<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><br></div><div>Yes, sir. That actually helps me understand and confirm a few things. My lab setup has two hosts. Each host is in a different network routed through a firewall with no NAT. They work perfectly creating SA and having no problems. But when ipsechost01 tries to talk to the AWS instances check out ipsechost01 to Thor(AWS). Which is AWS NAT with ipsechost behind a firewall, also NAT.<br><br></div><div>Feel free to give me example configs or anything else you want me to try this is all lab stuff and I have time so I can be your lab monkey.<br></div><div dir="ltr"><b><br></b></div><div><b> This is ipsechost01 and ejbca working in OE action</b><br></div><div dir="ltr">000 #1: "private#<a href="http://0.0.0.0/0">0.0.0.0/0</a>"[1] ...<a href="http://192.168.57.3:500">192.168.57.3:500</a> STATE_PARENT_R2 (received v2I2, PARENT SA established); EVENT_v2_SA_REPLACE_IF_USED_IKE in 3328s; newest ISAKMP; idle;<br>000 #2: "private#<a href="http://0.0.0.0/0">0.0.0.0/0</a>"[1] ...<a href="http://192.168.57.3:500">192.168.57.3:500</a> STATE_V2_IPSEC_R (IPsec SA established); EVENT_v2_SA_REPLACE_IF_USED in 28528s; newest IPSEC; eroute owner; isakmp#1; idle;<br>000 #2: "private#<a href="http://0.0.0.0/0">0.0.0.0/0</a>"[1] ...192.168.57.3 <a href="mailto:esp.84f01efa@192.168.57.3">esp.84f01efa@192.168.57.3</a> <a href="mailto:esp.67e30a4c@192.168.56.109">esp.67e30a4c@192.168.56.109</a> <a href="mailto:tun.0@192.168.57.3">tun.0@192.168.57.3</a> <a href="mailto:tun.0@192.168.56.109">tun.0@192.168.56.109</a> ref=0 refhim=0 Traffic: ESPin=84B ESPout=84B! ESPmax=0B <br>000 <br></div><div> logs from ejbca with ipsechost01 as source of connection</div><div>Oct 7 17:02:27.658858: | returning since no better match then original best_found<br>Oct 7 17:02:27.658864: | Peer ID matches and no better connection found - continuing with existing connection<br>Oct 7 17:02:27.658902: | checking keyid 'C=US, ST=CA, L=Palo Alto, O=mycompany, OU=Level5, CN=ipsechost1, E=<a href="mailto:admin@mycompany.com">admin@mycompany.com</a>' for match with 'C=US, ST=CA, L=Palo Alto, O=mycompany, OU=Level5, CN=ipsechost1, E=<a href="mailto:admin@mycompany.com">admin@mycompany.com</a>'<br>Oct 7 17:02:27.658972: "private#<a href="http://0.0.0.0/0">0.0.0.0/0</a>"[2] ...192.168.57.3 #3: Authenticated using RSA<br>Oct 7 17:02:27.659070: | private key for cert ejbca not found in local cache; loading from NSS DB<br>Oct 7 17:02:27.662565: | tsi[0] 0-65535: exact port match with 0. fitness 65536<br>Oct 7 17:02:27.662568: | tsr[0] 0-65535: exact port match with 0. fitness 65536<br>Oct 7 17:02:27.662571: | best ports fit so far: tsi[0] fitrange_i 65536, tsr[0] fitrange_r 65536, matchiness 131072<br>Oct 7 17:02:27.662575: | protocol 0 and tsi[0].ipprotoid 0: exact match<br>Oct 7 17:02:27.662578: | protocol 0 and tsr[0].ipprotoid 0: exact match<br>Oct 7 17:02:27.662580: | best protocol fit so far: tsi[0] fitrange_i 255, tsr[0] fitrange_r 255, matchiness 510<br>Oct 7 17:02:27.662608: | selecting default construvted local ESP/AH proposals for private#<a href="http://0.0.0.0/0">0.0.0.0/0</a> (IKE SA responder matching remote ESP/AH proposals)<br>Oct 7 17:02:27.662620: "private#<a href="http://0.0.0.0/0">0.0.0.0/0</a>"[2] ...192.168.57.3 #3: constructed local ESP/AH proposals for private#<a href="http://0.0.0.0/0">0.0.0.0/0</a> (IKE SA responder matching remote ESP/AH proposals): 1:ESP:ENCR=AES_GCM_C_256;INTEG=NONE;ESN=DISABLED 2:ESP:ENCR=AES_GCM_C_128;INTEG=NONE;ESN=DISABLED 3:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;ESN=DISABLED 4:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;ESN=DISABLED 5:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA1_96;ESN=DISABLED (default)<br>Oct 7 17:02:27.662624: | Comparing remote proposals against IKE SA responder matching remote ESP/AH proposals 5 local proposals<br>Oct 7 17:02:27.662632: | remote proposal 1 matches local proposal 1<br>Oct 7 17:02:27.662639: | remote proposal 2 does not match; unmatched remote transforms: ENCR+ESN<br>Oct 7 17:02:27.662645: | remote proposal 3 does not match; unmatched remote transforms: ENCR+INTEG+ESN<br>Oct 7 17:02:27.662651: | remote proposal 4 does not match; unmatched remote transforms: ENCR+INTEG+ESN<br>Oct 7 17:02:27.662657: | remote proposal 5 does not match; unmatched remote transforms: ENCR+INTEG+ESN<br></div><div dir="ltr"> <br>---------------------------------------------------------------------------------------------------------<br><b>Here's ipsechost01 tries to talk to Thor(AWS instance) </b><br><br>Oct 7 16:42:43.277322: | v2 state object #3 found, in STATE_PARENT_I1<br>Oct 7 16:42:43.277332: | found state #3<br>Oct 7 16:42:43.279975: | next payload type: setting 'IKEv2 Certificate Request Payload'.'next payload type' to IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH)<br>Oct 7 16:42:43.279978: | *****emit IKEv2 Authentication Payload:<br>Oct 7 16:42:43.279988: | next payload type: saving payload location 'IKEv2 Authentication Payload'.'next payload type'<br>Oct 7 16:42:43.283436: | emitting 256 raw bytes of rsa signature into IKEv2 Authentication Payload<br>Oct 7 16:42:43.283492: | emitting length of IKEv2 Authentication Payload: 264<br>Oct 7 16:42:43.283543: | next payload type: previous 'IKEv2 Authentication Payload'.'next payload type' matches 'IKEv2 Security Association Payload' (33:ISAKMP_NEXT_v2SA)<br>Oct 7 16:42:43.309983: | v2 state object #4 found, in STATE_PARENT_I2<br>Oct 7 16:42:43.309985: | found state #4<br>Oct 7 16:42:43.310116: | Notify Message Type: v2N_AUTHENTICATION_FAILED (0x18)<br>Oct 7 16:42:43.310121: | selected state microcode Initiator: process AUTHENTICATION_FAILED AUTH notification<br>Oct 7 16:42:43.310125: | calling processor Initiator: process AUTHENTICATION_FAILED AUTH notification<br>Oct 7 16:42:43.310129: "private#<a href="http://0.0.0.0/0">0.0.0.0/0</a>"[2] ...13.57.200.87 #4: IKE SA authentication request rejected: AUTHENTICATION_FAILED<br>Oct 7 16:42:43.310241: | v2 state object #3 found, in STATE_PARENT_I2<br>Oct 7 16:42:43.310249: | found state #3<br>Oct 7 16:42:43.310266: | no useful state microcode entry found<br>Oct 7 16:42:46.289302: "private#<a href="http://0.0.0.0/0">0.0.0.0/0</a>"[2] ...13.57.200.87 #4: STATE_PARENT_I2: 3 second timeout exceeded after 0 retransmits. Possible authentication failure: no acceptable response to our first encrypted message<br>Oct 7 16:42:46.289344: | OE: delete_state orphaning hold with failureshunt drop (negotiation shunt would have been trap)<br>Oct 7 16:42:46.289346: | failureshunt == negotiationshunt, no replace needed<br>Oct 7 16:42:46.289363: | add bare shunt 0x55f75a704a58 <a href="http://172.16.1.61/32:0">172.16.1.61/32:0</a> --0--> <a href="http://13.57.200.87/32:0">13.57.200.87/32:0</a> => %drop 0 oe-failing<br>Oct 7 16:42:46.289378: | No need to replace negotiation_shunt with failure_shunt - they are the same<br>Oct 7 16:42:48.526882: | keeping recent bare shunt 0x55f75a704a58 <a href="http://172.16.1.61/32:0">172.16.1.61/32:0</a> --0--> <a href="http://13.57.200.87/32:0">13.57.200.87/32:0</a> => %drop 0 oe-failing<br></div><br><div class="gmail_quote"><div dir="ltr">On Sun, Oct 7, 2018 at 2:50 PM Paul Wouters <<a href="mailto:paul@nohats.ca">paul@nohats.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Sun, 7 Oct 2018, rayv33n wrote:<br>
<br>
> Followed all your suggestions and the connection information shows the that the oppo sees that IP addresses across<br>
> the connection down to the %fromcert. What's different this time is the +MS+S=C which I have no idea what that is.<br>
> I blew away the /etc/ipsec.d/*.db and when back to the instruction on how to create it.<br>
<br>
That string is a clumpsy way to show identifications used, ignore it.<br>
<br>
> Oct 7 18:54:28.198237: | private key for cert Thor not found in local cache; loading from NSS DB<br>
<br>
I am still very confused about this. It is abnormal and other people<br>
don't run into this issue at all. So I am really trying to see what<br>
is different in your setup. Can you configure a static ip to ip<br>
connection with the same certificates? Does that work?<br>
<br>
Maybe try adding leftsendca=all ? Although the intermediary should<br>
not be needed since it appears in your NSS and is marked as trusted<br>
already. Perhaps you are missing some expected flags in the EKU or KU<br>
for NSS?<br>
<br>
> The regular config I have work if there is not NAT involved.<br>
<br>
So whether or not there is NAT should not affect the authentication at<br>
all?<br>
<br>
Paul<br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr">You are FREE to become a slave<br><div><br></div><div>Key ID: <span style="color:rgb(46,46,46);font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-style:italic">9A452ABAA4593489</span></div><div><span style="color:rgb(46,46,46);font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-style:italic">Finger Print: </span><span style="color:rgb(46,46,46);font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-style:italic">7A8A 5849 ED44 52B1 0D8A EDAC 9A45 2ABA A459 3489</span></div><div><font face="Helvetica Neue, Helvetica, Arial, sans-serif" color="#2e2e2e"><i>Pub Key: </i></font><a href="http://pgp.mit.edu:11371/pks/lookup?search=rayv33n%40gmail.com&op=index" target="_blank">http://pgp.mit.edu:11371/pks/lookup?search=rayv33n%40gmail.com&op=index</a></div></div></div></div></div></div></div>