3
Aug 9 22:28:29.568616: "west" #1: Peer ID is ID_IPV4_ADDR: '150.240.168.104'
Aug 9 22:28:29.568779: "west" #1: IKE SA established {auth=PRESHARED_KEY cipher=3DES_CBC_192 integ=HMAC_SHA1 group=MODP2048}
Aug 9 22:28:29.568820: "west" #2: initiating Quick Mode IKEv1+PSK+ENCRYPT+TUNNEL+PFS+UP+IKE_FRAG_ALLOW+ESN_NO+ESN_YES {using isakmp#1 msgid:a18aeb74 proposal=AES_CBC_256-HMAC_SHA2_256_128 pfsgroup=MODP2048}
Aug 9 22:28:29.570694: "west" #2: sent Quick Mode request
Aug 9 22:28:29.632798: "west" #2: IPsec SA established tunnel mode {ESPinUDP=>0xa1b24f53 <0xb854a25c xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATD=150.240.168.104:4500 DPD=passive}
Aug 9 22:28:33.249044: "west" #3: responding to Main Mode
Aug 9 22:28:33.249191: "west" #3: sent Main Mode R1
Aug 9 22:28:33.252946: "west" #3: sent Main Mode R2
Aug 9 22:28:33.254441: "west" #3: Peer ID is ID_IPV4_ADDR: '150.240.168.104'
Aug 9 22:28:33.254760: "west" #3: IKE SA established {auth=PRESHARED_KEY cipher=3DES_CBC_192 integ=HMAC_SHA1 group=MODP2048}
Aug 9 22:28:33.256890: "west" #3: the peer proposed: 12.167.9.0/24 -<all>-> 10.240.3.0/24
Aug 9 22:28:33.259501: "west" #4: responding to Quick Mode proposal {msgid:f2ff47a0}
Aug 9 22:28:33.259523: "west" #4: us: 192.168.9.0/24===192.168.9.5[150.240.168.105] them: 150.240.168.104===10.240.3.0/24
Aug 9 22:28:33.260242: "west" #4: sent Quick Mode reply, inbound IPsec SA installed, expecting confirmation tunnel mode {ESPinUDP=>0x5cf5809e <0x7d37f414 xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATD=150.240.168.104:4500 DPD=passive}
Aug 9 22:28:33.262427: "west" #4: IPsec SA established tunnel mode {ESPinUDP=>0x5cf5809e <0x7d37f414 xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATD=150.240.168.104:4500 DPD=passive}Aug 9 22:28:25.237509: "east": added IKEv1 connection
Aug 9 22:28:25.237599: listening for IKE messages
Aug 9 22:28:25.238082: Kernel supports NIC esp-hw-offload
Aug 9 22:28:25.238175: adding UDP interface eth0 10.240.3.7:500
Aug 9 22:28:25.238261: adding UDP interface eth0 10.240.3.7:4500
Aug 9 22:28:25.238287: adding UDP interface lo 127.0.0.1:500
Aug 9 22:28:25.238305: adding UDP interface lo 127.0.0.1:4500
Aug 9 22:28:25.238328: adding UDP interface lo [::1]:500
Aug 9 22:28:25.238373: adding UDP interface lo [::1]:4500
Aug 9 22:28:25.240132: loading secrets from "/etc/ipsec.secrets"
Aug 9 22:28:25.240173: loading secrets from "/etc/ipsec.d/test.secrets"
Aug 9 22:28:25.240268: initiating all conns with alias='base'
Aug 9 22:28:25.240276: no connection named "base"
Aug 9 22:28:25.240350: "east" #1: initiating IKEv1 Main Mode connection
Aug 9 22:28:25.240474: "east" #1: sent Main Mode request
Aug 9 22:28:25.740478: "east" #1: STATE_MAIN_I1: retransmission; will wait 0.5 seconds for response
Aug 9 22:28:26.241247: "east" #1: STATE_MAIN_I1: retransmission; will wait 1 seconds for response
Aug 9 22:28:27.242468: "east" #1: STATE_MAIN_I1: retransmission; will wait 2 seconds for response
Aug 9 22:28:29.244762: "east" #1: STATE_MAIN_I1: retransmission; will wait 4 seconds for response
Aug 9 22:28:29.562594: "east" #2: responding to Main Mode
Aug 9 22:28:29.562774: "east" #2: sent Main Mode R1
Aug 9 22:28:29.566458: "east" #2: sent Main Mode R2
Aug 9 22:28:29.568170: "east" #2: Peer ID is ID_IPV4_ADDR: '150.240.168.105'
Aug 9 22:28:29.568763: "east" #2: IKE SA established {auth=PRESHARED_KEY cipher=3DES_CBC_192 integ=HMAC_SHA1 group=MODP2048}
Aug 9 22:28:29.571601: "east" #2: the peer proposed: 10.240.3.0/24 -<all>-> 192.168.9.0/24
Aug 9 22:28:29.573517: "east" #3: responding to Quick Mode proposal {msgid:a18aeb74}
Aug 9 22:28:29.573532: "east" #3: us: 10.240.3.0/24===10.240.3.7[150.240.168.104] them: 150.240.168.105===12.167.9.0/24
Aug 9 22:28:29.574026: "east" #3: sent Quick Mode reply, inbound IPsec SA installed, expecting confirmation tunnel mode {ESPinUDP=>0xb854a25c <0xa1b24f53 xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATD=150.240.168.105:4500 DPD=passive}
