Strongswan (swanctl) ipsec ikev2 tunnel authentication by smartcard and EAP

[Alf007]

Dear team,

I'm stuck with an error message: gw validation failed

I'm using strongswan 6.0.2 on Linux.
I'm able to communicate with the FW, but it seems that something is not recognised or misunderstood communication between the client and the server.

swanctl.conf :

connections {
  fortigate {
    version = 2
    proposals = aes256-sha256-modp1536,aes256-sha256-modp2048,aes256-sha1-modp1536
    local_addrs  = %any
    remote_addrs = 192.168.14.250
    fragmentation = accept
    mobike = no
    send_cert = always

    local-pkcs11 {
      auth = pubkey
      round = 0
      cert {
        handle = 040840f509340ed8a314
        slot   = 0
      }
    }

    remote {
      auth = pubkey
      id = 192.168.14.250
    }
    
    local-eap {
      auth = eap-mschapv2
      eap_id = tdupont 
      round = 1
    }

    children {
      net {
        local_ts  = 0.0.0.0/0
        remote_ts = 10.226.2.0/24,10.226.3.128/25,10.226.4.80/28,10.226.20.0/24,10.226.101.0/28,10.226.130.0/24,10.72.10.123/32,10.121.0.0/16
        ipcomp = no
        esp_proposals = aes256-sha256-modp1536,aes256-sha256-modp2048
        mode = tunnel
      }
    }
  }
}

secrets {
    token-rossignol {
        handle = 040840f509340ed8a314
        slot = 0
    }

    eap-tdupont {
        id = "tdupont"
        secret = "Secret P@ss !"
    }
}

start strongswan service : OK
swanctl --load-all => request for pin code : OK

# swanctl --load-all
loaded certificate from '/etc/strongswan/swanctl/x509ca/AC-LOCAL-2044.pem'
loaded certificate from '/etc/strongswan/swanctl/x509ca/AC_auth.pem'
loaded certificate from '/etc/strongswan/swanctl/x509ca/AC_racine.pem'
PIN for token-rossignol: 
loaded key token-rossignol from token [keyid: 45320b32fac537444898ee051a31e6bb4a6abff7]
loaded eap secret 'eap-tdupont'
no authorities found, 0 unloaded
no pools found, 0 unloaded
loaded connection 'fortigate'
successfully loaded 1 connections, 0 unloaded

Trying to mount tunnel:

# swanctl --initiate --ike fortigate
[IKE] initiating IKE_SA fortigate[15] to 192.168.14.250
[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
[NET] sending packet: from 192.168.222.73[500] to 192.168.14.250[500] (488 bytes)
[NET] received packet: from 192.168.14.250[500] to 192.168.222.73[500] (405 bytes)
[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) ]
[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536
[IKE] faking NAT situation to enforce UDP encapsulation
[IKE] received cert request for "C=FR, O=MAISON, OU=LOCAL, CN=AC-LOCAL-2044"
[IKE] received cert request for "C=FR, O=SOCIETE DE FABRICATION, 55:04:61=NTRFR-130013345, OU=0002 130013345, CN=AC AUTHENTIFICATION ET SIGNATURE SDF QUALIFIEE"
[IKE] sending cert request for "C=FR, O=SOCIETE DE FABRICATION, 55:04:61=NTRFR-130013345, OU=0002 130013345, CN=AC RACINE SDF QUALIFIEE"
[IKE] sending cert request for "C=FR, O=SOCIETE DE FABRICATION, 55:04:61=NTRFR-130013345, OU=0002 130013345, CN=AC AUTHENTIFICATION ET SIGNATURE SDF QUALIFIEE"
[IKE] sending cert request for "C=FR, O=MAISON, OU=LOCAL, CN=AC-LOCAL-2044"
[IKE] authentication of '0x40:f5:09:34:0e:d8:a3:14' (myself) with RSA signature successful
[IKE] sending end entity cert "C=FR, O=MAISON, 55:04:61=NTRFR-120023015, OU=0002 120023015, CN=DUPONT Thomas, SN=DUPONT, G=Thomas, serialNumber=6134c12b-b692-410f-b452-856f466ca36b"
[ENC] generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
[NET] sending packet: from 192.168.222.73[4500] to 192.168.14.250[4500] (3344 bytes)
[IKE] retransmit 1 of request with message ID 1
[NET] sending packet: from 192.168.222.73[4500] to 192.168.14.250[4500] (3344 bytes)
[IKE] retransmit 2 of request with message ID 1
[NET] sending packet: from 192.168.222.73[4500] to 192.168.14.250[4500] (3344 bytes)
[IKE] retransmit 3 of request with message ID 1
[NET] sending packet: from 192.168.222.73[4500] to 192.168.14.250[4500] (3344 bytes)
...

In this log, some strange information: organizationIdentifier is replaced by 55:04:61 (not shown like this on the fortigate)

Fortigate log:

