I got the 3 certs into the sonicwall and the tunnel appears to be up, stay up but i can not pass any traffic from either network. Ipsec statusall does not show any SA's:
ipsec statusall
Status of IKEv2 charon daemon (strongSwan 4.4.0):
uptime: 17 minutes, since Apr 06 09:41:57 2012
worker threads: 9 idle of 16, job queue load: 0, scheduled events: 0
loaded plugins: curl ldap aes des sha1 sha2 md5 random x509 pubkey pkcs1 pgp dnskey pem openssl gcrypt fips-prf xcbc hmac gmp attr kernel-netlink socket-raw stroke updown resolve
Listening IP addresses:
192.168.1.18
Connections:
teknerds: 192.168.1.18...sonicwall.public.ip
teknerds: local: [strongswan.id] uses pre-shared key authentication
teknerds: remote: [sonicwall.id] uses any authentication
teknerds: child: 192.168.1.0/24 === 192.168.123.0/24
Security Associations:
none
I get the same output from ipsec up <conn> as when i did not have all 3 certs installed on the sonicwall:
initiating IKE_SA teknerds[1] to sonicwall.public.ip
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
sending packet: from 192.168.1.18[500] to sonicwall.public.ip[500]
received packet: from sonicwall.public.ip[500] to 192.168.1.18[500]
parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]
peer didn't accept DH group MODP_2048, it requested MODP_1024
initiating IKE_SA teknerds[1] to sonicwall.public.ip
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
sending packet: from 192.168.1.18[500] to sonicwall.public.ip[500]
received packet: from sonicwall.public.ip[500] to 192.168.1.18[500]
parsed IKE_SA_INIT response 0 [ SA KE No CERTREQ N(NATD_S_IP) N(NATD_D_IP) V ]
local host is behind NAT, sending keep alives
received cert request for "C=CH, O=ELC, CN=Edens Land Corp CA"
sending cert request for "C=CH, O=ELC, CN=Edens Land Corp CA"
authentication of 'strongswan.id' (myself) with pre-shared key
establishing CHILD_SA teknerds
generating IKE_AUTH request 1 [ IDi CERTREQ IDr AUTH SA TSi TSr N(EAP_ONLY) ]
sending packet: from 192.168.1.18[4500] to sonicwall.public.ip[4500]
received packet: from sonicwall.public.ip[4500] to 192.168.1.18[4500]
parsed IKE_AUTH response 1 [ IDr AUTH SA TSi TSr N(INIT_CONTACT) ]
authentication of 'sonicwall.id' with pre-shared key successful
constraint check failed: identity 'sonicwall.id' required
selected peer config 'teknerds' inacceptable
no alternative config found
----- Original Message -----
From: "Andreas Steffen" <andreas.steffen-***@public.gmane.org>
To: "Chris Arnold" <carnold-lmTtMILVy1gHLEsm+***@public.gmane.org>
Sent: Friday, April 6, 2012 5:02:24 AM
Subject: Re: [strongSwan] Question on IKEv2
Hello Chris,
I know what the problem is. The openssl pkcs12 command does not
accept keys and certificates in binary DER format. Therefore
if you generate keys and certificates with ipsec pki,
use the option --outform pem (the default being der).
Alternatively, if you want to convert existing binary DER files you
can use:
openssl rsa -inform der -in peerKey.der -out peerKey.pem
openssl x509 -inform der -in peerCert.der -out peerCert.pem
Regards
Andreas
Andreas, It is actually the peerKey.der that will not import.
Attached are the peerCert.der, peerKey.der and caCert.der. I trust
you will destroy these for security purposes. Thank you for your
help. I tried to package the 3 files together using: openssl pkcs12
-export -out sonicwall.p12 -inkey peerKey.der -in peerCert.der
-certfile caCert.der
and get unable to load private key. I wonder if something is wrong
with the peerKey.der file..
----- Original Message ----- From: "Andreas
Sent: Thursday, April 5, 2012 3:57:10 AM Subject: Re: [strongSwan]
Question on IKEv2
Hi Chris,
can you send me your caCert.der certificate?
Andreas
Post by Chris ArnoldThank you all for not calling me an id10t!! I read, completely,
the email Andreas sent and saw where you can use the pki tool....
So, I followed the instructions and on the import of caCert.der
into the sonicwall, I get the error, invalid format. Please use der
or pem. The other 2 files import fine into the sonicwall and they
too are der format.
======================================================================
strongSwan - the Linux VPN Solution!
www.strongswan.org Institute for Internet Technologies and
Applications University of Applied Sciences Rapperswil CH-8640
Rapperswil (Switzerland)
===========================================================[ITA-HSR]==
--
======================================================================
Andreas Steffen andreas.steffen-***@public.gmane.org
strongSwan - the Linux VPN Solution! www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[ITA-HSR]==