Question
Strongswan (swanctl) ipsec ikev2 tunnel authentication by smartcard and EAP
Dear team,
I'm stuck with an error message: gw validation failed
I'm using strongswan 6.0.2 on Linux.
I'm able to communicate with the FW, but it seems that something is not recognised or misunderstood communication between the client and the server.
swanctl.conf :
connections { fortigate { version = 2 proposals = aes256-sha256-modp1536,aes256-sha256-modp2048,aes256-sha1-modp1536 local_addrs = %any remote_addrs = 192.168.14.250 fragmentation = accept mobike = no send_cert = always local-pkcs11 { auth = pubkey round = 0 cert { handle = 040840f509340ed8a314 slot = 0 } } remote { auth = pubkey id = 192.168.14.250 } local-eap { auth = eap-mschapv2 eap_id = tdupont round = 1 } children { net { local_ts = 0.0.0.0/0 remote_ts = 10.226.2.0/24,10.226.3.128/25,10.226.4.80/28,10.226.20.0/24,10.226.101.0/28,10.226.130.0/24,10.72.10.123/32,10.121.0.0/16 ipcomp = no esp_proposals = aes256-sha256-modp1536,aes256-sha256-modp2048 mode = tunnel } } } } secrets { token-rossignol { handle = 040840f509340ed8a314 slot = 0 } eap-tdupont { id = "tdupont" secret = "Secret P@ss !" } }
start strongswan service : OK
swanctl --load-all => request for pin code : OK
# swanctl --load-all loaded certificate from '/etc/strongswan/swanctl/x509ca/AC-LOCAL-2044.pem' loaded certificate from '/etc/strongswan/swanctl/x509ca/AC_auth.pem' loaded certificate from '/etc/strongswan/swanctl/x509ca/AC_racine.pem' PIN for token-rossignol: loaded key token-rossignol from token [keyid: 45320b32fac537444898ee051a31e6bb4a6abff7] loaded eap secret 'eap-tdupont' no authorities found, 0 unloaded no pools found, 0 unloaded loaded connection 'fortigate' successfully loaded 1 connections, 0 unloaded
Trying to mount tunnel:
# swanctl --initiate --ike fortigate [IKE] initiating IKE_SA fortigate[15] to 192.168.14.250 [ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ] [NET] sending packet: from 192.168.222.73[500] to 192.168.14.250[500] (488 bytes) [NET] received packet: from 192.168.14.250[500] to 192.168.222.73[500] (405 bytes) [ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) ] [CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536 [IKE] faking NAT situation to enforce UDP encapsulation [IKE] received cert request for "C=FR, O=MAISON, OU=LOCAL, CN=AC-LOCAL-2044" [IKE] received cert request for "C=FR, O=SOCIETE DE FABRICATION, 55:04:61=NTRFR-130013345, OU=0002 130013345, CN=AC AUTHENTIFICATION ET SIGNATURE SDF QUALIFIEE" [IKE] sending cert request for "C=FR, O=SOCIETE DE FABRICATION, 55:04:61=NTRFR-130013345, OU=0002 130013345, CN=AC RACINE SDF QUALIFIEE" [IKE] sending cert request for "C=FR, O=SOCIETE DE FABRICATION, 55:04:61=NTRFR-130013345, OU=0002 130013345, CN=AC AUTHENTIFICATION ET SIGNATURE SDF QUALIFIEE" [IKE] sending cert request for "C=FR, O=MAISON, OU=LOCAL, CN=AC-LOCAL-2044" [IKE] authentication of '0x40:f5:09:34:0e:d8:a3:14' (myself) with RSA signature successful [IKE] sending end entity cert "C=FR, O=MAISON, 55:04:61=NTRFR-120023015, OU=0002 120023015, CN=DUPONT Thomas, SN=DUPONT, G=Thomas, serialNumber=6134c12b-b692-410f-b452-856f466ca36b" [ENC] generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH N(EAP_ONLY) N(MSG_ID_SYN_SUP) ] [NET] sending packet: from 192.168.222.73[4500] to 192.168.14.250[4500] (3344 bytes) [IKE] retransmit 1 of request with message ID 1 [NET] sending packet: from 192.168.222.73[4500] to 192.168.14.250[4500] (3344 bytes) [IKE] retransmit 2 of request with message ID 1 [NET] sending packet: from 192.168.222.73[4500] to 192.168.14.250[4500] (3344 bytes) [IKE] retransmit 3 of request with message ID 1 [NET] sending packet: from 192.168.222.73[4500] to 192.168.14.250[4500] (3344 bytes) ...In this log, some strange information: organizationIdentifier is replaced by 55:04:61 (not shown like this on the fortigate)
Fortigate log:
ike V=Forti:1:TunnelIkeV2:4057: responder received AUTH msg ike V=Forti:1:TunnelIkeV2:4057: processing notify type INITIAL_CONTACT ike V=Forti:1:TunnelIkeV2:4057: processing notify type NO_ADDITIONAL_ADDRESSES ike V=Forti:1:TunnelIkeV2:4057: processing notify type EAP_ONLY_AUTHENTICATION ike V=Forti:1:TunnelIkeV2:4057: processing notify type MESSAGE_ID_SYNC_SUPPORTED ike V=Forti:1:TunnelIkeV2:4057: received peer identifier DER_ASN1_DN 'C = FR, O = MAISON, organizationIdentifier = NTRFR-120023015, OU = 0002 120023015, CN = DUPONT Thomas, SN = DUPONT, GN = Thomas, serialNumber = 6134c12b-b692-410f-b452-856f466ca36b' ike V=Forti:1:TunnelIkeV2:4057: re-validate gw ID ike V=Forti:1:TunnelIkeV2:4057: gw validation failed ike V=Forti:1:TunnelIkeV2:4057: schedule delete of IKE SA aa8911b557bb48d4/1d6f9610e8a66ad5 ike V=Forti:1:TunnelIkeV2:4057: scheduled delete of IKE SA aa8911b557bb48d4/1d6f9610e8a66ad5 ike V=Forti:1:TunnelIkeV2: connection expiring due to phase1 down ike V=Forti:1:TunnelIkeV2: going to be deleted ike V=Forti:1: comes 192.168.222.205:4500->192.168.14.250:4500,ifindex=48,vrf=0,len=3412.... ike V=Forti:1: IKEv2 exchange=AUTH id=aa8911b557bb48d4/1d6f9610e8a66ad5:00000001 len=3408
What's wrong: why Fortigate respond with "gw validation failed"
All ideas are welcome!
