Strongswan on Leaf

   Trying to integrate Leaf with a Cisco Meraki using Strongswan.

   I upgraded to the current release of Leaf, and I'm getting this trying
   to bring the tunnel up:

   Apr 12 09:16:57 192 syslog: 08[CFG] selected proposal:
   IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
   Apr 12 09:16:57 192 syslog: 08[ENC] generating ID_PROT request 0 [ KE
   No NAT-D NAT-D ]
   Apr 12 09:16:57 192 syslog: 08[NET] sending packet: from
   192.168.10.10[500] to 192.168.10.20[500] (308 bytes)
   Apr 12 09:16:57 192 syslog: 11[NET] received packet: from
   192.168.10.20[500] to 192.168.10.10[500] (292 bytes)
   Apr 12 09:16:57 192 syslog: 11[ENC] parsed ID_PROT response 0 [ KE No
   NAT-D NAT-D ]
   Apr 12 09:16:57 192 syslog: 11[ENC] generating ID_PROT request 0 [ ID
   HASH N(INITIAL_CONTACT) ]
   Apr 12 09:16:57 192 syslog: 11[NET] sending packet: from
   192.168.10.10[500] to 192.168.10.20[500] (108 bytes)
   Apr 12 09:16:58 192 syslog: 14[NET] received packet: from
   192.168.10.20[500] to 192.168.10.10[500] (92 bytes)
   Apr 12 09:16:58 192 syslog: 14[ENC] parsed ID_PROT response 0 [ ID HASH
   V ]
   Apr 12 09:16:58 192 syslog: 14[IKE] received DPD vendor ID
   Apr 12 09:16:58 192 syslog: 14[IKE] IKE_SA meraki[1] established
   between 192.168.10.10[192.168.10.10]...192.168.10.20[192.168.10.20]
   Apr 12 09:16:58 192 syslog: 14[ENC] generating QUICK_MODE request
   2660676867 [ HASH SA No ID ID ]
   Apr 12 09:16:58 192 syslog: 14[NET] sending packet: from
   192.168.10.10[500] to 192.168.10.20[500] (236 bytes)
   Apr 12 09:16:58 192 syslog: 16[NET] received packet: from
   192.168.10.20[500] to 192.168.10.10[500] (172 bytes)
   Apr 12 09:16:58 192 syslog: 16[ENC] parsed QUICK_MODE response
   2660676867 [ HASH SA No ID ID ]
   Apr 12 09:16:58 192 syslog: 16[CFG] selected proposal:
   ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ
   Apr 12 09:16:58 192 syslog: 16[KNL] received netlink error: Function
   not implemented (38)
   Apr 12 09:16:58 192 syslog: 16[KNL] unable to add SAD entry with SPI
   ca9aa707 (FAILED)
   Apr 12 09:16:58 192 syslog: 16[KNL] received netlink error: Function
   not implemented (38)
   Apr 12 09:16:58 192 syslog: 16[KNL] unable to add SAD entry with SPI
   02ff536a (FAILED)

   Which seems to mean - lack of support for AES in the kernel?

   ipsec.conf:

           conn meraki
           left=192.168.10.10
           leftsubnet=192.168.65.0/24
           leftid=192.168.10.10
           right=192.168.10.20
           rightsubnet=192.168.128.0/24
           rightid=192.168.10.20
           ike=aes128-sha1-modp1536
           esp=aes128-sha1
           rekeymargin=3600s
           aggressive=no
           authby=psk
           keyingtries=%forever
           leftauth=psk
           rightauth=psk
           keyexchange=ikev1
           ikelifetime=1h
           lifetime=8h
           dpddelay=30
           dpdtimeout=120
           dpdaction=restart
           auto=start

   Am I reading that error correctly?  Anyone using Strongswan/IPSEC on
   Leaf?

   - Bob

------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/