1

I'm trying to configure a elementary OS Hera client to connect to an existing VPN using IKEv2 EAP - but I can't get it working.

Can anyone tell me what's wrong? (see UPDATE I below for further information on the cert and how I imported it on the client side and UPDATE II for a working Windows setup)

Here's what I did:

  1. Open AppCenter and install "strongSwan VPN client"
  2. Open "System Settings > Network > VPN"
  3. Add a new VPN connection by tapping on "+"
  4. Select "IPSEC/IKEv2 (Strongswan)"
  5. Hit "Create..."
  6. Enter the following information:
  7. Address: my.domain.tld
  8. Certificate: /path/to/my/certificate.pem
  9. Authentication: EAP
  10. Username: my-username
  11. Hit "Save"

Open a Terminal and execute tail -f /var/log/syslog - then Hit "Connect" for the newly created VPN connection - enter the user password when prompted (FWIW: I double checked the users password, it's correct). The Terminal prints the following:

Jan 14 11:34:49 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:49 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:49 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
Jan 14 11:34:51 MyMachine NetworkManager[959]: <info>  [1578998091.8162] audit: op="connection-activate" uuid="93ddc7bd-20e3-407e-8161-c1df393d30ab" name="my.domain.tld" pid=11945 uid=1001 result="success"
Jan 14 11:34:51 MyMachine NetworkManager[959]: <info>  [1578998091.8315] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: Saw the service appear; activating connection
Jan 14 11:34:51 MyMachine wingpanel[2354]: VpnMenuItem.vala:93: An VPN is being connected but not active.
Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:51 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:51 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
Jan 14 11:34:51 MyMachine nm-strongswan-a[12100]: GtkDialog mapped without a transient parent. This is discouraged.
Jan 14 11:34:55 MyMachine NetworkManager[959]: <info>  [1578998095.1872] settings-connection[0x55c9a7ef5990,93ddc7bd-20e3-407e-8161-c1df393d30ab]: write: successfully updated (keyfile: update /etc/NetworkManager/system-connections/my.domain.tld (93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld")), connection was modified in the process
Jan 14 11:34:55 MyMachine wingpanel[2354]: VpnMenuItem.vala:93: An VPN is being connected but not active.
Jan 14 11:34:55 MyMachine NetworkManager[959]: <info>  [1578998095.1950] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN connection: (ConnectInteractive) reply received
Jan 14 11:34:55 MyMachine charon-nm: 05[CFG] received initiate for NetworkManager connection my.domain.tld
Jan 14 11:34:55 MyMachine charon-nm: 05[CFG] using CA certificate, gateway identity 'my.domain.tld'
Jan 14 11:34:55 MyMachine charon-nm: 05[IKE] initiating IKE_SA my.domain.tld[12] to 123.231.132.123
Jan 14 11:34:55 MyMachine charon-nm: 05[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Jan 14 11:34:55 MyMachine charon-nm: 05[NET] sending packet: from 118.181.10.18[41265] to 123.231.132.123[500] (1116 bytes)
Jan 14 11:34:55 MyMachine NetworkManager[959]: <info>  [1578998095.1973] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: state changed: starting (3)
Jan 14 11:34:55 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:55 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:55 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
Jan 14 11:34:55 MyMachine charon-nm: 12[NET] received packet: from 123.231.132.123[500] to 118.181.10.18[41265] (38 bytes)
Jan 14 11:34:55 MyMachine charon-nm: 12[ENC] parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]
Jan 14 11:34:55 MyMachine charon-nm: 12[IKE] peer didn't accept DH group ECP_256, it requested MODP_2048
Jan 14 11:34:55 MyMachine charon-nm: 12[IKE] initiating IKE_SA my.domain.tld[12] to 123.231.132.123
Jan 14 11:34:55 MyMachine charon-nm: 12[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Jan 14 11:34:55 MyMachine charon-nm: 12[NET] sending packet: from 118.181.10.18[41265] to 123.231.132.123[500] (1308 bytes)
Jan 14 11:34:56 MyMachine charon-nm: 08[NET] received packet: from 123.231.132.123[500] to 118.181.10.18[41265] (681 bytes)
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HTTP_CERT_LOOK) CERTREQ V V V ]
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] received unknown vendor ID: f7:58:f2:26:68:75:0f:03:b0:8d:f6:eb:e1:d0:04:03
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] received unknown vendor ID: f9:19:6d:f8:6b:81:2f:b0:f6:80:26:d8:87:6d:cb:7b:00:04:32:00