ike V=Forti:1:TunnelIkeV2:4057: responder received AUTH msg
ike V=Forti:1:TunnelIkeV2:4057: processing notify type INITIAL_CONTACT
ike V=Forti:1:TunnelIkeV2:4057: processing notify type NO_ADDITIONAL_ADDRESSES
ike V=Forti:1:TunnelIkeV2:4057: processing notify type EAP_ONLY_AUTHENTICATION
ike V=Forti:1:TunnelIkeV2:4057: processing notify type MESSAGE_ID_SYNC_SUPPORTED
ike V=Forti:1:TunnelIkeV2:4057: received peer identifier DER_ASN1_DN 'C = FR, O = MAISON, organizationIdentifier = NTRFR-120023015, OU = 0002 120023015, CN = DUPONT Thomas, SN = DUPONT, GN = Thomas, serialNumber = 6134c12b-b692-410f-b452-856f466ca36b'
ike V=Forti:1:TunnelIkeV2:4057: re-validate gw ID
ike V=Forti:1:TunnelIkeV2:4057: gw validation failed
ike V=Forti:1:TunnelIkeV2:4057: schedule delete of IKE SA aa8911b557bb48d4/1d6f9610e8a66ad5
ike V=Forti:1:TunnelIkeV2:4057: scheduled delete of IKE SA aa8911b557bb48d4/1d6f9610e8a66ad5
ike V=Forti:1:TunnelIkeV2: connection expiring due to phase1 down
ike V=Forti:1:TunnelIkeV2: going to be deleted
ike V=Forti:1: comes 192.168.222.205:4500->192.168.14.250:4500,ifindex=48,vrf=0,len=3412....
ike V=Forti:1: IKEv2 exchange=AUTH id=aa8911b557bb48d4/1d6f9610e8a66ad5:00000001 len=3408

What's wrong: why Fortigate respond with "gw validation failed"

All ideas are welcome!

[Markus_M]

Hey,

the "gw validation failed" is quite generic and often not really helpful.
Check the configuration on the "config vpn ipsec phase1-interface" which should have a peer user referenced either directly or on a firewall policy that uses the tunnel. EAP has to be disabled, if there is no password. The Strongswan sends a peer ID that is your certificate subject; if possible see to not limit the FortiGate VPN settings to remove some complication. Add them later when it works.

I think organizationIdentifier just translates to 55:04:61 if Strongswan cannot read that attribute. It might be ignorable.
Check also the article that I found with the relevant config:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-gw-validation-failed-for-VPN-Ikev2-tunnel-...

[Alf007]

Dear Markus,

1/ Do you know if it exists settings to have better debug on FW output?

2/ IPsec settings

​config vpn ipsec phase1-interface
    edit "TunnelIkeV2"
        set type dynamic
        set interface "Vlan509"
        set ip-version 4
        set ike-version 2
        set local-gw 192.168.14.250
        set keylife 43200
        set authmethod signature
        unset authmethod-remote
        set peertype peergrp
        set monitor-min 0
        set net-device disable
        set exchange-interface-ip disable
        set aggregate-member disable
        set packet-redistribution disable
        set mode-cfg enable
        set ipv4-dns-server1 10.72.10.123
        set ipv4-dns-server2 192.168.91.1
        set ipv4-dns-server3 0.0.0.0
        set ipv4-wins-server1 0.0.0.0
        set ipv4-wins-server2 0.0.0.0
        set ipv6-dns-server1 ::
        set ipv6-dns-server2 ::
        set ipv6-dns-server3 ::
        set proposal aes256-sha256
        set add-route enable
        set localid ''
        set localid-type auto
        set negotiate-timeout 180
        set fragmentation enable
        set ip-fragmentation post-encapsulation
        set dpd on-idle
        set comments ''
        set npu-offload enable
        set send-cert-chain enable
        set dhgrp 14 5
        set suite-b disable
        set eap enable
        set eap-identity send-request
        set eap-exclude-peergrp ''
        set eap-cert-auth disable
        set acct-verify disable
        set ppk disable
        set wizard-type custom
        set reauth enable
        set authusrgrp ''
        set idle-timeout disable
        set ha-sync-esp-seqno enable
        set fgsp-sync disable
        set inbound-dscp-copy disable
        set auto-discovery-sender disable
        set auto-discovery-receiver disable
        set auto-discovery-forwarder disable
        set encapsulation none
        set nattraversal enable
        set esn disable
        set fragmentation-mtu 1200
        set childless-ike disable
        set azure-ad-autoconnect disable
        set client-resume disable
        set rekey enable
        set digital-signature-auth disable
        set rsa-signature-hash-override disable
        set enforce-unique-id disable
        set cert-id-validation enable
        set fec-egress disable
        set fec-ingress disable
        set network-overlay disable
        set dev-id-notification disable
        set link-cost 0
        set kms ''
        set exchange-fgt-device-id disable
        set ems-sn-check disable
        set cert-trust-store local
        set qkd disable
        set transport udp
        set remote-gw-match any
        set certificate "192.168.14.250"
        set default-gw 0.0.0.0
        set default-gw-priority 0
        set peergrp "GrpAuthorizedAC"
        set assign-ip enable
        set assign-ip-from range
        set ipv4-start-ip 10.250.3.1
        set ipv4-end-ip 10.250.3.254
        set ipv4-netmask 255.255.255.255
        set dns-mode manual
        set ipv4-split-include "GrpNetAccessiblesVPN"
        set split-include-service ''
        set ipv6-start-ip ::
        set ipv6-end-ip ::
        set ipv6-prefix 128
        set ipv6-split-include ''
        set ip-delay-interval 0
        set ipv4-split-exclude ''
        set save-password disable
        set client-auto-negotiate disable
        set client-keep-alive disable
        set keepalive 10
        set distance 15
        set priority 1
        set dpd-retrycount 3
        set dpd-retryinterval 60
    next


# show user peer
config user peer
    edit "Users AC LOCAL"
        set ca "CA_Cert_3"
    next
    edit "Users AC Rossignol"
        set ca "CA_Cert_2"
    next
end

# show user peergrp 
config user peergrp
    edit "GrpAuthorizedAC"
        set member "Users AC LOCAL" "Users AC Rossignol"
    next
end

3/ EAP is mandatory. First authentication with smarcard is needed to verify that user has a valid card with valid certificate.
Second authentication is for authorization: validation on LDAP (user/pass) to retrieve groups of user and permit accessing resources.

4/ I already had a look on the link you propose, but this request to disable EAP. This is not possible otherwise, authorization will no more work.