Score:0

Strongswan ike phase 1 failed: "IKE_SA being deleted"

sm flag

I'm trying to build IPsec tunnel between my Strongswan cloud instance to the Cisco CSR 1000V which is from ISP.

According to the form given to me, I have to configure with the following factors in mind Phase 1 Authentication Method: PSK Encryption Scheme: IKEv1 DH Group: Group 2 Encryption Algorithm: AES-256 Hashing Algorithm: SHA1 Main or Aggressive: Main Lifetime for renegotiation: 28800

Phase 2 ESP/AH: ESP Encryption: AES-256 Authentication Algorithm: SHA1 PFS: Group 2(no PFS) Lifetime (for renegotiation): 3600 Lifesize in KB(for renegotiation): Not used

This is my ipsec.conf file config

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration
config setup
#       strictcrlpolicy=yes
        charondebug="ike 1, knl 1, cfg 0"
        uniqueids=no
# Add connections here.

# Sample VPN connections
conn c2c-vpn
        type=tunnel
        keyexchange=ikev1
        left=X.X.X.X
        leftid=X.X.X.X 
        leftsubnet=172.31.8.0/24
        leftauth=secret
        leftfirewall=no
        right=Y.Y.Y.Y
        rightid=Y.Y.Y.Y
        rightsubnet=10.0.0.0/16
        rightauth=secret
        rightfirewall=yes
        ike=aes256-sha1-modp1024!
        esp=aes256-sha1
        aggressive=no
        fragmentation=yes
        ikelifetime=288000s
        lifetime=3600s
        keyingtries=%forever
        dpddelay=30s
        dpdtimeout=120s
        dpdaction=restart
        auto=start

X.X.X.X would be my side public ip and Y.Y.Y.Y would be the other side public IP (I'm aware that the keys I'm using are weak. But for now, I just want the tunnel to be up.)

This is my ipsec.secrets

X.X.X.X Y.Y.Y.Y : PSK "<MyPSK>"

I'm not sure it's important but this is strongswan.conf

charon {
        load_modular = yes
        plugins {
                include strongswan.d/charon/*.conf
        }
       max_ikev1_exchanges=100
}

