0

pfSense in version 2.2 switched from Racoon to strongSwan.

Since that change, users can no longer connect to the VPN from Android clients (Type IPSec Xauth PSK).


The current configuration on Android is as follows:

|_. Name                       | _[irrelevant]_  |
|_. Type                       | IPSec Auth PSK  |
|_. Server address             | $THE_PFSENSE_IP |
|_. IPSec identifier           | the.identifier  |
|_. IPSec pre-shared key       | 3yZuE7kLFGqOj79hRAqM3vQpPWC7DRlY6ep8hfoVtkZWVqNd8C3W |
|_. DNS search domains         | _[(not used}]_  |
|_. DNS servers                | _[(not used}]_  |
|_. Forwarding routes          | _$LOCAL_IP/32_  |

The current configuration on pfSense is as follows:

  • IPSec > Tunnels = Enable IPSec

Phase 1: Mobile Client

General information

|_. Disabled              | _[unset]_        |
|_. Key Exchange version  | _V1_             |
|_. Internet Protocol     | _IPv4_           |
|_. Interface             | WAN              |
|_. Description           | _[irrelevant]_   |

Phase 1 proposal (Authentication)

|_. Authentication method | _Mutual PSK + Xauth_ |
|_. Negotiation mode      | _Aggressive_         |
|_. My identifier         | _My IP address       |
|_. Peer identifier       | _Distinguished name_ _the.identifier_ |
|_. Pre-Shared Key        | 3yZuE7kLFGqOj79hRAqM3vQpPWC7DRlY6ep8hfoVtkZWVqNd8C3W |

Phase 1 proposal (Algorithms)

|_. Encryption algorithm  | _AES_ _256 bits_ |
|_. Hash algorithm        | _SHA1_           |
|_. DH key group          | _2 (1024 bit)_   |
|_. Lifetime              | _28800_ seconds  |

Advanced Options

|_. Disable Rekey         | _[unset]_        |
|_. Responder Only        | _[unset]_        |
|_. NAT Traversal         | _Auto_           |
|_. Dead Peer Detection   | _[enabled]_ _10_ seconds, _5_ retries |

Phase 2: Mobile Client

|_. Disabled              | _[unset]_        |
|_. Mode                  | _Tunnel IPv4_    |
|_. Local Network         | *Type:* _Address_ *Address:* _$LOCAL_IP_ *NAT:* _[none/empty]_ |
|_. Description           | _[irrelevant]_   |

Phase 2 proposal (SA/Key Exchange)

|_. Protocol              | _ESP_               |
|_. Encryption algorithms | _AES_ _auto_ *only* |
|_. Hash algorithms       | _SHA1_ *only*       |
|_. PFS key group         | _off_               |
|_. Lifetime              | _3600_ _seconds_    |

Advanced Options

|_. Automatically ping host | _[empty]_         |

Log Output on pfSense

IPSec Log (startup)

