<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.5pt">Hi ,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt">Trying to UP host-host tunnel using libreswan
<b>(Linux Libreswan 3.20 (netkey) on 3.10.0-514.26.2.el7.x86_64 </b>) over CENTOS using Certificates as authentication mechanism . Before this able to test “preshared key”, “unauthenticated OE” and both of them works fine.
<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.5pt">With Certificates ., pluto was throwing following error : -
<o:p></o:p></span></p>
<p class="MsoNormal">#########################################<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt">“002 "test" #2: initiating v2 parent SA<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">133 "test" #2: STATE_PARENT_I1: initiate<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">133 "test" #2: STATE_PARENT_I1: sent v2I1, expected v2R1<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:red">003 "test" #2: Failed to find our RSA key”<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:black">################################################</span></b><b><span style="font-size:10.0pt;color:red">
<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:red"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Can see that RSA key was there in NSS DB (“certutil –K –d sql:/etc/ipsec.d/”)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><u><span style="font-size:10.5pt;color:black">Steps followed :
<o:p></o:p></span></u></b></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">1] Generated self-signed certificates on both the hosts .<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">2] Exported the certs and ensured importing of the peer’s cert was working fine (“cert –L –d sql:/etc/ipsec.d”)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">3] PFA /etc/ipsec.conf
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">4] Started the ipsec , added the connection (“ipsec auto –-add <conn>”) & tried it to bring it UP (“ipsec auto -–up <conn>”)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">As per the documentation of libreswan , it looks pluto should be referring to nss db for Private Keys , Certs . Looks we were missing some configuration here.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Please let me know the needed configuration .<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Thanks a lot . <o:p>
</o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">-Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Kesav. <o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="0" style="width:407.25pt">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="0" style="width:407.25pt">
<tbody>
<tr>
<td colspan="3" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><img width="110" height="73" id="Picture_x0020_1" src="cid:image001.png@01D369D5.09EDB440" alt="http://www.cisco.com/c/dam/assets/email-signature-tool/logo_05.png?ct=1449478134969"><o:p></o:p></span></p>
</td>
</tr>
<tr>
<td nowrap="" valign="top" style="padding:0in 0in 0in .25in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:#666666">Kesava Vunnava</span></b><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:#666666"><br>
ENGINEER.SOFTWARE ENGINEERING<br>
<br>
<a href="mailto:kesriniv@cisco.com"><span style="color:#666666;text-decoration:none">kesriniv@cisco.com</span></a><br>
Mobile: <b>7893426891</b><o:p></o:p></span></p>
</td>
<td width="50%" valign="top" style="width:50.0%;padding:11.25pt 0in 7.5pt 15.0pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:#666666"><br>
<a href="http://www.cisco.com/"><span style="color:#666666;text-decoration:none">Cisco.com</span></a><o:p></o:p></span></p>
</td>
<td style="padding:0in 0in 0in 0in"></td>
</tr>
<tr>
<td colspan="3" style="padding:0in 0in 0in 0in"></td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;display:none"><o:p> </o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="0" style="width:300.0pt">
<tbody>
<tr>
<td style="padding:3.75pt 15.0pt 0in .25in">
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#009900"><img border="0" width="18" height="19" id="Picture_x0020_2" src="cid:image002.gif@01D369D5.09EDB440" alt="http://www.cisco.com/assets/swa/img/thinkbeforeyouprint.gif">Think
before you print.<o:p></o:p></span></p>
</td>
</tr>
<tr>
<td style="padding:5.25pt 15.0pt 4.5pt .25in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#999999">This email may contain confidential and privileged material for the sole use of the intended recipient.
Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#999999">Please
<a href="http://www.cisco.com/web/about/doing_business/legal/cri/index.html" title="Legal Information">
<span style="color:#0E58A0">click here</span></a> for Company Registration Information.<o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><br clear="all">
</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>