And this is the corresponding log from charon after I restarted ipsec

Jul 04 17:23:49 uvmuk charon[14906]: 00[LIB] dropped capabilities, running as uid 0, gid 0
Jul 04 17:23:49 uvmuk charon[14906]: 00[JOB] spawning 16 worker threads
Jul 04 17:23:49 uvmuk ipsec_starter[14905]: charon (14906) started after 40 ms
Jul 04 17:23:49 uvmuk charon[14906]: 07[IKE] initiating Main Mode IKE_SA mpt-to-melo-vpn[1] to Y.Y.Y.Y
Jul 04 17:23:49 uvmuk charon[14906]: 07[IKE] initiating Main Mode IKE_SA mpt-to-melo-vpn[1] to Y.Y.Y.Y
Jul 04 17:23:49 uvmuk charon[14906]: 07[ENC] generating ID_PROT request 0 [ SA V V V V V ]
Jul 04 17:23:49 uvmuk charon[14906]: 07[NET] sending packet: from X.X.X.X[500] to Y.Y.Y.Y[500] (184 bytes)
Jul 04 17:23:49 uvmuk charon[14906]: 09[NET] received packet: from Y.Y.Y.Y[500] to X.X.X.X[500] (108 bytes)
Jul 04 17:23:49 uvmuk charon[14906]: 09[ENC] parsed ID_PROT response 0 [ SA V ]
Jul 04 17:23:49 uvmuk charon[14906]: 09[IKE] received NAT-T (RFC 3947) vendor ID
Jul 04 17:23:49 uvmuk charon[14906]: 09[ENC] generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
Jul 04 17:23:49 uvmuk charon[14906]: 09[NET] sending packet: from X.X.X.X[500] to Y.Y.Y.Y[500] (244 bytes)
Jul 04 17:23:49 uvmuk charon[14906]: 10[NET] received packet: from Y.Y.Y.Y[500] to X.X.X.X[500] (304 bytes)
Jul 04 17:23:49 uvmuk charon[14906]: 10[ENC] parsed ID_PROT response 0 [ KE No V V V V NAT-D NAT-D ]
Jul 04 17:23:49 uvmuk charon[14906]: 10[IKE] received Cisco Unity vendor ID
Jul 04 17:23:49 uvmuk charon[14906]: 10[IKE] received DPD vendor ID
Jul 04 17:23:49 uvmuk charon[14906]: 10[ENC] received unknown vendor ID: 41:45:bc:50:b1:fa:91:a8:72:57:6f:4e:4e:e2:17:29
Jul 04 17:23:49 uvmuk charon[14906]: 10[IKE] received XAuth vendor ID
Jul 04 17:23:49 uvmuk charon[14906]: 10[IKE] remote host is behind NAT
Jul 04 17:23:49 uvmuk charon[14906]: 10[ENC] generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
Jul 04 17:23:49 uvmuk charon[14906]: 10[NET] sending packet: from X.X.X.X[4500] to Y.Y.Y.Y[4500] (108 bytes)
Jul 04 17:23:49 uvmuk charon[14906]: 11[NET] received packet: from Y.Y.Y.Y[4500] to X.X.X.X[4500] (92 bytes)
Jul 04 17:23:49 uvmuk charon[14906]: 11[ENC] invalid HASH_V1 payload length, decryption failed?
Jul 04 17:23:49 uvmuk charon[14906]: 11[ENC] could not decrypt payloads
Jul 04 17:23:49 uvmuk charon[14906]: 11[IKE] message parsing failed
Jul 04 17:23:49 uvmuk charon[14906]: 11[IKE] ignore malformed INFORMATIONAL request
Jul 04 17:23:49 uvmuk charon[14906]: 11[IKE] INFORMATIONAL_V1 request with message ID 4053640584 processing failed
Jul 04 17:23:49 uvmuk charon[14906]: 12[NET] received packet: from Y.Y.Y.Y[4500] to X.X.X.X[4500] (76 bytes)
Jul 04 17:23:49 uvmuk charon[14906]: 12[ENC] parsed ID_PROT response 0 [ ID HASH ]
Jul 04 17:23:49 uvmuk charon[14906]: 12[IKE] IDir '10.0.1.189' does not match to 'Y.Y.Y.Y'
Jul 04 17:23:49 uvmuk charon[14906]: 12[IKE] deleting IKE_SA c2c-vpn[1] between X.X.X.X[X.X.X.X]...Y.Y.Y.Y[%any]
Jul 04 17:23:49 uvmuk charon[14906]: 12[IKE] deleting IKE_SA c2c-vpn[1] between X.X.X.X[X.X.X.X]...Y.Y.Y.Y[%any]
Jul 04 17:23:49 uvmuk charon[14906]: 12[IKE] sending DELETE for IKE_SA c2c-vpn[1]
Jul 04 17:23:49 uvmuk charon[14906]: 12[ENC] generating INFORMATIONAL_V1 request 4232678559 [ HASH D ]
Jul 04 17:23:49 uvmuk charon[14906]: 12[NET] sending packet: from X.X.X.X[4500] to Y.Y.Y.Y[4500] (92 bytes)

I'm relatively new with strongswan and IPsec configurations in general but I'm sure the phase 1 tunnel isn't established because of "deleting IKE_SA" line. I've tried to find solutions from multiple forums already, hoping someone had the same problem as me but I'm stuck. Help.

Score:0
za flag

The piece

Jul 04 17:23:49 uvmuk charon[14906]: 11[ENC] invalid HASH_V1 payload length, decryption failed?
Jul 04 17:23:49 uvmuk charon[14906]: 11[ENC] could not decrypt payloads
Jul 04 17:23:49 uvmuk charon[14906]: 11[IKE] message parsing failed
Jul 04 17:23:49 uvmuk charon[14906]: 11[IKE] ignore malformed INFORMATIONAL request

clearly indicates that something has gone wrong. With 95% probability chance the PSK on bothe end is not the same (decryption failed, could not decrypt payloads).

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.