Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am having trouble configuring strongSwan 4.5.2 to work with iOS 7 and OS X Mavericks. I have followed these two guides, but am still encountering problems. http://teebeenator.blogspot.com/2013/06/strongswan-for-raspberry-pi.html http://wiki.strongswan.org/projects/strongswan/wiki/IOS_(Apple)

I suspect the issue is related to the old version of strongSwan; unfortunately, my server is a Raspberry Pi, and I don't think there is an easy way to get strongSwan 5.x on the Pi.

It might be a red herring, but I suspect that the following error message in my /var/log/auth.log has something to do with my issue:

message ignored because it contains an unexpected payload type (ISAKMP_NEXT_SA)

I cannot find anything helpful online about that error message (at least, nothing in English; I saw a few mentions of it in German).

Here is the contents of /etc/strongswan.conf

# strongswan.conf - strongSwan configuration file

charon {

    # number of worker threads in charon
    threads = 16

    # send strongswan vendor ID?
    # send_vendor_id = yes

    plugins {

        sql {
            # loglevel to log into sql database
            loglevel = -1

            # URI to the database
            # database = sqlite:///path/to/file.db
            # database = mysql://user:password@localhost/database
        }
        dhcp {
            identity_lease = yes
        }
    }

    # ...
}

pluto {
      dns1 = 192.168.0.1
}

libstrongswan {

    #  set to no, the DH exponent size is optimized
    #  dh_exponent_ansi_x9_42 = no
}

Next, the contents of /etc/ipsec.conf

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
    # plutodebug=all
    # crlcheckinterval=600
    # strictcrlpolicy=yes
    # cachecrls=yes
    nat_traversal=yes
    #charonstart=yes
    plutostart=yes

# Add connections here.

conn %default
        keyexchange=ikev1
        authby=xauthrsasig
        xauth=server
        left=%defaultroute
        leftsubnet=0.0.0.0/0
        leftfirewall=yes
        leftcert=serverCert.pem
        right=%any
        rightsubnet=10.0.0.0/24
        rightsourceip=10.0.0.2
        rightcert=clientCert.pem
        pfs=no
        auto=add
conn rw-eap
    dpdaction=clear
    dpddelay=300s
    leftauth=pubkey
    leftcert=serverCert.pem
    rightauth=eap-mschapv2
    rightsendcert=never

include /var/lib/strongswan/ipsec.conf.inc

And I have copied the following files, as directed in the guides:

cp caCert.pem /etc/ipsec.d/cacerts/
cp serverCert.pem /etc/ipsec.d/certs/
cp serverKey.pem /etc/ipsec.d/private/
cp clientCert.pem /etc/ipsec.d/certs/
cp clientKey.pem /etc/ipsec.d/private/

I also edited my /usr/lib/ssl/openssl.cnf file to contain an appropriate subjectAltName, before generating those certificates.

Any assistance would be much appreciated, even just suggesting how I might get a newer version of strongSwan on my Pi! Thanks!

The following are some more complete auth.log output, with the dates removed.

Starting server

sudo:       pi : TTY=pts/1 ; PWD=/home/pi ; USER=root ; COMMAND=/usr/sbin/ipsec start
sudo: pam_unix(sudo:session): session opened for user root by pi(uid=0)
ipsec_starter[22013]: Starting strongSwan 4.5.2 IPsec [starter]...
sudo: pam_unix(sudo:session): session closed for user root
pluto[22027]: Starting IKEv1 pluto daemon (strongSwan 4.5.2) THREADS SMARTCARD VENDORID
ipsec_starter[22026]: pluto (22027) started after 20 ms
pluto[22027]: listening on interfaces:
pluto[22027]:   eth0
pluto[22027]:     192.168.1.9
pluto[22027]: received netlink error: Address family not supported by protocol (97)
pluto[22027]: unable to create IPv6 routing table rule
pluto[22027]: loaded plugins: test-vectors curl ldap aes des sha1 sha2 md5 random x509 pkcs1 pgp dnskey pem openssl gmp hmac xauth attr kernel-netlink 
pluto[22027]:   including NAT-Traversal patch (Version 0.6c)
pluto[22027]: failed to load pkcs11 module '/usr/lib/opensc-pkcs11.so'
ipsec_starter[22026]: charon (22028) started after 740 ms
pluto[22027]: loading ca certificates from '/etc/ipsec.d/cacerts'
pluto[22027]:   loaded ca certificate from '/etc/ipsec.d/cacerts/caCert.pem'
pluto[22027]: loading aa certificates from '/etc/ipsec.d/aacerts'
pluto[22027]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
pluto[22027]: Changing to directory '/etc/ipsec.d/crls'
pluto[22027]: loading attribute certificates from '/etc/ipsec.d/acerts'
pluto[22027]: spawning 4 worker threads
pluto[22027]: listening for IKE messages
pluto[22027]: adding interface eth0/eth0 192.168.1.9:500
pluto[22027]: adding interface eth0/eth0 192.168.1.9:4500
pluto[22027]: adding interface lo/lo 127.0.0.1:500
pluto[22027]: adding interface lo/lo 127.0.0.1:4500
pluto[22027]: loading secrets from "/etc/ipsec.secrets"
pluto[22027]: no secrets filename matched "/var/lib/strongswan/ipsec.secrets.inc"
pluto[22027]:   loaded private key from 'serverKey.pem'
pluto[22027]:   loaded XAUTH secret for peter.story 
pluto[22027]:   loaded host certificate from '/etc/ipsec.d/certs/serverCert.pem'
pluto[22027]:   id '%any' not confirmed by certificate, defaulting to 'C=CH, O=storyZone, CN=storyzone.us.to'
pluto[22027]:   loaded host certificate from '/etc/ipsec.d/certs/clientCert.pem'
pluto[22027]:   id '%any' not confirmed by certificate, defaulting to 'C=CH, O=storyZone, CN=piclient'
pluto[22027]: added connection description "rw-eap"

