IKEv2 StrongSwan to Cisco IOS 15.1 interop quirks: some 'attributes failed'
Hi,
Much to my pleasant surprise I was able to set up a RW connection to a Cisco IOS 15.1
headend using IKEv2. Kudos so the StrongSwan team!
The StrongSwan RW successfully connects with split tunneling (two subnets behind IOS). It obtains
a /32 address, and installs the xfrm correctly. Everything works as expected. There are however
some messages about attribute failed. Just wondering what these 'failed' messages mean.
(StrongSwan is behind a NAT device)
certificate status is not available
reached self-signed root ca with a path length of 0
authentication of 'XXXX' with RSA signature successful
IKE_SA roadw2[1] established between 192.168.2.139[XXXX]...1.2.3.4[YYYY]
scheduling reauthentication in 10105s
maximum IKE_SA lifetime 10645s
handling INTERNAL_IP4_NETMASK attribute failed
handling INTERNAL_IP4_SUBNET attribute failed
handling INTERNAL_IP4_SUBNET attribute failed
installing new virtual IP 192.168.87.35
conn roadw2
left=%defaultroute
leftsourceip=%config
leftcert=mycert.crt
right=1.2.3.4
rightsubnet=192.168.10.0/24,192.168.11.0/24
rightid="CN=IOS15"
rightca="CN=IOS-CA"
ike=aes256-sha1-modp1536
esp=aes256-sha1
auto=add
authby=pubkey
keyexchange=ikev2
While this is not an IOS list, I noticed that IOS installs an
"all IP traffic to 192.168.87.35/32" selector, instead of narrowing its selectors to match StrongSwan's rightsubnets. So just incase there are some inter-op experts here
protected vrf: (none)
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (192.168.87.35/255.255.255.255/0/0)
current_peer 1.2.3.4 port 4500
PERMIT, flags={}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 1.2.3.5, remote crypto endpt.: 1.2.3.4
path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/2
current outbound spi: 0xCAF25434(3404878900)
PFS (Y/N): N, DH group: none
(I am by no means an IOS 15.1 expert and it took some time to figure this out).
This split tunnel networks are specified by an acl.
Extended IP access list acl.ROADW
10 permit ip 192.168.10.0 0.255.255.255 any
20 permit ip 192.168.11.0 0.0.0.255 any
crypto ikev2 name-mangler MANGLER
dn organization-unit
crypto ikev2 authorization policy ROADW
pool pool.ROADW
netmask 255.255.255.0
subnet-acl 199
crypto ikev2 proposal AES256
encryption aes-cbc-256
integrity sha1
group 5
crypto ikev2 policy ROADW
proposal AES256
crypto ikev2 profile ROADW
match certificate CERTMAP
identity local dn
authentication local rsa-sig
authentication remote rsa-sig
pki trustpoint MYCA
aaa authorization group MYLOCAL name-mangler MANGLER
<div><p>Hi,<br><br>Much to my pleasant surprise I was able to set up a RW connection to a Cisco IOS 15.1<br>headend using IKEv2. Kudos so the StrongSwan team! <br><br><br>The StrongSwan RW successfully connects with split tunneling (two subnets behind IOS). It obtains<br> a /32 address, and installs the xfrm correctly. Everything works as expected. There are however<br>some messages about attribute failed. Just wondering what these 'failed' messages mean.<br><br><br>(StrongSwan is behind a NAT device)<br> certificate status is not available<br> reached self-signed root ca with a path length of 0<br>authentication of 'XXXX' with RSA signature successful<br>IKE_SA roadw2[1] established between 192.168.2.139[XXXX]...1.2.3.4[YYYY]<br> scheduling reauthentication in 10105s<br>maximum IKE_SA lifetime 10645s<br>handling INTERNAL_IP4_NETMASK attribute failed<br>handling INTERNAL_IP4_SUBNET attribute failed<br>handling INTERNAL_IP4_SUBNET attribute failed<br> installing new virtual IP 192.168.87.35<br><br><br>conn roadw2<br> left=%defaultroute<br> leftsourceip=%config<br> leftcert=mycert.crt<br> right=1.2.3.4<br> rightsubnet=<a href="http://192.168.10.0/24,192.168.11.0/24">192.168.10.0/24,192.168.11.0/24</a><br> rightid="CN=IOS15"<br> rightca="CN=IOS-CA"<br> ike=aes256-sha1-modp1536<br> esp=aes256-sha1<br> auto=add<br> authby=pubkey<br> keyexchange=ikev2<br><br>While this is not an IOS list, I noticed that IOS installs an<br> "all IP traffic to <a href="http://192.168.87.35/32">192.168.87.35/32</a>" selector, instead of narrowing its selectors to match StrongSwan's rightsubnets. So just incase there are some inter-op experts here<br><br> protected vrf: (none)<br> local ident (addr/mask/prot/port): (<a href="http://0.0.0.0/0.0.0.0/0/0">0.0.0.0/0.0.0.0/0/0</a>)<br> remote ident (addr/mask/prot/port): (<a href="http://192.168.87.35/255.255.255.255/0/0">192.168.87.35/255.255.255.255/0/0</a>)<br> current_peer 1.2.3.4 port 4500<br> PERMIT, flags={}<br> #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0<br> #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0<br> #pkts compressed: 0, #pkts decompressed: 0<br> #pkts not compressed: 0, #pkts compr. failed: 0<br> #pkts not decompressed: 0, #pkts decompress failed: 0<br> #send errors 0, #recv errors 0<br><br> local crypto endpt.: 1.2.3.5, remote crypto endpt.: 1.2.3.4<br> path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/2<br> current outbound spi: 0xCAF25434(3404878900)<br> PFS (Y/N): N, DH group: none<br><br>(I am by no means an IOS 15.1 expert and it took some time to figure this out).<br> This split tunnel networks are specified by an acl.<br><br><br>Extended IP access list acl.ROADW<br> 10 permit ip 192.168.10.0 0.255.255.255 any<br> 20 permit ip 192.168.11.0 0.0.0.255 any<br><br><br>crypto ikev2 name-mangler MANGLER<br> dn organization-unit<br>crypto ikev2 authorization policy ROADW<br> pool pool.ROADW<br> netmask 255.255.255.0<br> subnet-acl 199<br>crypto ikev2 proposal AES256 <br> encryption aes-cbc-256<br> integrity sha1<br> group 5<br> crypto ikev2 policy ROADW <br> proposal AES256<br>crypto ikev2 profile ROADW<br> match certificate CERTMAP<br> identity local dn <br> authentication local rsa-sig<br> authentication remote rsa-sig<br> pki trustpoint MYCA<br> aaa authorization group MYLOCAL name-mangler MANGLER<br><br><br><br><br><br></p></div>
RSS Feed