I'm trying to configure a elementary OS Hera client to connect to an existing VPN using IKEv2 EAP - but I can't get it working.
Can anyone tell me what's wrong?
Here's what I did:
- Open AppCenter and install "strongSwan VPN client"
- Open "System Settings > Network > VPN"
- Add a new VPN connection by tapping on "+"
- Select "IPSEC/IKEv2 (Strongswan)"
- Hit "Create..."
- Enter the following information:
- Address: my.domain.tld
- Certificate: /path/to/my/certificate.pem
- Authentication: EAP
- Username: my-username
- Hit "Save"
Open a Terminal and execute tail -f /var/log/syslog - then Hit "Connect" for the newly created VPN connection - enter the user password when prompted (FWIW: I double checked the users password, it's correct). The Terminal prints the following:
Jan 14 11:34:49 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:49 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:49 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
Jan 14 11:34:51 MyMachine NetworkManager[959]: <info> [1578998091.8162] audit: op="connection-activate" uuid="93ddc7bd-20e3-407e-8161-c1df393d30ab" name="my.domain.tld" pid=11945 uid=1001 result="success"
Jan 14 11:34:51 MyMachine NetworkManager[959]: <info> [1578998091.8315] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: Saw the service appear; activating connection
Jan 14 11:34:51 MyMachine wingpanel[2354]: VpnMenuItem.vala:93: An VPN is being connected but not active.
Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:51 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:51 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
Jan 14 11:34:51 MyMachine nm-strongswan-a[12100]: GtkDialog mapped without a transient parent. This is discouraged.
Jan 14 11:34:55 MyMachine NetworkManager[959]: <info> [1578998095.1872] settings-connection[0x55c9a7ef5990,93ddc7bd-20e3-407e-8161-c1df393d30ab]: write: successfully updated (keyfile: update /etc/NetworkManager/system-connections/my.domain.tld (93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld")), connection was modified in the process
Jan 14 11:34:55 MyMachine wingpanel[2354]: VpnMenuItem.vala:93: An VPN is being connected but not active.
Jan 14 11:34:55 MyMachine NetworkManager[959]: <info> [1578998095.1950] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN connection: (ConnectInteractive) reply received
Jan 14 11:34:55 MyMachine charon-nm: 05[CFG] received initiate for NetworkManager connection my.domain.tld
Jan 14 11:34:55 MyMachine charon-nm: 05[CFG] using CA certificate, gateway identity 'my.domain.tld'
Jan 14 11:34:55 MyMachine charon-nm: 05[IKE] initiating IKE_SA my.domain.tld[12] to 123.231.132.123
Jan 14 11:34:55 MyMachine charon-nm: 05[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Jan 14 11:34:55 MyMachine charon-nm: 05[NET] sending packet: from 118.181.10.18[41265] to 123.231.132.123[500] (1116 bytes)
Jan 14 11:34:55 MyMachine NetworkManager[959]: <info> [1578998095.1973] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: state changed: starting (3)
Jan 14 11:34:55 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:55 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:55 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
Jan 14 11:34:55 MyMachine charon-nm: 12[NET] received packet: from 123.231.132.123[500] to 118.181.10.18[41265] (38 bytes)
Jan 14 11:34:55 MyMachine charon-nm: 12[ENC] parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]
Jan 14 11:34:55 MyMachine charon-nm: 12[IKE] peer didn't accept DH group ECP_256, it requested MODP_2048
Jan 14 11:34:55 MyMachine charon-nm: 12[IKE] initiating IKE_SA my.domain.tld[12] to 123.231.132.123
Jan 14 11:34:55 MyMachine charon-nm: 12[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Jan 14 11:34:55 MyMachine charon-nm: 12[NET] sending packet: from 118.181.10.18[41265] to 123.231.132.123[500] (1308 bytes)
Jan 14 11:34:56 MyMachine charon-nm: 08[NET] received packet: from 123.231.132.123[500] to 118.181.10.18[41265] (681 bytes)
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HTTP_CERT_LOOK) CERTREQ V V V ]
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] received unknown vendor ID: f7:58:f2:26:68:75:0f:03:b0:8d:f6:eb:e1:d0:04:03
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] received unknown vendor ID: f9:19:6d:f8:6b:81:2f:b0:f6:80:26:d8:87:6d:cb:7b:00:04:32:00