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] received unknown vendor ID: ac:40:f8:c4:38:99:27:c6:e8:ac:24:53:1b:b7:8b:2b:a1:ba:53:43:94:cc:20:8c:04:0d:fe:24:b7:99:7d:2b:73:61:0a:33:bd:6f:7b:4f:6f:1f:9c:06:45:24:83:ae:9b:a5:0b:ad:84:fd:f0:dd:3b:f4:19:c5:6c:54:cb:ba:d3:fa:8a:ad:9f:e8:40:a7:bd:4f:47:41:23:d7:22:e3:9e:16:b1:04:31:f9:ad:24:bf:60:ac:32:40:09:d5:41:58:4a:6b:a5:ce:1c:50:69:be:e8:92:49:56:37:48:d2:0e:f0:ef:89:df:2a:5f:49:1c:29:41:8a:b6:f2:e9:be
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] local host is behind NAT, sending keep alives
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] received cert request for "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] received 2 cert requests for an unknown ca
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] sending cert request for "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] establishing CHILD_SA my.domain.tld{12}
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
Jan 14 11:34:56 MyMachine charon-nm: 08[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (304 bytes)
Jan 14 11:34:58 MyMachine charon-nm: 09[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (1408 bytes)
Jan 14 11:34:58 MyMachine charon-nm: 09[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
Jan 14 11:34:58 MyMachine charon-nm: 09[IKE] received end entity cert "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
Jan 14 11:34:58 MyMachine charon-nm: 09[CFG]   using trusted certificate "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
Jan 14 11:34:58 MyMachine charon-nm: 09[IKE] authentication of 'my.domain.tld' with RSA signature successful
Jan 14 11:34:58 MyMachine charon-nm: 09[IKE] server requested EAP_IDENTITY (id 0x2A), sending 'my-username'
Jan 14 11:34:58 MyMachine charon-nm: 09[ENC] generating IKE_AUTH request 2 [ EAP/RES/ID ]
Jan 14 11:34:58 MyMachine charon-nm: 09[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (80 bytes)
Jan 14 11:34:58 MyMachine charon-nm: 15[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (80 bytes)
Jan 14 11:34:58 MyMachine charon-nm: 15[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/PEAP ]
Jan 14 11:34:58 MyMachine charon-nm: 15[IKE] server requested EAP_PEAP authentication (id 0x2B)
Jan 14 11:34:58 MyMachine charon-nm: 15[TLS] EAP_PEAP version is v0
Jan 14 11:34:58 MyMachine charon-nm: 15[ENC] generating IKE_AUTH request 3 [ EAP/RES/PEAP ]
Jan 14 11:34:58 MyMachine charon-nm: 15[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (272 bytes)
Jan 14 11:34:59 MyMachine charon-nm: 11[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (1104 bytes)
Jan 14 11:34:59 MyMachine charon-nm: 11[ENC] parsed IKE_AUTH response 3 [ EAP/REQ/PEAP ]
Jan 14 11:34:59 MyMachine charon-nm: 11[TLS] negotiated TLS 1.0 using suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
Jan 14 11:34:59 MyMachine charon-nm: 11[TLS] server certificate does not match to 'my.domain.tld'
Jan 14 11:34:59 MyMachine charon-nm: 11[TLS] sending fatal TLS alert 'access denied'
Jan 14 11:34:59 MyMachine charon-nm: 11[ENC] generating IKE_AUTH request 4 [ EAP/RES/PEAP ]
Jan 14 11:34:59 MyMachine charon-nm: 11[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (96 bytes)
Jan 14 11:34:59 MyMachine charon-nm: 10[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (80 bytes)
Jan 14 11:34:59 MyMachine charon-nm: 10[ENC] parsed IKE_AUTH response 4 [ EAP/FAIL ]
Jan 14 11:34:59 MyMachine charon-nm: 10[IKE] received EAP_FAILURE, EAP authentication failed
Jan 14 11:34:59 MyMachine charon-nm: 10[ENC] generating INFORMATIONAL request 5 [ N(AUTH_FAILED) ]
Jan 14 11:34:59 MyMachine charon-nm: 10[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (80 bytes)
Jan 14 11:34:59 MyMachine NetworkManager[959]: <warn>  [1578998099.1459] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: failed: connect-failed (1)
Jan 14 11:34:59 MyMachine NetworkManager[959]: <warn>  [1578998099.1460] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: failed: connect-failed (1)
Jan 14 11:34:59 MyMachine NetworkManager[959]: <info>  [1578998099.1463] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: state changed: stopping (5)
Jan 14 11:34:59 MyMachine NetworkManager[959]: <info>  [1578998099.1465] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: state changed: stopped (6)
Jan 14 11:34:59 MyMachine wingpanel[2354]: VpnMenuItem.vala:93: An VPN is being connected but not active.
Jan 14 11:34:59 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:59 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:59 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent

While in the router I can see the following log output:

enter image description here

UPDATE I: The following screenshot shows how the certifacte on the Zyxel USG is setup. All blackened parts are set to my.domain.tld. As you can see there, it seems the Subject Alternative Name of the certificate is set correctly (means: it is equal to the FQDN of the Zyxel device which serves the VPN connection and I'm trying to connect to):

enter image description here

I downloaded this cert and imported it on the client side with the following commands:

sudo cp ~/Downloads/VPN_my.domain.tld.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

And then in Network Manager I selected the generated /etc/ssl/certs/VPN_my.domain.tld.pem.

UPDATE II: In Windows I'm able to connect to the VPN with the following VPN-Adapter Settings (same certificate imported in machine-wide "Trusted Root Certificate Authorities"):

  1. Navigate to Control Center > Network and Internet > Network and Share Center
  2. Click Adapter Settings
  3. Right click on > Properties

  4. Security:

    • VPN Type: IKEv2
    • Encryption: Required
    • Authentication: ✓ Use Extensible-Authentication-Protocol (EAP): Microsoft: Secured Password (EAP-MSCHAP v2)(Encryption enabled)
Improve this question
3
  • That's not the correct way to install that certificate because it's not a CA certificate (and strongSwan's charon/charon-systemd daemons don't load CA certs from there anyway). And that certificate is most likely not the one that's sent during EAP-PEAP but the one used during IKEv2 (which is fine according to the log). Anyway, you can try to configure the AAA identity (connections.<conn>.local<suffix>.aaa_id in swanctl.conf) so it matches the identity in the certificate sent by the AAA server during EAP-PEAP.
    – ecdsa
    Commented Jan 17, 2020 at 15:16
  • I don't get it. I don't understand how the vpn connection process is supposed to work and which parts are involved, once setup correctly. I installed strongswan-swanctl and set the aaa_id in swanctl.conf like this: connections { my.domain.tld { local { aaa_id = "my.domain.tld" } } } and then again tried to connect via the configured connection in NetworkManager. Still same issue.
    – Marco Betschart
    Commented Jan 20, 2020 at 9:56
  • That's because that's the identity that's already used and doesn't work. You have to configure an actual identity of that AAA certificate (full subject distinguished name or one of the subjectAltNames). Unfortunately, there is no log message that prints the subject DN or any other identity of the received certificate (unless it's accepted). So you'd have to either modify the source and add one, or contact the AAA server admin for information about the certificate. I'm not sure if using aaa_id=%any works, but you could try that and then configure the logged identity afterwards.
    – ecdsa
    Commented Jan 20, 2020 at 16:43

1 Answer 1

Reset to default
0

According to the log, the server requests EAP-PEAP, however, the certificate it uses for that doesn't contain the hostname configured on the client (which it enforces):

Jan 14 11:34:59 MyMachine charon-nm: 11[TLS] server certificate does not match to 'my.domain.tld'

With strongSwan's NM client you currently can't configure the AAA identity to a value different from the IKE identity, so this only works if the hostname is contained in that certificate as subjectAltName extension.

So either modify the certificate (or use a different one, that for IKE seems to include the hostname), disable EAP-PEAP (you could try to do so only on the client by disabling the plugin, but whether that works depends on the server configuration), or don't use the NM frontend and configure strongSwan via config file where the AAA identity can be set explicitly.

Improve this answer
4
  • thanks for the hint! Seems don't using the NM frontend is the way to go. Can you please elaborate a bit more how to configure strongSwan via config file? What I found online seems not point to /etc/ipsec.conf and/or /etc/ipsed.d - but I don't have these. I do have however /etc/strongswan.d...
    – Marco Betschart
    Commented Jan 16, 2020 at 10:32
  • You might not have the necessary packages installed yet (see my answer here for some pointers).
    – ecdsa
    Commented Jan 16, 2020 at 14:11
  • Sorry to bother you again, but any chance you can provide a sample config of the given scenario? Can be pseudo-config - just enough to get me started. I read your link and installed strongswan-swanctl, charon-systemd as well as charon-cmd. Then I tried to configure swanctl and played around with different options for charon-cmd. In both cases I wasn't able to get rid of the server certificate does not match to 'my.domain.tld' error message.
    – Marco Betschart
    Commented Jan 17, 2020 at 7:00
  • FYI: I added some more information of the cert and how I imported it on the client side. Hope this helps to narrow this issue down.
    – Marco Betschart
    Commented Jan 17, 2020 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.