Aug 9 22:28:29.671096: "east" #3: IPsec SA established tunnel mode {ESPinUDP=>0xb854a25c <0xa1b24f53 xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATD=150.240.168.105:4500 DPD=passive}
Aug 9 22:28:33.248917: "east" #1: STATE_MAIN_I1: retransmission; will wait 8 seconds for response
Aug 9 22:28:33.251229: "east" #1: sent Main Mode I2
Aug 9 22:28:33.254591: "east" #1: sent Main Mode I3
Aug 9 22:28:33.255614: "east" #1: Peer ID is ID_IPV4_ADDR: '150.240.168.105'
Aug 9 22:28:33.255772: "east" #1: IKE SA established {auth=PRESHARED_KEY cipher=3DES_CBC_192 integ=HMAC_SHA1 group=MODP2048}
Aug 9 22:28:33.255801: "east" #4: initiating Quick Mode IKEv1+PSK+ENCRYPT+TUNNEL+PFS+UP+IKE_FRAG_ALLOW+ESN_NO+ESN_YES {using isakmp#1 msgid:f2ff47a0 proposal=AES_CBC_256-HMAC_SHA2_256_128 pfsgroup=MODP2048}
Aug 9 22:28:33.257033: "east" #4: sent Quick Mode request
Aug 9 22:28:33.262531: "east" #4: IPsec SA established tunnel mode {ESPinUDP=>0x7d37f414 <0x5cf5809e xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATD=150.240.168.105:4500 DPD=passive}I guess you have 192.168.9.0/24 --> 10.240.3.0/24 on second log line before editing - which exactly matches expected .
What does that mean? The CIDR range on one side is: 12.167.9.0/24 <-> 10.240.3.0/24, the other side the CIDR range is 10.240.3.0/24 <-> 192.168.9.0/24. The CIDR ranges actually do not match.
paulwouters
commented
1 year ago When the mismatched connection is established, can you run on both ends:ip xfrm stateip xfrm policyAnd share that with us ?PaulSent using a virtual keyboard on a phoneOn Aug 9, 2023, at 23:06, ppeixiao @.***> wrote:
I guess you have 192.168.9.0/24 --> 10.240.3.0/24 on second log line before editing - which exactly matches expected .
What does that mean? The CIDR range on one side is: 12.167.9.0/24 <-> 10.240.3.0/24, the other side the CIDR range is 10.240.3.0/24 <-> 192.168.9.0/24. The CIDR ranges actually do not match.
—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you are subscribed to this thread.Message ID: @.***>
sky9090
commented
1 year ago @paulwouters The XFRM state and policy output are as follows:
# ipsec look
ppei-vsi-01 Fri Aug 11 00:21:49 EDT 2023
XFRM state:
src 150.240.168.105 dst 10.240.3.7
proto esp spi 0xc1873bfd reqid 16389 mode tunnel
replay-window 0 flag af-unspec
auth-trunc hmac(sha1) 0x0b25aa8085f14451610d5eba7ee4b79c287af606 96
enc cbc(aes) 0x96aad09554154f067180aefb93dae577
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0x0, oseq-hi 0x0, oseq 0x0
replay_window 128, bitmap-length 4
00000000 00000000 00000000 00000000
src 10.240.3.7 dst 150.240.168.105
proto esp spi 0x4397b78a reqid 16389 mode tunnel
replay-window 0 flag af-unspec
auth-trunc hmac(sha1) 0xddd357ee09ccfa224fe07ed728718aa8e0dcaf9a 96
enc cbc(aes) 0x78b0823b1f3e1916fa19068760e7b5e8
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0x0, oseq-hi 0x0, oseq 0x0
replay_window 128, bitmap-length 4
00000000 00000000 00000000 00000000
XFRM policy:
src 10.240.3.0/24 dst 12.167.9.0/24
dir out priority 1757393 ptype main
tmpl src 10.240.3.7 dst 150.240.168.105
proto esp reqid 16389 mode tunnel
src 12.167.9.0/24 dst 10.240.3.0/24
dir fwd priority 1757393 ptype main
tmpl src 150.240.168.105 dst 10.240.3.7
proto esp reqid 16389 mode tunnel
src 12.167.9.0/24 dst 10.240.3.0/24
dir in priority 1757393 ptype main
tmpl src 150.240.168.105 dst 10.240.3.7
proto esp reqid 16389 mode tunnel
src ::/0 dst ::/0 proto ipv6-icmp type 135
dir fwd priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 135
dir in priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 135
dir out priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 136
dir fwd priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 136
dir in priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 136
dir out priority 1 ptype main
XFRM done
IPSEC mangle TABLES
iptables filter TABLE
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ROUTING TABLES
default via 10.240.3.1 dev eth0
default via 10.240.3.1 dev eth0 proto dhcp src 10.240.3.7 metric 100