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] received unknown vendor ID: ac:40:f8:c4:38:99:27:c6:e8:ac:24:53:1b:b7:8b:2b:a1:ba:53:43:94:cc:20:8c:04:0d:fe:24:b7:99:7d:2b:73:61:0a:33:bd:6f:7b:4f:6f:1f:9c:06:45:24:83:ae:9b:a5:0b:ad:84:fd:f0:dd:3b:f4:19:c5:6c:54:cb:ba:d3:fa:8a:ad:9f:e8:40:a7:bd:4f:47:41:23:d7:22:e3:9e:16:b1:04:31:f9:ad:24:bf:60:ac:32:40:09:d5:41:58:4a:6b:a5:ce:1c:50:69:be:e8:92:49:56:37:48:d2:0e:f0:ef:89:df:2a:5f:49:1c:29:41:8a:b6:f2:e9:be
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] local host is behind NAT, sending keep alives
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] received cert request for "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] received 2 cert requests for an unknown ca
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] sending cert request for "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] establishing CHILD_SA my.domain.tld{12}
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
Jan 14 11:34:56 MyMachine charon-nm: 08[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (304 bytes)
Jan 14 11:34:58 MyMachine charon-nm: 09[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (1408 bytes)
Jan 14 11:34:58 MyMachine charon-nm: 09[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
Jan 14 11:34:58 MyMachine charon-nm: 09[IKE] received end entity cert "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
Jan 14 11:34:58 MyMachine charon-nm: 09[CFG] using trusted certificate "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
Jan 14 11:34:58 MyMachine charon-nm: 09[IKE] authentication of 'my.domain.tld' with RSA signature successful
Jan 14 11:34:58 MyMachine charon-nm: 09[IKE] server requested EAP_IDENTITY (id 0x2A), sending 'my-username'
Jan 14 11:34:58 MyMachine charon-nm: 09[ENC] generating IKE_AUTH request 2 [ EAP/RES/ID ]
Jan 14 11:34:58 MyMachine charon-nm: 09[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (80 bytes)
Jan 14 11:34:58 MyMachine charon-nm: 15[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (80 bytes)
Jan 14 11:34:58 MyMachine charon-nm: 15[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/PEAP ]
Jan 14 11:34:58 MyMachine charon-nm: 15[IKE] server requested EAP_PEAP authentication (id 0x2B)
Jan 14 11:34:58 MyMachine charon-nm: 15[TLS] EAP_PEAP version is v0
Jan 14 11:34:58 MyMachine charon-nm: 15[ENC] generating IKE_AUTH request 3 [ EAP/RES/PEAP ]
Jan 14 11:34:58 MyMachine charon-nm: 15[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (272 bytes)
Jan 14 11:34:59 MyMachine charon-nm: 11[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (1104 bytes)
Jan 14 11:34:59 MyMachine charon-nm: 11[ENC] parsed IKE_AUTH response 3 [ EAP/REQ/PEAP ]
Jan 14 11:34:59 MyMachine charon-nm: 11[TLS] negotiated TLS 1.0 using suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
Jan 14 11:34:59 MyMachine charon-nm: 11[TLS] server certificate does not match to 'my.domain.tld'
Jan 14 11:34:59 MyMachine charon-nm: 11[TLS] sending fatal TLS alert 'access denied'
Jan 14 11:34:59 MyMachine charon-nm: 11[ENC] generating IKE_AUTH request 4 [ EAP/RES/PEAP ]
Jan 14 11:34:59 MyMachine charon-nm: 11[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (96 bytes)
Jan 14 11:34:59 MyMachine charon-nm: 10[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (80 bytes)
Jan 14 11:34:59 MyMachine charon-nm: 10[ENC] parsed IKE_AUTH response 4 [ EAP/FAIL ]
Jan 14 11:34:59 MyMachine charon-nm: 10[IKE] received EAP_FAILURE, EAP authentication failed
Jan 14 11:34:59 MyMachine charon-nm: 10[ENC] generating INFORMATIONAL request 5 [ N(AUTH_FAILED) ]
Jan 14 11:34:59 MyMachine charon-nm: 10[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (80 bytes)
Jan 14 11:34:59 MyMachine NetworkManager[959]: <warn> [1578998099.1459] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: failed: connect-failed (1)
Jan 14 11:34:59 MyMachine NetworkManager[959]: <warn> [1578998099.1460] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: failed: connect-failed (1)
Jan 14 11:34:59 MyMachine NetworkManager[959]: <info> [1578998099.1463] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: state changed: stopping (5)
Jan 14 11:34:59 MyMachine NetworkManager[959]: <info> [1578998099.1465] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: state changed: stopped (6)
Jan 14 11:34:59 MyMachine wingpanel[2354]: VpnMenuItem.vala:93: An VPN is being connected but not active.
Jan 14 11:34:59 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:59 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:59 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
While in the router I can see the following log output:
