3

I'm trying to configure a remote acccess vpn into a cisco ASA 5510 (9.1(7)15). I want to be able to use IKEv2 with Certificate + user/password xauth with strongswan as the client under Ubuntu.

I have this working for an IKEv1 tunnel after much frustration, but I cannot get an IKEv2 configuration to work.

ipsec.conf:

version 2
config setup
        strictcrlpolicy=no
        charondebug="ike 4, knl 2, cfg 2"

conn %default
        ikelifetime=1440m
        keylife=60m
        rekeymargin=3m
        keyingtries=1
        ike=aes256-sha1-modp1536     #Phase1 parameters
        esp=aes256-sha1              #Phase2 parameters
        xauth=client              #Xauth client mode
        xauth_identity=chris      #identity for Xauth
        auto=add

conn "cert2"
        keyexchange=ikev2
        authby=xauthrsasig
        aggressive=no
        leftsourceip=%config
        leftauth2=xauth
        leftcert=chris2.cer
        right = vpn.my.company.com
        rightid=%any
        rightsubnet=0.0.0.0/0

From the logs on the ASA it looks like it wants to treate the IKE2 connection as a L2L tunnel. It wants to match the DefaultL2LGroup and if I remove the %config from leftsourceip, the tunnel will come up, but shows to be a L2L tunnel and doesn't work since I dont get a DHCP address.

2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-2: attempting to find tunnel group for IP: 72.48.127.151
2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-2: ignoring tunnel-group-map default group, not L2L
2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-2: mapped to DefaultL2LGroup
2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-2: tg_name set to: DefaultL2LGroup
2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-2: tunn grp type set to: L2L

2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-1: (82): Process request attribute: Unable to get webvpn session
2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-1: Error processing config mode request attibute: 1
2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-1: Failed to build config mode reply
2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PROTO-2: (82): Error in retrieving config mode data to send

I feel like there's something very obvious that I must not understand about strongswan and/or the ASA ikev2 config.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.