☰

Actualizar

tag-icon • tag-icon vpn ipsec openswan
Actualizar

Intento configurar una conexión VPN a Office Fortigate pero no puedo pasar la fase 2.

Información recibida de los administradores de sistemas:

  • PSK
  • IKE v1

  • Modo agresivo

  • Fase1 3DES-SHA1

  • HD grupo 5

  • Vida útil de la clave 28800

  • Servidor XAUTH PAP (no estoy seguro si es necesario saberlo)

  • Fase2 3DES-SHA1

  • SLP no

Este es uno de muchos intentos de configuración. He intentado agregar/eliminar diferentes parámetros.

config setup
interfaces=%defaultroute
plutodebug="control parsing"
plutoopts="--interface=wlan0"
dumpdir=/var/run/pluto/
nat_traversal=no
virtual_private=%v4:
10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
oe=off
protostack=netkey

conn office
left=%defaultroute
right=<my gateway ip>

phase2=ah
phase2alg=sha1;modp1536
type=transport
authby=secret
pfs=no
compress=no
   keyingtries=%forever

La salida

?  /etc  sudo service ipsec restart
?  /etc  sudo ipsec auto --add office && sudo ipsec auto --up office
104 "office" #1: STATE_MAIN_I1: initiate
003 "office" #1: received Vendor ID payload [Dead Peer Detection]
003 "office" #1: ignoring unknown Vendor ID payload
[8299031757a36082c6a621de00050282]
106 "office" #1: STATE_MAIN_I2: sent MI2, expecting MR2
108 "office" #1: STATE_MAIN_I3: sent MI3, expecting MR3
003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3
010 "office" #1: STATE_MAIN_I3: retransmission; will wait 20s for response
003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3
010 "office" #1: STATE_MAIN_I3: retransmission; will wait 40s for response
031 "office" #1: max number of retransmissions (2) reached STATE_MAIN_I3.
Possible authentication failure: no acceptable response to our first
encrypted message
000 "office" #1: starting keying attempt 2 of an unlimited number, but
releasing whack

Actualizar

Agregué el modo agresivo en mi configuración y obtuve un error sobre información hash no válida, ¿por qué? ¿No están configurados correctamente los parámetros?

conn office 
    aggrmode=yes
     left=%defaultroute
     right=<vpn gateway>
     phase2=ah
     phase2alg=sha1;modp1536
     type=transport
     ike=3des-sha1;modp1536

     authby=secret
     #esp=3des;modp1536
     pfs=no
     compress=no
     keyingtries=%forever

Producción

➜  /etc  sudo ipsec auto --up office 
112 "office" #1: STATE_AGGR_I1: initiate
003 "office" #1: received Vendor ID payload [Dead Peer Detection]
003 "office" #1: received Vendor ID payload [XAUTH]
003 "office" #1: ignoring unknown Vendor ID payload [8299031757a36082c6a621de00050282]
003 "office" #1: received Hash Payload does not match computed value
223 "office" #1: STATE_AGGR_I1: INVALID_HASH_INFORMATION

ipsec automático --estado

000 "office":     myip=unset; hisip=unset;
000 "office":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "office":   policy: PSK+AUTHENTICATE+UP+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 32,24; interface: wlan0; 
000 "office":   newest ISAKMP SA: #0; newest IPsec SA: #0; 
000 "office":   IKE algorithms wanted: 3DES_CBC(5)_000-SHA1(2)_000-MODP1536(5); flags=-strict
000 "office":   IKE algorithms found:  3DES_CBC(5)_192-SHA1(2)_160-MODP1536(5)
000 "office":   AH algorithms wanted: SHA1(2)_000; pfsgroup=MODP1536(5); flags=-strict
000 "office":   AH algorithms loaded: SHA1(2)_160
000  
000 #3: "office":500 STATE_AGGR_I1 (sent AI1, expecting AR1); none in -1s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate
000 #3: pending Phase 2 for "office" replacing #0

Actualización 2

Se las arregló para pasar la fase 1. El análisis de los registros del firewall mostró que el túnel establecido era diferente al esperado y tenía un PSK diferente.

Ahora errores de negociación de fase 2. Sin embargo, el administrador del sistema dice que requiere un usuario para la fase 2, ¿no está seguro de cómo especificaría eso?

➜  /etc  sudo ipsec auto --up office 
104 "office" #2: STATE_MAIN_I1: initiate
003 "office" #2: received Vendor ID payload [RFC 3947] method set to=109 
003 "office" #2: received Vendor ID payload [Dead Peer Detection]
003 "office" #2: ignoring unknown Vendor ID payload [8299031757a36082c6a621de00050282]
106 "office" #2: STATE_MAIN_I2: sent MI2, expecting MR2
003 "office" #2: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): i am NATed
108 "office" #2: STATE_MAIN_I3: sent MI3, expecting MR3
004 "office" #2: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1024}
117 "office" #3: STATE_QUICK_I1: initiate
010 "office" #3: STATE_QUICK_I1: retransmission; will wait 20s for response
010 "office" #3: STATE_QUICK_I1: retransmission; will wait 40s for response
031 "office" #3: max number of retransmissions (2) reached STATE_QUICK_I1.  No acceptable response to our first Quick Mode message: perhaps peer likes no proposal
000 "office" #3: starting keying attempt 2 of an unlimited number, but releasing whack

Respuesta1

Sin registros del receptor (Fortigate) es difícil dar una respuesta definitiva.

Comencemos con lo obvio: reconfigure su VPN enmain mode(no aggressive mode) y cambiar el tipo de transportatunnel.

Vuelva a intentar la conexión y, si es posible, proporciónenos los registros de Fortigate.

información relacionada