10.240.3.0/24 dev eth0 proto kernel scope link src 10.240.3.7 metric 100
::1 dev lo proto kernel metric 256 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
NSS_CERTIFICATES
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI# ipsec look
ppei-vsi-02 Fri Aug 11 00:22:28 EDT 2023
XFRM state:
src 150.240.168.104 dst 192.168.9.5
proto esp spi 0x4397b78a reqid 16389 mode tunnel
replay-window 0 flag af-unspec
auth-trunc hmac(sha1) 0xddd357ee09ccfa224fe07ed728718aa8e0dcaf9a 96
enc cbc(aes) 0x78b0823b1f3e1916fa19068760e7b5e8
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0x0, oseq-hi 0x0, oseq 0x0
replay_window 128, bitmap-length 4
00000000 00000000 00000000 00000000
src 192.168.9.5 dst 150.240.168.104
proto esp spi 0xc1873bfd reqid 16389 mode tunnel
replay-window 0 flag af-unspec
auth-trunc hmac(sha1) 0x0b25aa8085f14451610d5eba7ee4b79c287af606 96
enc cbc(aes) 0x96aad09554154f067180aefb93dae577
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0x0, oseq-hi 0x0, oseq 0x0
replay_window 128, bitmap-length 4
00000000 00000000 00000000 00000000
XFRM policy:
src 10.240.3.0/24 dst 192.168.9.0/24
dir fwd priority 1757393 ptype main
tmpl src 150.240.168.104 dst 192.168.9.5
proto esp reqid 16389 mode tunnel
src 10.240.3.0/24 dst 192.168.9.0/24
dir in priority 1757393 ptype main
tmpl src 150.240.168.104 dst 192.168.9.5
proto esp reqid 16389 mode tunnel
src 192.168.9.0/24 dst 10.240.3.0/24
dir out priority 1757393 ptype main
tmpl src 192.168.9.5 dst 150.240.168.104
proto esp reqid 16389 mode tunnel
src ::/0 dst ::/0 proto ipv6-icmp type 135
dir fwd priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 135
dir in priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 135
dir out priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 136
dir fwd priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 136
dir in priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 136
dir out priority 1 ptype main
XFRM done
IPSEC mangle TABLES
iptables filter TABLE
/usr/local/libexec/ipsec/look: line 163: iptables: command not found
ROUTING TABLES
default via 192.168.9.1 dev eth0
default via 192.168.9.1 dev eth0 proto dhcp src 192.168.9.5 metric 100
192.168.9.0/24 dev eth0 proto kernel scope link src 192.168.9.5 metric 100
::1 dev lo proto kernel metric 256 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
NSS_CERTIFICATES
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
letoams
commented
1 year ago On Thu, 10 Aug 2023, ppeixiao wrote:
@paulwouters The XFRM state and policy output are as follows:
ipsec look
ppei-vsi-01 Fri Aug 11 00:21:49 EDT 2023 XFRM state: src 150.240.168.105 dst 10.240.3.7
Note the IPs of the endpoints here: 150.240.168.105 and 10.240.3.7
And the two SPIs are:
proto esp spi 0xc1873bfd reqid 16389 mode tunnel
proto esp spi 0x4397b78a reqid 16389 mode tunnel
And the subnets are:
XFRM policy: src 10.240.3.0/24 dst 12.167.9.0/24
Now let's check the other side:
ppei-vsi-02 Fri Aug 11 00:22:28 EDT 2023 XFRM state: src 150.240.168.104 dst 192.168.9.5
These are two different IPs. Are both endpoints behind NAT? Are there port forwards in place?
proto esp spi 0x4397b78a reqid 16389 mode tunnel
proto esp spi 0xc1873bfd reqid 16389 mode tunnel
Looks like the same SPIs.
src 10.240.3.0/24 dst 192.168.9.0/24
And indeed different subnets.
This will cause all packet flows to get rejected by one endpoint or the other.
This is really strange.
cagney
commented
1 year ago how does this compare to github-1210-ikev1-quick-mismatch
sky9090
commented
1 year ago @letoams I think both endpoints are behind NAT and the port forwards are set in place. This problem does not occur when I switch the ike version to ikev2. Is there any other information I need to provide so that you can help debug more.
OS:
libreswan version:
VPN-01: leftsubnets=10.240.4.0/24 rightsubnets=100.64.4.0/24
VPN-02: leftsubnets=192.168.8.0/24 rightsubnets=172.16.4.0/24
VPN-01 ipsec status:
VPN-02 ipsec status:
The CIDR of two ikev1 VPN peers does not match but I saw the vpn connection is always up.