 
Mar 23 02:10:43  ipsec_starter[88815]: Starting weakSwan 5.2.1 IPsec [starter]...
Mar 23 02:10:43  ipsec_starter[88815]: no netkey IPsec stack detected
Mar 23 02:10:43  ipsec_starter[88815]: no KLIPS IPsec stack detected
Mar 23 02:10:43  ipsec_starter[88815]: no known IPsec stack detected, ignoring!
Mar 23 02:10:43  charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.2.1, FreeBSD 10.1-RELEASE-p6, i386)
Mar 23 02:10:44  charon: 00[KNL] unable to set UDP_ENCAP: Invalid argument
Mar 23 02:10:44  charon: 00[NET] enabling UDP decapsulation for IPv6 on port 4500 failed
Mar 23 02:10:44  charon: 00[CFG] ipseckey plugin is disabled
Mar 23 02:10:44  charon: 00[CFG] loading ca certificates from '/var/etc/ipsec/ipsec.d/cacerts'
Mar 23 02:10:44  charon: 00[CFG] loaded ca certificate "$CERT1_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/a85fc367.0.crt'
Mar 23 02:10:44  charon: 00[CFG] loaded ca certificate "$CERT2_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/5eb84096.0.crt'
Mar 23 02:10:44  charon: 00[CFG] loaded ca certificate "$CERT3_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/16eb0859.0.crt'
Mar 23 02:10:44  charon: 00[CFG] loaded ca certificate "$CERT4_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/e06d03ef.0.crt'
Mar 23 02:10:44  charon: 00[CFG] loaded ca certificate "$CERT5_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/01c1b386.0.crt'
Mar 23 02:10:44  charon: 00[CFG] loading aa certificates from '/var/etc/ipsec/ipsec.d/aacerts'
Mar 23 02:10:44  charon: 00[CFG] loading ocsp signer certificates from '/var/etc/ipsec/ipsec.d/ocspcerts'
Mar 23 02:10:44  charon: 00[CFG] loading attribute certificates from '/var/etc/ipsec/ipsec.d/acerts'
Mar 23 02:10:44  charon: 00[CFG] loading crls from '/var/etc/ipsec/ipsec.d/crls'
Mar 23 02:10:44  charon: 00[CFG] loading secrets from '/var/etc/ipsec/ipsec.secrets'
Mar 23 02:10:44  charon: 00[CFG] loaded IKE secret for $PFSENSE_IP the.identifier
Mar 23 02:10:44  charon: 00[CFG] loaded IKE secret for %any the.identifier
Mar 23 02:10:44  charon: 00[CFG] opening triplet file /var/etc/ipsec/ipsec.d/triplets.dat failed: No such file or directory
Mar 23 02:10:44  charon: 00[CFG] loaded 0 RADIUS server configurations
Mar 23 02:10:44  charon: 00[LIB] loaded plugins: charon unbound aes des blowfish rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey ipseckey pem openssl fips-prf gmp xcbc cmac hmac curl attr kernel-pfkey kernel-pfroute resolve socket-default stroke smp updown eap-identity eap-sim eap-aka eap-aka-3gpp2 eap-md5 eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap whitelist addrblock unity
Mar 23 02:10:44  charon: 00[LIB] unable to load 6 plugin features (5 due to unmet dependencies)
Mar 23 02:10:44  charon: 00[JOB] spawning 16 worker threads
Mar 23 02:10:44  ipsec_starter[89411]: charon (89559) started after 600 ms
Mar 23 02:10:44  charon: 06[CFG] received stroke: add connection 'con1'
Mar 23 02:10:44  charon: 06[CFG] adding virtual IP address pool 192.168.97.0/24
Mar 23 02:10:44  charon: 06[CFG] added configuration 'con1'
Mar 23 02:11:02  charon: 06[CFG] rereading secrets
Mar 23 02:11:02  charon: 06[CFG] loading secrets from '/var/etc/ipsec/ipsec.secrets'
Mar 23 02:11:02  charon: 06[CFG] loaded IKE secret for $PFSENSE_IP the.identifier
Mar 23 02:11:02  charon: 06[CFG] loaded IKE secret for %any the.identifier
Mar 23 02:11:02  charon: 06[CFG] rereading ca certificates from '/var/etc/ipsec/ipsec.d/cacerts'
Mar 23 02:11:02  charon: 06[CFG] loaded ca certificate "$CERT1_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/a85fc367.0.crt'
Mar 23 02:11:02  charon: 06[CFG] loaded ca certificate "$CERT2_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/5eb84096.0.crt'
Mar 23 02:11:02  charon: 06[CFG] loaded ca certificate "$CERT3_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/16eb0859.0.crt'
Mar 23 02:11:02  charon: 06[CFG] loaded ca certificate "$CERT4_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/e06d03ef.0.crt'
Mar 23 02:11:02  charon: 06[CFG] loaded ca certificate "$CERT5_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/01c1b386.0.crt'
Mar 23 02:11:02  charon: 06[CFG] rereading ocsp signer certificates from '/var/etc/ipsec/ipsec.d/ocspcerts'
Mar 23 02:11:02  charon: 06[CFG] rereading aa certificates from '/var/etc/ipsec/ipsec.d/aacerts'
Mar 23 02:11:02  charon: 06[CFG] rereading attribute certificates from '/var/etc/ipsec/ipsec.d/acerts'
Mar 23 02:11:02  charon: 06[CFG] rereading crls from '/var/etc/ipsec/ipsec.d/crls'

IPSec Log (connection)

