1

I'm trying to configure strongswan 5.7.1 for Android strongswan "IKEv2 Certificate" connection. I'm using a self signed user certificate and a godaddy wildcard server certificate. I am unable to connect and in the log I see "local id match: 0 and "no matching peer config found"

ipsec.conf:

conn android
       fragmentation=yes
       keyexchange=ikev2
       left=%defaultroute
       leftsubnet=0.0.0.0/0
       leftfirewall=yes
       leftcert=serverCert.pem
       leftsendcert=always
       right=%any
       rightauth=pubkey
       rightsubnet=10.1.0.0/16
       rightsourceip=10.1.0.0/16
       auto=add

ipsec statusall output:

Virtual IP pools (size/online/offline):
  10.0.0.0/16: 65534/0/0
  10.1.0.0/16: 65534/0/0
Listening IP addresses:
  172.30.3.123
Connections:
         ios:  %any...%any  IKEv1
         ios:   local:  [OU=Domain Control Validated, CN=*.vpntest.com] uses public key authentication
         ios:    cert:  "OU=Domain Control Validated, CN=*.vpntest.com"
         ios:   remote: uses public key authentication
         ios:   remote: uses XAuth authentication: any
         ios:   child:  0.0.0.0/0 === 10.0.0.0/16 TUNNEL
     android:  %any...%any  IKEv2
     android:   local:  [OU=Domain Control Validated, CN=*.vpntest.com] uses public key authentication
     android:    cert:  "OU=Domain Control Validated, CN=*.vpntest.com"
     android:   remote: uses public key authentication
     android:   child:  0.0.0.0/0 === 10.1.0.0/16 TUNNEL
Security Associations (0 up, 0 connecting):

/var/log/syslog:

