Re: Strongswan on Leaf

Hi Bob

Am 12.04.2022 um 11:29 schrieb Robert K Coffman Jr. -Info From Data Corp.:
>     Trying to integrate Leaf with a Cisco Meraki using Strongswan.
> 
>     I upgraded to the current release of Leaf, and I'm getting this trying
>     to bring the tunnel up:
> 
>     Apr 12 09:16:57 192 syslog: 08[CFG] selected proposal:
>     IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
>     Apr 12 09:16:57 192 syslog: 08[ENC] generating ID_PROT request 0 [ KE
>     No NAT-D NAT-D ]
>     Apr 12 09:16:57 192 syslog: 08[NET] sending packet: from
...>     Apr 12 09:16:58 192 syslog: 16[NET] received packet: from
>     192.168.10.20[500] to 192.168.10.10[500] (172 bytes)
>     Apr 12 09:16:58 192 syslog: 16[ENC] parsed QUICK_MODE response
>     2660676867 [ HASH SA No ID ID ]
>     Apr 12 09:16:58 192 syslog: 16[CFG] selected proposal:
>     ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ
>     Apr 12 09:16:58 192 syslog: 16[KNL] received netlink error: Function
>     not implemented (38)
>     Apr 12 09:16:58 192 syslog: 16[KNL] unable to add SAD entry with SPI
>     ca9aa707 (FAILED)
>     Apr 12 09:16:58 192 syslog: 16[KNL] received netlink error: Function
>     not implemented (38)
>     Apr 12 09:16:58 192 syslog: 16[KNL] unable to add SAD entry with SPI
>     02ff536a (FAILED)
> 
>     Which seems to mean - lack of support for AES in the kernel?
> 
>     ipsec.conf:
> 
>             conn meraki
>             left=192.168.10.10
>             leftsubnet=192.168.65.0/24
>             leftid=192.168.10.10
>             right=192.168.10.20
>             rightsubnet=192.168.128.0/24
>             rightid=192.168.10.20
>             ike=aes128-sha1-modp1536
>             esp=aes128-sha1
>             rekeymargin=3600s
>             aggressive=no
>             authby=psk
>             keyingtries=%forever
>             leftauth=psk
>             rightauth=psk
>             keyexchange=ikev1
>             ikelifetime=1h
>             lifetime=8h
>             dpddelay=30
>             dpdtimeout=120
>             dpdaction=restart
>             auto=start
> 
>     Am I reading that error correctly?  Anyone using Strongswan/IPSEC on
>     Leaf?

It has been quite a while that I used IPSEC on Leaf. It looks like the 
peers cannot agree on the proposals. I typically did not specify too 
much on the ike and esp parameters to give the local machine a chance to 
agree on something. It looks like it is failing on the esp parameter.

Crypto in the kernel relies mostly on modules which may not be loaded as 
a default. Please check with lsmod and possibly add it in /etc/modules.

cheers

ET

------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/