Version vom 17. November 2017, 10:04 Uhr

VPN Check

CONN=s2s
CHECK="(CHILD_SA|failed|error|could not|proposal|not match)"
PATTERN=${CONN}.*$CHECK

Abfrage

tail -f /var/log/strongswan/charon.log | egrep "$PATTERN"

Verbindung erfolgreich

Nov 17 10:29:36 01[IKE] <s2s|1> sending DELETE for ESP CHILD_SA with SPI c484ade1
Nov 17 10:29:38 04[CFG] <s2s|2> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:29:38 16[CFG] <s2s|2> received proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:29:38 16[CFG] <s2s|2> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:29:38 03[CFG] <s2s|2> configured proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ
Nov 17 10:29:38 03[CFG] <s2s|2> configured proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ
Nov 17 10:29:38 06[CFG] <s2s|2> received proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ
Nov 17 10:29:38 06[CFG] <s2s|2> configured proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ
Nov 17 10:29:38 06[IKE] <s2s|2> CHILD_SA s2s{2} established with SPIs c3dde116_i ced89952_o and TS 10.83.33.0/24 === 10.83.32.0/24

PSK falsch

Nov 17 10:32:47 16[CFG] <s2s|2> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:32:47 15[CFG] <s2s|2> received proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:32:47 15[CFG] <s2s|2> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:32:47 04[ENC] <s2s|2> invalid HASH_V1 payload length, decryption failed?
Nov 17 10:32:47 04[ENC] <s2s|2> could not decrypt payloads
Nov 17 10:32:47 04[IKE] <s2s|2> message parsing failed
Nov 17 10:32:47 04[IKE] <s2s|2> INFORMATIONAL_V1 request with message ID 2548885084 processing failed

PHASE1 oder PHASE2 Proposals

PHASE1 und PHASE2 ok

Nov 17 10:12:35 05[CFG] <s2s|2> received proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:12:35 05[CFG] <s2s|2> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:12:35 05[CFG] <s2s|2> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
...
Nov 17 10:12:35 01[CFG] <s2s|2> received proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ
Nov 17 10:12:35 01[CFG] <s2s|2> configured proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ
Nov 17 10:12:35 01[CFG] <s2s|2> selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ

Fehlkonfiguration der Proposals

Nov 17 10:38:28 06[CFG] <s2s|1> configured proposals:

PHASE1 Proposals werden nicht beantwortet

Es fehlt das selected proposal bei IKE

Nov 17 10:42:24 01[CFG] <s2s|3> configured proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
Nov 17 10:42:24 12[IKE] <s2s|3> received NO_PROPOSAL_CHOSEN error notify

Verschiedene Phase2 Proposals

Es fehlt das selected proposal bei ESP

Nov 17 10:46:24 06[CFG] <s2s|2> received proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:46:24 06[CFG] <s2s|2> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:46:24 06[CFG] <s2s|2> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:46:24 03[CFG] <s2s|2> configured proposals: ESP:AES_CBC_256/HMAC_SHA1_96/MODP_2048/NO_EXT_SEQ
Nov 17 10:46:24 03[CFG] <s2s|2> configured proposals: ESP:AES_CBC_256/HMAC_SHA1_96/MODP_2048/NO_EXT_SEQ
Nov 17 10:46:24 02[IKE] <s2s|2> received NO_PROPOSAL_CHOSEN error notify

Falsches Netz

Nov 17 10:49:14 14[CFG] <s2s|1> received proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:49:14 14[CFG] <s2s|1> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:49:14 14[CFG] <s2s|1> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:49:14 16[CFG] <s2s|1> configured proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ
Nov 17 10:49:14 16[CFG] <s2s|1> configured proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ
Nov 17 10:49:14 05[IKE] <s2s|1> received INVALID_ID_INFORMATION error notify

Falsche ID

Nov 17 10:57:34 05[CFG] <s2s|17> received proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:57:34 05[CFG] <s2s|17> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:57:34 05[CFG] <s2s|17> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Nov 17 10:57:34 16[IKE] <s2s|17> IDir 'tiazel' does not match to '10.84.252

=

ipsec up s2s

initiating Main Mode IKE_SA s2s[19] to 10.84.252.32 generating ID_PROT request 0 [ SA V V V V ] sending packet: from 10.84.252.33[500] to 10.84.252.32[500] (156 bytes) received packet: from 10.84.252.32[500] to 10.84.252.33[500] (136 bytes) parsed ID_PROT response 0 [ SA V V V ] received XAuth vendor ID received DPD vendor ID received NAT-T (RFC 3947) vendor ID generating ID_PROT request 0 [ KE No NAT-D NAT-D ] sending packet: from 10.84.252.33[500] to 10.84.252.32[500] (396 bytes) received packet: from 10.84.252.32[500] to 10.84.252.33[500] (396 bytes) parsed ID_PROT response 0 [ KE No NAT-D NAT-D ] generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ] sending packet: from 10.84.252.33[500] to 10.84.252.32[500] (108 bytes) received packet: from 10.84.252.32[500] to 10.84.252.33[500] (92 bytes) parsed ID_PROT response 0 [ ID HASH ] IDir 'tiazel' does not match to '10.84.252.32' deleting IKE_SA s2s[19] between 10.84.252.33[10.84.252.33]...10.84.252.32[%any] sending DELETE for IKE_SA s2s[19] generating INFORMATIONAL_V1 request 2142858728 [ HASH D ] sending packet: from 10.84.252.33[500] to 10.84.252.32[500] (108 bytes) connection 's2s' established successfully

Angebotene IKE Lifetime

Nov 16 22:19:51 12[IKE] <s2s|5> maximum IKE_SA lifetime 3375s

Strongswan Check: Unterschied zwischen den Versionen