Добрый день.
Раньше использовал racoon + l2tpd и всё работало прекрасно, то тут потребовалась поддержка IKE2 и поставил strongswan И имею ряд проблем, а имеено:
- одновременно l2tp и ike2 не удаётся заставить работать
- проблемы policy based routing на клиенте
конфиг ipsec.conf
conn rw-base fragmentation=yes dpdaction=clear dpdtimeout=90s dpddelay=30s left=%any4 right=%any4 reauth=no rekey=no ike=aes256-sha1-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024! esp=aes256-sha256,aes256-sha1,3des-sha1!
conn ikev1-l2tp-chap-auth-in-l2tp also=rw-base auto=add type=transport leftprotoport=17/1701 rightprotoport=17/%any leftsubnet=%dynamic[/1701] rightsubnet=%dynamic mark=%unique leftauth=psk rightauth=psk
conn ikev2-eap-mschapv2 also=rw-base auto=add keyexchange=ikev2 mark=42 leftid=@ leftauth=pubkey leftcert=.crt leftsendcert=always leftsubnet=0.0.0.0/0 leftfirewall=no leftupdown=/etc/ipsec.d/leftupdown.sh rightid=%any rightauth=eap-mschapv2 rightsendcert=never rightsourceip=%dhcp rightdns=10.10.10.10 eap_identity=%identity
ipsec.secrets такой
%any %any : PSK «key» : RSA «.key» user : EAP «pass»
конфиг взят из офф документации на roadwarrior когда клиент подключается, то пишет такое:
: 01[NET] received packet: from <client_ip>[500] to <srv_ip>[500] (788 bytes) : 01[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V V V V ] : 01[IKE] received NAT-T (RFC 3947) vendor ID : 01[IKE] received draft-ietf-ipsec-nat-t-ike vendor ID : 01[IKE] received draft-ietf-ipsec-nat-t-ike-08 vendor ID : 01[IKE] received draft-ietf-ipsec-nat-t-ike-07 vendor ID : 01[IKE] received draft-ietf-ipsec-nat-t-ike-06 vendor ID : 01[IKE] received draft-ietf-ipsec-nat-t-ike-05 vendor ID : 01[IKE] received draft-ietf-ipsec-nat-t-ike-04 vendor ID : 01[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID : 01[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID : 01[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID : 01[IKE] received FRAGMENTATION vendor ID : 01[IKE] received DPD vendor ID : 01[IKE] <client_ip> is initiating a Main Mode IKE_SA : 01[IKE] <client_ip> is initiating a Main Mode IKE_SA : 01[ENC] generating ID_PROT response 0 [ SA V V V V ] : 01[NET] sending packet: from <srv_ip>[500] to <client_ip>[500] (160 bytes) : 15[NET] received packet: from <client_ip>[500] to <srv_ip>[500] (228 bytes) : 15[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ] : 15[IKE] remote host is behind NAT : 15[ENC] generating ID_PROT response 0 [ KE No NAT-D NAT-D ] : 15[NET] sending packet: from <srv_ip>[500] to <client_ip>[500] (244 bytes) : 16[NET] received packet: from <client_ip>[4500] to <srv_ip>[4500] (108 bytes) : 16[ENC] parsed ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ] : 16[CFG] looking for pre-shared key peer configs matching <srv_ip>…<client_ip>[<cl_local_ip>] : 16[IKE] no peer config found : 16[ENC] generating INFORMATIONAL_V1 request 2182135495 [ HASH N(AUTH_FAILED) ]
это первая проблема с l2tp
вторая проблема с роутингом через ike2 когда клиент тоже strongswan снова по офф мануале сделан leftupdown script, который поднимает vti интерфейс и потом ip r add dev vti0 маршрут появляется, если смотреть tcpdump даже видны пакеты, НО, на выходе сервера их нет!