Dec 10 21:25:11 vpn-server charon: 07[CFG]   rightauth=pubkey
Dec 10 21:25:11 vpn-server charon: 07[CFG]   dpddelay=30
Dec 10 21:25:11 vpn-server charon: 07[CFG]   dpdtimeout=150
Dec 10 21:25:11 vpn-server charon: 07[CFG]   sha256_96=no
Dec 10 21:25:11 vpn-server charon: 07[CFG]   mediation=no
Dec 10 21:25:11 vpn-server charon: 07[CFG]   keyexchange=ikev2
Dec 10 21:25:11 vpn-server charon: 07[CFG] adding virtual IP address pool 10.1.0.0/16
Dec 10 21:25:11 vpn-server charon: 07[CFG]   loaded certificate "OU=Domain Control Validated, CN=*.vpntest.com" from 'serverCert.pem'
Dec 10 21:25:11 vpn-server charon: 07[CFG]   id '%any' not confirmed by certificate, defaulting to 'OU=Domain Control Validated, CN=*.vpntest.com'
Dec 10 21:25:11 vpn-server charon: 07[CFG] added configuration 'android'
Dec 10 21:27:26 vpn-server charon: 09[CFG] looking for an IKEv2 config for 172.30.3.123...181.171.184.17
Dec 10 21:27:26 vpn-server charon: 09[CFG] ike config match: 0 (%any...%any IKEv1)
Dec 10 21:27:26 vpn-server charon: 09[CFG] ike config match: 28 (%any...%any IKEv2)
Dec 10 21:27:26 vpn-server charon: 09[CFG]   candidate: %any...%any, prio 28
Dec 10 21:27:26 vpn-server charon: 09[CFG] found matching ike config: %any...%any with prio 28
Dec 10 21:27:26 vpn-server charon: 09[IKE] 181.171.184.17 is initiating an IKE_SA
Dec 10 21:27:26 vpn-server charon: 09[IKE] IKE_SA (unnamed)[1] state change: CREATED => CONNECTING
Dec 10 21:27:26 vpn-server charon: 09[CFG] selecting proposal:
Dec 10 21:27:26 vpn-server charon: 09[CFG]   proposal matches
Dec 10 21:27:26 vpn-server charon: 09[CFG] received proposals: IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/HMAC_SHA1_96/AES_XCBC_96/P
RF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/MODP_3072/MODP_4096/MODP_6144/MODP_819
2/MODP_2048, IKE:AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/CHACHA20_POLY1305/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/PRF_HMAC_SHA2_256/PRF_H
MAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048
Dec 10 21:27:26 vpn-server charon: 09[CFG] configured proposals: IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/
HMAC_SHA1_96/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/CURVE_25519/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048
Dec 10 21:27:26 vpn-server charon: 09[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_AES128_XCBC/CURVE_25519
Dec 10 21:27:26 vpn-server charon: 09[CFG] received supported signature hash algorithms: sha256 sha384 sha512 identity
Dec 10 21:27:26 vpn-server charon: 09[IKE] local host is behind NAT, sending keep alives
Dec 10 21:27:26 vpn-server charon: 09[IKE] remote host is behind NAT
Dec 10 21:27:26 vpn-server charon: 09[IKE] DH group ECP_256 unacceptable, requesting CURVE_25519
Dec 10 21:27:26 vpn-server charon: 09[IKE] IKE_SA (unnamed)[1] state change: CONNECTING => DESTROYING
Dec 10 21:27:26 vpn-server charon: 10[CFG] looking for an IKEv2 config for 172.30.3.123...181.171.184.17
Dec 10 21:27:26 vpn-server charon: 10[CFG] ike config match: 0 (%any...%any IKEv1)
Dec 10 21:27:26 vpn-server charon: 10[CFG] ike config match: 28 (%any...%any IKEv2)
Dec 10 21:27:26 vpn-server charon: 10[CFG]   candidate: %any...%any, prio 28
Dec 10 21:27:26 vpn-server charon: 10[IKE] 181.171.184.17 is initiating an IKE_SA
Dec 10 21:27:26 vpn-server charon: 10[IKE] IKE_SA (unnamed)[2] state change: CREATED => CONNECTING
Dec 10 21:27:26 vpn-server charon: 10[CFG] selecting proposal:
Dec 10 21:27:26 vpn-server charon: 10[CFG]   proposal matches
Dec 10 21:27:26 vpn-server charon: 10[CFG] received proposals: IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/HMAC_SHA1_96/AES_XCBC_96/P
RF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_HMAC_SHA1/CURVE_25519/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_6144/MODP_819
2/MODP_2048, IKE:AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/CHACHA20_POLY1305/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/PRF_HMAC_SHA2_256/PRF_H
MAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_HMAC_SHA1/CURVE_25519/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048
Dec 10 21:27:26 vpn-server charon: 10[CFG] configured proposals: IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/
HMAC_SHA1_96/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/CURVE_25519/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048
Dec 10 21:27:26 vpn-server charon: 10[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_AES128_XCBC/CURVE_25519
Dec 10 21:27:26 vpn-server charon: 10[CFG] received supported signature hash algorithms: sha256 sha384 sha512 identity
Dec 10 21:27:26 vpn-server charon: 10[IKE] local host is behind NAT, sending keep alives
Dec 10 21:27:26 vpn-server charon: 10[IKE] remote host is behind NAT
Dec 10 21:27:26 vpn-server charon: 10[CFG] sending supported signature hash algorithms: sha256 sha384 sha512 identity
Dec 10 21:27:26 vpn-server charon: 10[IKE] sending cert request for "C=CN, O=strongSwan, CN=strongSwan CA"
Dec 10 21:27:26 vpn-server charon: 10[IKE] sending cert request for "C=CN, O=VpnTest, CN=VpnTest CA"
Dec 10 21:27:26 vpn-server charon: 10[IKE] sending cert request for "C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certs.godaddy.com/repository/, CN=Go Daddy Secure Certifica$
e Authority - G2"
Dec 10 21:27:26 vpn-server charon: 10[IKE] sending cert request for "C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certificates.godaddy.com/repository, CN=Go Daddy Secure Cer$
ification Authority, SN=07969287"
Dec 10 21:27:26 vpn-server charon: 11[IKE] received cert request for "C=CN, O=VpnTest, CN=VpnTest CA"
Dec 10 21:27:26 vpn-server charon: 11[IKE] received cert request for "C=CN, O=VpnTest, CN=VpnTest CA"
Dec 10 21:27:26 vpn-server charon: 11[IKE] received end entity cert "CN=user1, O=VpnTest"
Dec 10 21:27:26 vpn-server charon: 11[CFG] looking for peer configs matching 172.30.3.123["OU=Domain Control Validated, CN=*.vpntest.com"]...181.171.184.17[CN=user1, O=VpnTest]
Dec 10 21:27:26 vpn-server charon: 11[CFG] peer config "ios", ike match: 0 (%any...%any IKEv1)
Dec 10 21:27:26 vpn-server charon: 11[CFG] peer config "android", ike match: 28 (%any...%any IKEv2)
Dec 10 21:27:26 vpn-server charon: 11[CFG]   local id match: 0 (ID_KEY_ID: 22:4f:55:3d:44:6f:6d:61:69:6e:20:43:6f:6e:74:72:6f:6c:20:56:61:6c:69:64:61:74:65:64:2c:20:43:4e:3d:2a:2e:70:75:72:65$
73:69:67:68:74:2e:63:6f:6d:22)
Dec 10 21:27:26 vpn-server charon: 11[CFG] no matching peer config found
Dec 10 21:27:26 vpn-server charon: 11[IKE] processing INTERNAL_IP4_ADDRESS attribute
Dec 10 21:27:26 vpn-server charon: 11[IKE] processing INTERNAL_IP6_ADDRESS attribute
Dec 10 21:27:26 vpn-server charon: 11[IKE] processing INTERNAL_IP4_DNS attribute
Dec 10 21:27:26 vpn-server charon: 11[IKE] processing INTERNAL_IP6_DNS attribute
Dec 10 21:27:26 vpn-server charon: 11[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Dec 10 21:27:26 vpn-server charon: 11[IKE] peer supports MOBIKE
Dec 10 21:27:26 vpn-server charon: 11[IKE] IKE_SA (unnamed)[2] state change: CONNECTING => DESTROYING
2
  • The remote identity sent by the client is wrong (it includes quote characters and is sent as ID_KEY_ID and not as ASN.1 DN). What exactly did you configure on the client as server identity?
    – ecdsa
    Dec 11, 2018 at 9:34
  • The quotes in the server identity on the client were indeed the problem. Once removing them I am able to connect. Thanks! Dec 12, 2018 at 1:56

1 Answer 1

0

I configured the server identity on the Android client with quotes. After removing the quotes I am able to connect

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.