<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
-->
</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap: break-word;
-webkit-nbsp-mode: space;-webkit-line-break: after-white-space">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Hi Paul,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Can you turn on Pluto logging if you are using iKEv1 and charon logging if you are using IKEv2.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Please send me the log information.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";
color:#1F497D">Swaminathan Vasudevan<br>
Systems Software Engineer (TC)<br>
<br>
<br>
HP Networking<br>
Hewlett-Packard<br>
8000 Foothills Blvd<br>
M/S 5541<br>
Roseville, CA - 95747<br>
tel: 916.785.0937<br>
fax: 916.785.1815<br>
email: swaminathan.vasudevan@hp.com</span><span style="font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Paul Michali [mailto:pcm@cisco.com]
<br>
<b>Sent:</b> Tuesday, May 14, 2013 6:50 PM<br>
<b>To:</b> Nachi Ueno; Vasudevan, Swaminathan (PNB Roseville)<br>
<b>Cc:</b> OpenStack Development Mailing List<br>
<b>Subject:</b> VPNaaS strongswan questions...<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi guys… very slow process here…<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I finally was able to get four VMs running in Virtual box, with a topology and config set up like this:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="http://www.strongswan.org/uml/testresults/ikev2/net2net-psk/">http://www.strongswan.org/uml/testresults/ikev2/net2net-psk/</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Only difference is that I have a NAT I/F (to do S/W installs), which shows as eth0.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I restarted ipsec service on each GW. On <b>moon, </b> it indicated that the pkcs11 plugging failed to load (thinking that is OK, as not using smart cards). On
<b>sun</b>, it indicated that the socket-default plugin failed to load. Though, I did the restart again and now it only mentions the pkcs11 plugin.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I tried <b>ipsec start</b> on each GW. On <b>sun,</b> I see:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">!! Your strongswan.conf contains manual plugin load options for<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">!! pluto and/or charon. This is recommended for experts only, see<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">!! <a href="http://wiki.strongswan.org/projects/strongswan/wiki/PluginLoad">
http://wiki.strongswan.org/projects/strongswan/wiki/PluginLoad</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b>Q: Is that possibly a problem?</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I did <b>ipsec up net-net</b> on each side and I see messages of retransmitting:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">openstack@sun:/var/log$ sudo ipsec up net-net<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">initiating IKE_SA net-net[1] to 192.168.0.1<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">sending packet: from 192.168.0.2[500] to 192.168.0.1[500]<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">retransmit 1 of request with message ID 0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">sending packet: from 192.168.0.2[500] to 192.168.0.1[500]<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">retransmit 2 of request with message ID 0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">sending packet: from 192.168.0.2[500] to 192.168.0.1[500]<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If I look at status, I see that it is connecting, but not completing:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">openstack@moon:/var/log$ sudo ipsec statusall<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">000 Status of IKEv1 pluto daemon (strongSwan 4.5.2):<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">000 interface lo/lo ::1:500<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">000 interface lo/lo 127.0.0.1:500<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">000 interface eth0/eth0 10.0.2.15:500<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">000 interface eth1/eth1 10.1.0.1:500<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">000 interface eth2/eth2 192.168.0.1:500<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">000 %myid = '%any'<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">000 loaded plugins: test-vectors curl ldap aes des sha1 sha2 md5 random x509 pkcs1 pgp dnskey pem openssl gmp hmac xauth attr kernel-netlink resolve <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">000 debug options: none<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">000 <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Status of IKEv2 charon daemon (strongSwan 4.5.2):<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> uptime: 72 seconds, since May 14 21:32:21 2013<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> malloc: sbrk 270336, mmap 0, used 237648, free 32688<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> worker threads: 7 idle of 16, job queue load: 0, scheduled events: 1<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> loaded plugins: test-vectors curl ldap aes des sha1 sha2 md5 random x509 revocation constraints pubkey pkcs1 pgp pem openssl fips-prf gmp agent pkcs11 xcbc hmac ctr ccm gcm attr kernel-netlink resolve socket-raw farp stroke updown eap-identity
eap-aka eap-md5 eap-gtc eap-mschapv2 eap-radius eap-tls eap-ttls eap-tnc dhcp led addrblock <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Listening IP addresses:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 10.0.2.15<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 10.1.0.1<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 192.168.0.1<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Connections:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> net-net: 192.168.0.1...192.168.0.2<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> net-net: local: [<a href="http://moon.strongswan.org">moon.strongswan.org</a>] uses pre-shared key authentication<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> net-net: remote: [<a href="http://sun.strongswan.org">sun.strongswan.org</a>] uses any authentication<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> net-net: child: 10.1.0.0/16 === 10.2.0.0/16 <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Security Associations:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> net-net[1]: CONNECTING, 192.168.0.1[%any]...192.168.0.2[%any]<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> net-net[1]: IKE SPIs: 95f2e9c6f5315397_i* 0000000000000000_r<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> net-net[1]: Tasks active: IKE_VENDOR IKE_INIT IKE_NATD IKE_CERT_PRE IKE_AUTHENTICATE IKE_CERT_POST IKE_CONFIG CHILD_CREATE IKE_AUTH_LIFETIME <o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b>Q: Any idea why the SA is not connecting? Any debugging tips?</b> I tried tcpdump on the I/F, but see no output during the startup. Installing wireshark on one node and will see what it shows.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Goal here is to get this going and then see what the commands are to setup and start the tunnels. Then, I'd guess trying to see how that maps to the APIs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Comments/suggestions welcome!<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">PCM (Paul Michali)<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>