I'm trying to create an IKEv2 Strongswan VPN server (U5.7.2/K5.3.0-42-generic) since two days on my personnal VPS (Ubuntu 19.10) to make some tests before implement it on the Unifi equipment of my work (I hope that will be possible)
I've used differents tutorials and troubleshooting pages to make my conf
I'm using a radius authentication (with a local freeradius server) for the users
And I'm facing this stupid issue, I hope one of you can take 2 minutes to help me :)
I will try to be the most verbose than possible, do not hesitate to ask for more informations if needed
My ipsec.conf:
config setup
strictcrlpolicy=yes
uniqueids=never
conn roadwarrior
auto=add
compress=no
type=tunnel
keyexchange=ikev2
fragmentation=yes
forceencaps=yes
ike=aes256-sha1-modp1024,aes256gcm16-sha256-ecp521,aes256-sha256-ecp384
esp=aes256-sha1,aes128-sha256-modp3072,aes256gcm16-sha256,aes256gcm16-ecp384
dpdaction=clear
dpddelay=180s
rekey=no
left=%any
leftid=vpsXXXXXX.ovh.net
leftcert=vpn.example.com.crt.pem
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightid=%any
rightauth=eap-radius
eap_identity=%identity
rightdns=8.8.8.8,8.8.4.4
rightsourceip=10.10.10.0/24
rightsendcert=never
My ipsec.secrets:
vpsXXXXXX.ovh.net : RSA vpn.example.com.key.der
My ipsec.d/ files:
~$ sudo ls /etc/ipsec.d/private/
vpn.example.com.key.der
~$ sudo ls /etc/ipsec.d/certs/
vpn.example.com.crt.pem
~$ sudo ls /etc/ipsec.d/cacerts/
vpnca.crt.der
I've imported my vpnca.crt.der on my Mac, my Android (Strongswan client), my Windows 10 Enterprise and a Windows 10 Standard of a friend
Everything is working fine for my Mac and my Android, but impossible to establish the connexion with Windows
In the swanctl --log :
14[CFG] selected peer config 'roadwarrior'
14[IKE] initiating EAP_IDENTITY method (id 0x00)
14[IKE] peer supports MOBIKE
14[IKE] authentication of 'vpsXXXXXX.ovh.net' (myself) with RSA signature successful
14[IKE] sending end entity cert "C=FR, O=Test Company, CN=vpsXXXXXX.ovh.net"
14[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
14[ENC] splitting IKE message (1996 bytes) into 2 fragments
14[ENC] generating IKE_AUTH response 1 [ EF(1/2) ]
14[ENC] generating IKE_AUTH response 1 [ EF(2/2) ]
14[NET] sending packet: from XX.XX.XX.XX[4500] to YY.YY.YY.YY[4500] (1248 bytes)
14[NET] sending packet: from XX.XX.XX.XX[4500] to YY.YY.YY.YY[4500] (816 bytes)
On the windows side, the error shown is the usual :
"IKE authentication credentials are unacceptable"
In the Event Viewer:
CoId={6C88B9D2-54F0-4671-A12D-B506DE75630F}: The user MYWORKDOMAIN\myuser dialed a connection named VPN Connection which has failed. The error code returned on failure is 13801.
What I've done on Windows side:
- Import the CA cert in Local computer certificates -> Trusted Root Certification Authorities -> Certificates
- Create the VPN Connexion under VPN Settings:
- Server name or address: vpsXXXXXX.ovh.net
- VPN Type: IKEv2
- Type of sign-in info: User and password
- In the ncpa.cpl addaptator properties:
- Security:
- Data encryption: Optionnal encryption
- Authentication: Use Extensible Authentication Protocol (EAP): Microsoft: Secured password (EAP-MSCHAPv2) (encryption enabled)
- Networking: unchecked IPv6
- Security:
The CA has this attributes:
Verison:
V3
Serial Number:
73fbd6a8d90a33db
Signature algorithm:
sha1RSA
Signature hash algorithm:
sha1
Issuer:
CN = TEST VPS CA
O = Test Company
C = FR
Valid from:
Friday, March 27, 2020 3:15:29 PM
Valid to:
Monday, March 27, 2023 3:15:29 PM
Subject:
CN = TEST VPS CA
O = Test Company
C = FR
Pulic key:
RSA (4096 bits)
Pulic key parameters:
05 00
Subject key identifier:
214851f1fe79e3719be0139fab1799a9d4a08561
Enhanced Key Usage:
Server Authentication (1.3.6.1.5.5.7.3.1)
Basic Constraints:
Subject Type=CA
Path Length Constraint=None
Key Usage:
Information Not Available
Thumbprint:
78e8cc49ab508b8f477b419d369873036be488b4
The VPS cert attributes:
Version:
3
Serial Number:
3611432227629166526
Signature Algorithm:
sha1WithRSAEncryption
Issuer:
C = FR, O = Test Company, CN = TEST VPS CA
Validity:
Not Before: Mar 27 14:15:31 2020 GMT
Not After : Mar 27 14:15:31 2023 GMT
Subject:
C = FR, O = Test Company, CN = vpsXXXXXX.ovh.net
Public Key Algorithm:
rsaEncryption
RSA Public-Key:
(4096 bit)
X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:21:48:51:F1:FE:79:E3:71:9B:E0:13:9F:AB:17:99:A9:D4:A0:85:61
X509v3 Subject Alternative Name:
DNS:vpsXXXXXX.ovh.net
X509v3 Extended Key Usage:
TLS Web Server Authentication
Signature Algorithm:
sha1WithRSAEncryption
Commands used to create the certificates:
ipsec pki --gen --type rsa --size 4096 --outform pem > vpnca.key.pem
ipsec pki --self --flag serverAuth --in vpnca.key.pem --type rsa --digest sha1 \
--dn "C=FR, O=Test Company, CN=TEST VPS CA" --ca > vpnca.crt.der
ipsec pki --gen --type rsa --size 4096 --outform pem > vpn.example.com.key.pem
ipsec pki --pub --in vpn.example.com.key.pem --type rsa > vpn.example.com.csr
ipsec pki --issue --cacert vpnca.crt.der --cakey vpnca.key.pem --digest sha1 \
--dn "C=FR, O=Test Company, CN=vpsXXXXXX.ovh.net" \
--san "vps807542.ovh.net" --flag serverAuth --outform pem \
< vpn.example.com.csr > vpn.example.com.crt.pem
openssl rsa -in vpn.example.com.key.pem -out vpn.example.com.key.der -outform DER
cp vpnca.crt.der /etc/ipsec.d/cacerts
cp vpn.example.com.crt.pem /etc/ipsec.d/certs
cp vpn.example.com.key.der /etc/ipsec.d/private
I hope you have enought information and you will be able to help me because I really do not understand why my Windows does not reply to the IKE_AUTH packet...
Thanks for your help and take care!