<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<br>
<br>
<div class="moz-cite-prefix">On 24/12/2020 03:41, Alex wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAB1R3sj5a32ScL5b3TrOZSwFBjbuWhBBiaOGRZ8-OSb-iX3DHQ@mail.gmail.com">
<pre class="moz-quote-pre" wrap="">
Hi,
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Is there documentation available on how to configure
it with libreswan?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Yes, see our libreswan examples on the website.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
I followed the examples outlined on this page, including importing the
pkcs12 file with ipsec and building an ipsec.conf for the VPN server.
<a class="moz-txt-link-freetext" href="https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv2">https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv2</a>
I was able to import the cert successfully on win10. When I try to
connect, I receive a "Policy match error". How do I troubleshoot this?
I have made the registry changes for "Windows Certificate
requirements" and "L2TP / IPsec with the server behind NAT" as per
this doc:
<a class="moz-txt-link-freetext" href="https://libreswan.org/wiki/Interoperability#Windows_Certificate_requirements">https://libreswan.org/wiki/Interoperability#Windows_Certificate_requirements</a>
I've also added the "NegotiateDH2048_AES256" DWORD as per this doc:
<a class="moz-txt-link-freetext" href="https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv2">https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv2</a>
I'm also seeing the following in pluto.log:
Dec 23 22:31:29.242048: "ikev2-cp"[4] 192.168.1.35 #7: no local
proposal matches remote proposals
1:IKE:ENCR=3DES;INTEG=HMAC_SHA1_96;PRF=HMAC_SHA1;DH=MODP1024
2:IKE:ENCR=AES_CBC_256;INTEG=HMAC_SHA1_96;PRF=HMAC_SHA1;DH=MODP1024
3:IKE:ENCR=3DES;INTEG=HMAC_SHA2_256_128;PRF=HMAC_SHA2_256;DH=MODP1024
4:IKE:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_256_128;PRF=HMAC_SHA2_256;DH=MODP1024
5:IKE:ENCR=3DES;INTEG=HMAC_SHA2_384_192;PRF=HMAC_SHA2_384;DH=MODP1024
6:IKE:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_384_192;PRF=HMAC_SHA2_384;DH=MODP1024
Dec 23 22:31:29.242065: "ikev2-cp"[4] 192.168.1.35 #7: responding to
IKE_SA_INIT message (ID 0) from 192.168.1.35:500 with unencrypted
notification NO_PROPOSAL_CHOSEN
The win10 laptop I am using is connected to our internal network on
192.168.1.35. The libreswan server has a public IP (which I've
specified as the endpoint for the win10 client), but also is the
Internet gateway for the win10 client as 192.168.1.1. Is it possible
to connect to the libreswan server while being on the same internal
network?
</pre>
</blockquote>
Shouldn't you use an FQDN rather than IP with the FQDN matching your
certificate SAN. Then, on your LAN fix the DNS server to map the
FQDN to 192.168.1.1.<br>
<br>
FWIW an internal LAN of 192.168.1.0/24 or 192.168.0.0/24 is lousy
for a roadwarrior as there is a high chance it will be the same as
the local LAN he is connecting from, once he is on the road.<br>
<blockquote type="cite"
cite="mid:CAB1R3sj5a32ScL5b3TrOZSwFBjbuWhBBiaOGRZ8-OSb-iX3DHQ@mail.gmail.com">
<pre class="moz-quote-pre" wrap="">The network looks like this:
68.195.111.42 <--> 192.168.1.1 <--> internal network with win10 client
192.168.1.35
If not, is there another way to test this without having to go outside
the local network?
Here is my windows.conf config file:
conn ikev2-cp
left=68.195.111.42
leftcert=vpn.mycompany.com
<a class="moz-txt-link-abbreviated" href="mailto:leftid=@vpn.mycompany.com">leftid=@vpn.mycompany.com</a>
leftsendcert=always
leftsubnet=0.0.0.0/0
leftrsasigkey=%cert
right=%any
rightaddresspool=192.168.6.2-192.168.6.254
rightca=%same
rightrsasigkey=%cert
modecfgdns=8.8.8.8,8.8.4.4
narrowing=yes
dpddelay=30
dpdtimeout=120
dpdaction=clear
auto=add
ikev2=insist
rekey=no
fragmentation=yes
_______________________________________________
Swan mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Swan@lists.libreswan.org">Swan@lists.libreswan.org</a>
<a class="moz-txt-link-freetext" href="https://lists.libreswan.org/mailman/listinfo/swan">https://lists.libreswan.org/mailman/listinfo/swan</a>
</pre>
</blockquote>
<br>
</body>
</html>