0

I'm required to configure an ipsec tunnel to communicate with a remote vpn (Cisco ASA 5555). I have created an Amazon Lightsail instance with ubuntu 18.04 installed. Upon doing some studying i came across Strongswan which I've used to configure the tunnel. The remote side provided a list of parameters I should use to configure my tunnel, I've listed them below and my settings found in ipsec.conf file. My problem is, whenever i initiate traffic to the remote side the traffic originates from my private ip (aa.aa.aa.aa) instead of my public ip AA.AA.AA.AA - since the remote side refused to use my private ip as encryption domain (something to do with it has been used in their local network) they had to allow my public ip. How can i configure strongswan such that the remote side sees traffic originating from my public ip (that way we'll have a successful tunnel connection).

Local site A:

  • Public IP: AA.AA.AA.AA
  • Private IP: aa.aa.aa.aa
  • Subnet: aa.aa.aa.aa.aa/20

Remote site B:

  • Public IP: BB.BB.BB.BB
  • Private IP: bb.bb.bb.bb
  • Subnet: bb.bb.bb.bb/32

Conf Parameters:

Phase 1

  • Authentication method: Pre-Shared Key
  • Encryption Scheme: IKE
  • DH: Group 2
  • Encryption Algorithm: ESP-AES-256
  • Hashing Algorithm: SHA1
  • Main Mode
  • Lifetime (for negotiation): 86400s

Phase 2

  • Encapsulation: ESP
  • Encryption Algorithm: AES-256
  • Authentication Algorithm: SHA1
  • No PFS
  • Lifetime (for negotiation): 3600s
  • Key Exchange: Yes

Any help is appreciated!


ipsec.conf . charon log

  • For some reason the other peer is not responding (or the response does not reach the initiator). Check the logs on the remote end and make sure the configured IP address is correct and no firewall blocks UDP port 500 between the peers. – ecdsa Feb 25 at 8:51
  • For some reason my vpn gateway was blocked by the remote site. Allowing it still didn't solve the problem but i came to notice some very weird behaviour on the server. Strongswan service crashed a few seconds after it has been started. Later i solved the problem, gonna leave the answer below. And, thank you for your time to go over the question @ecdsa. – KareimQ Feb 26 at 20:51
0

I found out a few strongswan problems running on ubuntu 18.04. The service was crushing few seconds after being started, somehow ipsec was using my private IP instead of my public IP for tunnelling despite the fact I've public IP set in my configuration file.

So i went ahead and installed CentOS with openswan, and with the same configuration i was able to establish the tunnel.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.