1

The problem is the ikeV2 authentication with the ASA as initiator.

For the following experimets I set on the ASA the followings PSKs: local: 123, remote: 321


In case the ASA is the initiator:

Now several combinations in ipsec.secrets on the StrongSwan side:

left 123 right 321

ASA:Auth exchange failed

SWAN: tried 1 shared key for '%any' - 'XXX', but MAC mismatched

left 123 right 123

ASA:Failed to authenticate the IKE SA

charon: 11[IKE] authentication of 'a with pre-shared key successful
charon: 11[IKE] authentication of 'b' (myself) with pre-shared key
charon: 11[IKE] IKE_SA x[1] established between b[b]...a[a]

left 321 right 123 (should be the working one)

ASA:Failed to authenticate the IKE SA

charon: 08[IKE] authentication of 'a' with pre-shared key successful
charon: 08[IKE] authentication of 'b' (myself) with pre-shared key
charon: 08[IKE] x[1] established between b[b]...a[a]

left 321 right 321

ASA: Auth exchange failed

SWAN: ... but MAC mismatched

If I set the two PSKs the same on each side then everything works.

BTW what is the point anyway with IKEv2 having two different PSKs?

Oh, and ASA debugs show the following when it cannot connect:

REAL Decrypted packet:Data: 8 bytes
IKEv2-PROTO-5: Parse Notify Payload: AUTHENTICATION_FAILED NOTIFY(AUTHENTICATION_FAILED)  Next payload: NONE, reserved: 0x0, length: 8
    Security protocol id: Unknown - 0, spi size: 0, type: AUTHENTICATION_FAILED

Now with StrongSwan being the initiator: (ASA still local: 123, remote: 321)

left 123 right 321 !!!

SWAN ok

ASA ok

left 123 right 123

SWAN: received AUTHENTICATION_FAILED notify error

ASA: Failed to authenticate the IKE SA

left 321 right 123 (should be the working one)

SWAN: received AUTHENTICATION_FAILED notify error

ASA: Failed to authenticate the IKE SA

left 321 right 321 !!!

SWAN ok

ASA ok

Here's the strongswan conf

# cat /var/lib/strongswan/ipsec.conf.inc

conn TEST
 left=l
 leftsubnet=n/24
 leftid=l
 leftfirewall=yes
 right=r
 rightsubnet=n/24
 rightid=r
 auto=add # or start
 ike=aes256-sha512-modp1024
 esp=aes256-sha1
 keyexchange=ikev2
        authby=secret

Here's the ASA conf, standard stuff

tunnel-group x type ipsec-l2l
tunnel-group x general-attributes
 default-group-policy VPN_x_GP
tunnel-group x ipsec-attributes
 ikev2 remote-authentication pre-shared-key 321
 ikev2 local-authentication pre-shared-key 123
group-policy VPN_x_GP internal
group-policy VPN_x_GP attributes
 vpn-filter value ACL_VPN_x
 vpn-tunnel-protocol ikev2
crypto ipsec ikev2 ipsec-proposal IKEv2-ESP-AES256-SHA1
 protocol esp encryption aes-256
 protocol esp integrity sha-1
crypto map internet_crypto_map 1 match address internet_cryptomap
crypto map internet_crypto_map 1 set pfs
crypto map internet_crypto_map 1 set peer x
crypto map internet_crypto_map 1 set ikev2 ipsec-proposal IKEv2-ESP-AES256-SHA1
crypto map internet_crypto_map interface outside
crypto ikev2 policy 999
 encryption aes-256
 integrity sha512
 group 2
 prf sha512
 lifetime seconds 86400
crypto ikev2 policy 1000
 encryption aes-256
 integrity sha
 group 2
 prf sha
 lifetime seconds 86400

ipsec.secrets

left : PSK "321"
right : PSK "123"

Although I currently suspect that is not entirely correct, I believe it would be for ikev1 but I don't find much documentation for ikev2 (multiple PSKs). For now, I'll investigate in that direction.

0

This was discussed on the strongSwan mailing list.

As you can see from that thread, in the end it turned out that it makes no real sense to use this, at least not with strongSwan.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.