Connection attempt from iOS

pluto[22027]: packet from 96.237.188.238:500: received Vendor ID payload [RFC 3947]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [4df37928e9fc4fd1b3262170d515c662]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [9909b64eed937c6573de52ace952fa6b]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
pluto[22027]: packet from 96.237.188.238:500: received Vendor ID payload [XAUTH]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [Cisco-Unity]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [FRAGMENTATION 80000000]
pluto[22027]: packet from 96.237.188.238:500: received Vendor ID payload [Dead Peer Detection]
pluto[22027]: "rw-eap"[1] 96.237.188.238 #1: responding to Main Mode from unknown peer 96.237.188.238
pluto[22027]: packet from 96.237.188.238:500: received Vendor ID payload [RFC 3947]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [4df37928e9fc4fd1b3262170d515c662]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [9909b64eed937c6573de52ace952fa6b]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
pluto[22027]: packet from 96.237.188.238:500: received Vendor ID payload [XAUTH]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [Cisco-Unity]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [FRAGMENTATION 80000000]
pluto[22027]: packet from 96.237.188.238:500: received Vendor ID payload [Dead Peer Detection]
pluto[22027]: "rw-eap"[1] 96.237.188.238 #2: responding to Main Mode from unknown peer 96.237.188.238
pluto[22027]: "rw-eap"[1] 96.237.188.238 #1: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_SA)
pluto[22027]: "rw-eap"[1] 96.237.188.238 #1: sending notification INVALID_PAYLOAD_TYPE to 96.237.188.238:500
pluto[22027]: "rw-eap"[1] 96.237.188.238 #2: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_SA)
pluto[22027]: "rw-eap"[1] 96.237.188.238 #2: sending notification INVALID_PAYLOAD_TYPE to 96.237.188.238:500
pluto[22027]: "rw-eap"[1] 96.237.188.238 #1: ignoring informational payload, type INVALID_PAYLOAD_TYPE
pluto[22027]: "rw-eap"[1] 96.237.188.238 #2: ignoring informational payload, type INVALID_PAYLOAD_TYPE
pluto[22027]: packet from 96.237.188.238:500: received Vendor ID payload [RFC 3947]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [4df37928e9fc4fd1b3262170d515c662]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [9909b64eed937c6573de52ace952fa6b]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
pluto[22027]: packet from 96.237.188.238:500: received Vendor ID payload [XAUTH]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [Cisco-Unity]
pluto[22027]: packet from 96.237.188.238:500: ignoring Vendor ID payload [FRAGMENTATION 80000000]
pluto[22027]: packet from 96.237.188.238:500: received Vendor ID payload [Dead Peer Detection]
pluto[22027]: "rw-eap"[1] 96.237.188.238 #3: responding to Main Mode from unknown peer 96.237.188.238
pluto[22027]: "rw-eap"[1] 96.237.188.238 #3: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_SA)
pluto[22027]: "rw-eap"[1] 96.237.188.238 #3: sending notification INVALID_PAYLOAD_TYPE to 96.237.188.238:500
pluto[22027]: "rw-eap"[1] 96.237.188.238 #3: ignoring informational payload, type INVALID_PAYLOAD_TYPE
pluto[22027]: "rw-eap"[1] 96.237.188.238 #2: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_SA)
pluto[22027]: "rw-eap"[1] 96.237.188.238 #2: sending notification INVALID_PAYLOAD_TYPE to 96.237.188.238:500
pluto[22027]: "rw-eap"[1] 96.237.188.238 #1: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_SA)
pluto[22027]: "rw-eap"[1] 96.237.188.238 #1: sending notification INVALID_PAYLOAD_TYPE to 96.237.188.238:500
pluto[22027]: "rw-eap"[1] 96.237.188.238 #2: ignoring informational payload, type INVALID_PAYLOAD_TYPE
pluto[22027]: "rw-eap"[1] 96.237.188.238 #1: ignoring informational payload, type INVALID_PAYLOAD_TYPE
pluto[22027]: "rw-eap"[1] 96.237.188.238 #3: message ignored because it contains an unexpected payload type (ISAKMP_NEXT_SA)
pluto[22027]: "rw-eap"[1] 96.237.188.238 #3: sending notification INVALID_PAYLOAD_TYPE to 96.237.188.238:500
pluto[22027]: "rw-eap"[1] 96.237.188.238 #3: ignoring informational payload, type INVALID_PAYLOAD_TYPE
share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.