☰

Azurblau:

tag-icon • tag-icon ubuntu azure ipsec strongswan
Azurblau:

Ich möchte meinen Ubuntu 14.04-Server mit Strongswan mit Microsoft Azure Gateway verbinden. Ich möchte lediglich eine Verbindung zwischen Azure und diesem Ubuntu-Server herstellen. In Azure habe ich ein dynamisches Gateway konfiguriert.

Azurblau:

Virtuelles Netzwerk:

10.0.1.0/24 (gesamtes virtuelles Netzwerk)
10.0.1.0/27 (Subnetz für VM)
10.0.1.32/29 (Subnetz für Gateway)
1.1.1.1 (Gateway-IP)

Lokales Netzwerk:

10.0.2.15/32 (Netzwerk)
2.2.2.2 (Gateway-Adresse)

Ubuntu Server 14.04 mit Strongswan:

StrongSwan: Linux strongSwan U5.1.2/K3.16.0-49-generisch

Netzwerk:

10.0.2.15 (Ubuntu-Server mit Strongswan)
2.2.2.2 (Gateway mit NAT)

Konfigurationen:

/etc/ipsec.conf:

conn azure
        type=tunnel
        closeaction=restart
        dpdaction=restart
        ike=aes256-sha1-modp1024
        esp=aes256-sha1
        reauth=no
        keyexchange=ikev2
        mobike=no
        ikelifetime=28800s
        keylife=3600s
        keyingtries=%forever
        leftauth=psk
        left=10.0.2.15             # local instance ip (strongswan)
        leftsubnet=0.0.0.0/0
        leftid=10.0.2.15           # local instance ip (strongswan)
        right=1.1.1.1              # vpn gateway ip (azure)
        rightid=1.1.1.1            # vpn gateway ip (azure)
        rightsubnet=10.0.1.0/24    # private ip segment (azure)
        auto=start

/etc/ipsec.secrests:

10.0.2.15 1.1.1.1 : PSK "secret-pre-shared-key"

Syslog:

Sep 24 10:34:50 vpn-test charon: 04[CFG] received stroke: add connection 'azure'
Sep 24 10:34:50 vpn-test charon: 04[CFG] added configuration 'azure'
Sep 24 10:34:50 vpn-test charon: 06[CFG] received stroke: initiate 'azure'
Sep 24 10:34:50 vpn-test charon: 06[IKE] initiating IKE_SA azure[1] to 1.1.1.1
Sep 24 10:34:50 vpn-test charon: 06[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
Sep 24 10:34:50 vpn-test charon: 06[NET] sending packet: from 10.0.2.15[500] to 1.1.1.1[500] (1044 bytes)
Sep 24 10:34:50 vpn-test charon: 08[NET] received packet: from 1.1.1.1[500] to 10.0.2.15[500] (865 bytes)
Sep 24 10:34:50 vpn-test charon: 08[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) V V CERTREQ ]
Sep 24 10:34:50 vpn-test charon: 08[ENC] received unknown vendor ID: 2b:51:69:05:7d:7c:96:fc:bf:b5:e4:61:00:00:00
Sep 24 10:34:50 vpn-test charon: 08[ENC] received unknown vendor ID: 1d:e3:cd:b7:ea:16:b7:e5:be:08:f1
Sep 24 10:34:50 vpn-test charon: 08[IKE] local host is behind NAT, sending keep alives
Sep 24 10:34:50 vpn-test charon: 08[IKE] received 25 cert requests for an unknown ca
Sep 24 10:34:50 vpn-test charon: 08[IKE] authentication of '10.0.2.15' (myself) with pre-shared key
Sep 24 10:34:50 vpn-test charon: 08[IKE] establishing CHILD_SA azure
Sep 24 10:34:50 vpn-test charon: 08[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(EAP_ONLY) ]
Sep 24 10:34:50 vpn-test charon: 08[NET] sending packet: from 10.0.2.15[4500] to 1.1.1.1[4500] (316 bytes)
Sep 24 10:34:50 vpn-test charon: 09[NET] received packet: from 1.1.1.1[4500] to 10.0.2.15[4500] (68 bytes)
Sep 24 10:34:50 vpn-test charon: 09[ENC] parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]
Sep 24 10:34:50 vpn-test charon: 09[IKE] received AUTHENTICATION_FAILED notify error

verwandte Informationen