Strongswan (swanctl) ipsec ikev2 tunnel authentication by smartcard and EAP

[Alf007]

Dear team,

I'm stuck with an error message: gw validation failed

I'm using strongswan 6.0.2 on Linux.
I'm able to communicate with the FW, but it seems that something is not recognised or misunderstood communication between the client and the server.

swanctl.conf :

connections {
  fortigate {
    version = 2
    proposals = aes256-sha256-modp1536,aes256-sha256-modp2048,aes256-sha1-modp1536
    local_addrs  = %any
    remote_addrs = 192.168.14.250
    fragmentation = accept
    mobike = no
    send_cert = always

    local-pkcs11 {
      auth = pubkey
      round = 0
      cert {
        handle = 040840f509340ed8a314
        slot   = 0
      }
    }

    remote {
      auth = pubkey
      id = 192.168.14.250
    }
    
    local-eap {
      auth = eap-mschapv2
      eap_id = tdupont 
      round = 1
    }

    children {
      net {
        local_ts  = 0.0.0.0/0
        remote_ts = 10.226.2.0/24,10.226.3.128/25,10.226.4.80/28,10.226.20.0/24,10.226.101.0/28,10.226.130.0/24,10.72.10.123/32,10.121.0.0/16
        ipcomp = no
        esp_proposals = aes256-sha256-modp1536,aes256-sha256-modp2048
        mode = tunnel
      }
    }
  }
}

secrets {
    token-rossignol {
        handle = 040840f509340ed8a314
        slot = 0
    }

    eap-tdupont {
        id = "tdupont"
        secret = "Secret P@ss !"
    }
}

start strongswan service : OK
swanctl --load-all => request for pin code : OK

# swanctl --load-all
loaded certificate from '/etc/strongswan/swanctl/x509ca/AC-LOCAL-2044.pem'
loaded certificate from '/etc/strongswan/swanctl/x509ca/AC_auth.pem'
loaded certificate from '/etc/strongswan/swanctl/x509ca/AC_racine.pem'
PIN for token-rossignol: 
loaded key token-rossignol from token [keyid: 45320b32fac537444898ee051a31e6bb4a6abff7]
loaded eap secret 'eap-tdupont'
no authorities found, 0 unloaded
no pools found, 0 unloaded
loaded connection 'fortigate'
successfully loaded 1 connections, 0 unloaded

Trying to mount tunnel:

# swanctl --initiate --ike fortigate
[IKE] initiating IKE_SA fortigate[15] to 192.168.14.250
[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
[NET] sending packet: from 192.168.222.73[500] to 192.168.14.250[500] (488 bytes)
[NET] received packet: from 192.168.14.250[500] to 192.168.222.73[500] (405 bytes)
[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) ]
[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536
[IKE] faking NAT situation to enforce UDP encapsulation
[IKE] received cert request for "C=FR, O=MAISON, OU=LOCAL, CN=AC-LOCAL-2044"
[IKE] received cert request for "C=FR, O=SOCIETE DE FABRICATION, 55:04:61=NTRFR-130013345, OU=0002 130013345, CN=AC AUTHENTIFICATION ET SIGNATURE SDF QUALIFIEE"
[IKE] sending cert request for "C=FR, O=SOCIETE DE FABRICATION, 55:04:61=NTRFR-130013345, OU=0002 130013345, CN=AC RACINE SDF QUALIFIEE"
[IKE] sending cert request for "C=FR, O=SOCIETE DE FABRICATION, 55:04:61=NTRFR-130013345, OU=0002 130013345, CN=AC AUTHENTIFICATION ET SIGNATURE SDF QUALIFIEE"
[IKE] sending cert request for "C=FR, O=MAISON, OU=LOCAL, CN=AC-LOCAL-2044"
[IKE] authentication of '0x40:f5:09:34:0e:d8:a3:14' (myself) with RSA signature successful
[IKE] sending end entity cert "C=FR, O=MAISON, 55:04:61=NTRFR-120023015, OU=0002 120023015, CN=DUPONT Thomas, SN=DUPONT, G=Thomas, serialNumber=6134c12b-b692-410f-b452-856f466ca36b"
[ENC] generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
[NET] sending packet: from 192.168.222.73[4500] to 192.168.14.250[4500] (3344 bytes)
[IKE] retransmit 1 of request with message ID 1
[NET] sending packet: from 192.168.222.73[4500] to 192.168.14.250[4500] (3344 bytes)
[IKE] retransmit 2 of request with message ID 1
[NET] sending packet: from 192.168.222.73[4500] to 192.168.14.250[4500] (3344 bytes)
[IKE] retransmit 3 of request with message ID 1
[NET] sending packet: from 192.168.222.73[4500] to 192.168.14.250[4500] (3344 bytes)
...

In this log, some strange information: organizationIdentifier is replaced by 55:04:61 (not shown like this on the fortigate)

Fortigate log:

ike V=Forti:1:TunnelIkeV2:4057: responder received AUTH msg
ike V=Forti:1:TunnelIkeV2:4057: processing notify type INITIAL_CONTACT
ike V=Forti:1:TunnelIkeV2:4057: processing notify type NO_ADDITIONAL_ADDRESSES
ike V=Forti:1:TunnelIkeV2:4057: processing notify type EAP_ONLY_AUTHENTICATION
ike V=Forti:1:TunnelIkeV2:4057: processing notify type MESSAGE_ID_SYNC_SUPPORTED
ike V=Forti:1:TunnelIkeV2:4057: received peer identifier DER_ASN1_DN 'C = FR, O = MAISON, organizationIdentifier = NTRFR-120023015, OU = 0002 120023015, CN = DUPONT Thomas, SN = DUPONT, GN = Thomas, serialNumber = 6134c12b-b692-410f-b452-856f466ca36b'
ike V=Forti:1:TunnelIkeV2:4057: re-validate gw ID
ike V=Forti:1:TunnelIkeV2:4057: gw validation failed
ike V=Forti:1:TunnelIkeV2:4057: schedule delete of IKE SA aa8911b557bb48d4/1d6f9610e8a66ad5
ike V=Forti:1:TunnelIkeV2:4057: scheduled delete of IKE SA aa8911b557bb48d4/1d6f9610e8a66ad5
ike V=Forti:1:TunnelIkeV2: connection expiring due to phase1 down
ike V=Forti:1:TunnelIkeV2: going to be deleted
ike V=Forti:1: comes 192.168.222.205:4500->192.168.14.250:4500,ifindex=48,vrf=0,len=3412....
ike V=Forti:1: IKEv2 exchange=AUTH id=aa8911b557bb48d4/1d6f9610e8a66ad5:00000001 len=3408

What's wrong: why Fortigate respond with "gw validation failed"

All ideas are welcome!

[Markus_M]

Hey,

the "gw validation failed" is quite generic and often not really helpful.
Check the configuration on the "config vpn ipsec phase1-interface" which should have a peer user referenced either directly or on a firewall policy that uses the tunnel. EAP has to be disabled, if there is no password. The Strongswan sends a peer ID that is your certificate subject; if possible see to not limit the FortiGate VPN settings to remove some complication. Add them later when it works.

I think organizationIdentifier just translates to 55:04:61 if Strongswan cannot read that attribute. It might be ignorable.
Check also the article that I found with the relevant config:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-gw-validation-failed-for-VPN-Ikev2-tunnel-...