Mar 23 02:13:50  charon: 14[ENC] parsed AGGRESSIVE request 0 [ SA KE No ID V V V V V V V V ]
Mar 23 02:13:50  charon: 14[IKE]  received FRAGMENTATION vendor ID
Mar 23 02:13:50  charon: 14[IKE] received FRAGMENTATION vendor ID
Mar 23 02:13:50  charon: 14[IKE]  received NAT-T (RFC 3947) vendor ID
Mar 23 02:13:50  charon: 14[IKE] received NAT-T (RFC 3947) vendor ID
Mar 23 02:13:50  charon: 14[IKE]  received draft-ietf-ipsec-nat-t-ike-02 vendor ID
Mar 23 02:13:50  charon: 14[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID
Mar 23 02:13:50  charon: 14[IKE]  received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Mar 23 02:13:50  charon: 14[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Mar 23 02:13:50  charon: 14[IKE]  received draft-ietf-ipsec-nat-t-ike-00 vendor ID
Mar 23 02:13:50  charon: 14[IKE] received draft-ietf-ipsec-nat-t-ike-00 vendor ID
Mar 23 02:13:50  charon: 14[IKE]  received XAuth vendor ID
Mar 23 02:13:50  charon: 14[IKE] received XAuth vendor ID
Mar 23 02:13:50  charon: 14[IKE]  received Cisco Unity vendor ID
Mar 23 02:13:50  charon: 14[IKE] received Cisco Unity vendor ID
Mar 23 02:13:50  charon: 14[IKE]  received DPD vendor ID
Mar 23 02:13:50  charon: 14[IKE] received DPD vendor ID
Mar 23 02:13:50  charon: 14[IKE]  $REMOTE_IP is initiating a Aggressive Mode IKE_SA
Mar 23 02:13:50  charon: 14[IKE] $REMOTE_IP is initiating a Aggressive Mode IKE_SA
Mar 23 02:13:50  charon: 14[CFG] looking for XAuthInitPSK peer configs matching $PFSENSE_IP...$REMOTE_IP[the.identifier]
Mar 23 02:13:50  charon: 14[CFG] selected peer config "con1"
Mar 23 02:13:50  charon: 14[ENC] generating AGGRESSIVE response 0 [ SA KE No ID NAT-D NAT-D HASH V V V V V ]
Mar 23 02:13:50  charon: 14[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:13:52  charon: 14[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:13:52  charon: 14[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:13:52  charon: 14[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:13:52  charon: 14[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:13:54  charon: 14[IKE]  sending retransmit 1 of response message ID 0, seq 1
Mar 23 02:13:54  charon: 14[IKE] sending retransmit 1 of response message ID 0, seq 1
Mar 23 02:13:54  charon: 14[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:13:55  charon: 14[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:13:55  charon: 14[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:13:55  charon: 14[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:13:55  charon: 14[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:13:59  charon: 14[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:13:59  charon: 14[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:13:59  charon: 14[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:13:59  charon: 14[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:01  charon: 14[IKE]  sending retransmit 2 of response message ID 0, seq 1
Mar 23 02:14:01  charon: 14[IKE] sending retransmit 2 of response message ID 0, seq 1
Mar 23 02:14:01  charon: 14[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:01  charon: 14[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:14:01  charon: 14[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:01  charon: 14[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:01  charon: 14[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:05  charon: 16[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:14:05  charon: 16[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:05  charon: 16[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:05  charon: 16[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:07  charon: 16[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:14:07  charon: 16[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:07  charon: 16[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:07  charon: 16[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:11  charon: 16[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:14:11  charon: 16[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:11  charon: 16[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:11  charon: 16[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:13  charon: 16[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:14:13  charon: 16[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:13  charon: 16[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:13  charon: 16[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:14  charon: 16[IKE]  sending retransmit 3 of response message ID 0, seq 1
Mar 23 02:14:14  charon: 16[IKE] sending retransmit 3 of response message ID 0, seq 1
Mar 23 02:14:14  charon: 16[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:16  charon: 16[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:14:16  charon: 16[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:16  charon: 16[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:16  charon: 16[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:20  charon: 16[JOB] deleting half open IKE_SA after timeout

What could be the reasons for the connection to fail and how may they be resolved?

  • I just corrected the mentioned shortcomings. – user569825 Mar 23 '15 at 1:45
  • I've got the same exactly issue and can't find a way to solve this. – Vinícius Ferrão Apr 9 '15 at 4:44
1

I've been having this exact same issue.

As per this [IKEv1 can't connect from Android's default vpn client], there is a bug in the current Android VPN IKEv1 client that happens if aggressive mode is selected and a "IPsec identifier" is used to configure the Android client.

The solution is to clear the "IPsec identifier" entry from the android client and in Phase 1 proposal the negotiation mode should be Main.

In my setup the Phase 1 proposal (Authentication) : Authentication method is Mutual PSK + Xauth and not just Mutual PSK.

  • Ah yes, mine says Mutual PSK + Xauth as well. I had it changed briefly for testing purpose, so I updated the question accordingly now. Implementing your suggestion I now get charon: 07[ENC] invalid ID_V1 payload length, decryption failed? What did you set as Peer identifier on the pfSense side? – user569825 Mar 23 '15 at 21:11
  • That is the root problem. It's only an issue with aggressive mode + PSK. Changing to RSA instead of PSK is the best solution. – Chris Buechler Mar 24 '15 at 1:48
  • I'll try that. Luis, how did you manage to configure Android to Main mode? – user569825 Mar 26 '15 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.