Home / server / Questions / 1062302
In Process
StanleyHui
Asked: 2021-05-03 07:17:01 +0800 CST

How to config IPSEC XAUTH PSK in StrongSwan without using CA file?

  • 772

Iam using strongSwan 5.6.2 on Ubuntu18. I can use Strongswan client on Android to connect it , also it works with win7 IKEV2.

However I am in China so that it is imposible to access Google Play at first time to install the Strongswan client. so that I have to config server to use L2TP/IPSEC XAUTH PSK mode without CA file.

here is ipsec.conf

config setup
    charondebug="all"
    uniqueids=no 
conn android_xauth_psk
    type=transport
    keyexchange=ike
    aggressive = yes
    left=%defaultroute
    leftauth=psk
    leftsubnet=0.0.0.0/0
    leftprotoport=17/1701
    right=%any
    authby=psk
    #xauth=server
    rightauth=psk
    #rightauth2=xauth
    #rightauth=pubkey
    #rightauth2=xauth
    rightsourceip=10.10.10.0/24
    rightdns=8.8.8.8,8.8.4.4
    #ike = 3des-md5-modp1024!
    #esp = 3des-md5-modp1024!
    auto=add

and in strongswan.conf

load_modular = yes
load = aes des sha1 sha2 md4 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc stroke 

kernel-netlink socket-default fips-prf eap-mschapv2 eap-identity updown

then, it is getting errors below:

May  2 23:11:12 ip-172-31-31-249 charon-custom: 12[IKE] 120.230.79.229 is initiating a Main Mode IKE_SA
May  2 23:11:12 ip-172-31-31-249 charon-custom: 12[CFG] received proposals: IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_1024, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:AES_CBC_128/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_1024, IKE:AES_CBC_128/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_128/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024
May  2 23:11:12 ip-172-31-31-249 charon-custom: 12[CFG] configured proposals: IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/AES_CTR_128/AES_CTR_192/AES_CTR_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/CAMELLIA_CTR_128/CAMELLIA_CTR_192/CAMELLIA_CTR_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/HMAC_SHA1_96/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/CURVE_25519/NTRU_128/NTRU_192/NTRU_256/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048, IKE:AES_CCM_16_128/AES_CCM_16_192/AES_CCM_16_256/AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/CAMELLIA_CCM_16_128/CAMELLIA_CCM_16_192/CAMELLIA_CCM_16_256/CHACHA20_POLY1305_256/AES_CCM_8_128/AES_CCM_8_192/AES_CCM_8_256/AES_CCM_12_128/AES_CCM_12_192/AES_CCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/CAMELLIA_CCM_8_128/CAMELLIA_CCM_8_192/CAMELLIA_CCM_8_256/CAMELLIA_CCM_12_128/CAMELLIA_CCM_12_192/CAMELLIA_CCM_12_256/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/CURVE_25519/NTRU_128/NTRU_192/NTRU_256/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048
May  2 23:11:12 ip-172-31-31-249 charon-custom: 12[IKE] no proposal found

If I add

ike=chacha20poly1305-sha512-curve25519-prfsha512,aes256gcm16-sha384-prfsha384-ecp384,aes256-sha1-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024

in ipsec.conf,error changed to

May  2 23:46:05 ip-172-31-31-249 charon-custom: 13[CFG] looking for XAuthInitPSK peer configs matching 172.31.31.249...183.37.131.20[10.3.130.208]
May  2 23:46:05 ip-172-31-31-249 charon-custom: 13[IKE] found 1 matching config, but none allows XAuthInitPSK authentication using Main Mode
May  2 23:46:05 ip-172-31-31-249 charon-custom: 13[ENC] generating INFORMATIONAL_V1 request 1053446643 [ HASH N(AUTH_FAILED) ]

I have no idea next. any help? Thanks a lot!

strongswan xauth

0 Answers