I'm trying to configure a elementary OS Hera client to connect to an existing VPN using IKEv2 EAP - but I can't get it working.
Can anyone tell me what's wrong? (see Update below for further information on the cert and how I imported it on the client side)
Here's what I did:
- Open AppCenter and install "strongSwan VPN client"
- Open "System Settings > Network > VPN"
- Add a new VPN connection by tapping on "+"
- Select "IPSEC/IKEv2 (Strongswan)"
- Hit "Create..."
- Enter the following information:
- Address: my.domain.tld
- Certificate: /path/to/my/certificate.pem
- Authentication: EAP
- Username: my-username
- Hit "Save"
Open a Terminal and execute tail -f /var/log/syslog - then Hit "Connect" for the newly created VPN connection - enter the user password when prompted (FWIW: I double checked the users password, it's correct). The Terminal prints the following:
Jan 14 11:34:49 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:49 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:49 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
Jan 14 11:34:51 MyMachine NetworkManager[959]: <info> [1578998091.8162] audit: op="connection-activate" uuid="93ddc7bd-20e3-407e-8161-c1df393d30ab" name="my.domain.tld" pid=11945 uid=1001 result="success"
Jan 14 11:34:51 MyMachine NetworkManager[959]: <info> [1578998091.8315] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: Saw the service appear; activating connection
Jan 14 11:34:51 MyMachine wingpanel[2354]: VpnMenuItem.vala:93: An VPN is being connected but not active.
Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:51 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:51 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
Jan 14 11:34:51 MyMachine nm-strongswan-a[12100]: GtkDialog mapped without a transient parent. This is discouraged.
Jan 14 11:34:55 MyMachine NetworkManager[959]: <info> [1578998095.1872] settings-connection[0x55c9a7ef5990,93ddc7bd-20e3-407e-8161-c1df393d30ab]: write: successfully updated (keyfile: update /etc/NetworkManager/system-connections/my.domain.tld (93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld")), connection was modified in the process
Jan 14 11:34:55 MyMachine wingpanel[2354]: VpnMenuItem.vala:93: An VPN is being connected but not active.
Jan 14 11:34:55 MyMachine NetworkManager[959]: <info> [1578998095.1950] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN connection: (ConnectInteractive) reply received
Jan 14 11:34:55 MyMachine charon-nm: 05[CFG] received initiate for NetworkManager connection my.domain.tld
Jan 14 11:34:55 MyMachine charon-nm: 05[CFG] using CA certificate, gateway identity 'my.domain.tld'
Jan 14 11:34:55 MyMachine charon-nm: 05[IKE] initiating IKE_SA my.domain.tld[12] to 123.231.132.123
Jan 14 11:34:55 MyMachine charon-nm: 05[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Jan 14 11:34:55 MyMachine charon-nm: 05[NET] sending packet: from 118.181.10.18[41265] to 123.231.132.123[500] (1116 bytes)
Jan 14 11:34:55 MyMachine NetworkManager[959]: <info> [1578998095.1973] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: state changed: starting (3)
Jan 14 11:34:55 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:55 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:55 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
Jan 14 11:34:55 MyMachine charon-nm: 12[NET] received packet: from 123.231.132.123[500] to 118.181.10.18[41265] (38 bytes)
Jan 14 11:34:55 MyMachine charon-nm: 12[ENC] parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]
Jan 14 11:34:55 MyMachine charon-nm: 12[IKE] peer didn't accept DH group ECP_256, it requested MODP_2048
Jan 14 11:34:55 MyMachine charon-nm: 12[IKE] initiating IKE_SA my.domain.tld[12] to 123.231.132.123
Jan 14 11:34:55 MyMachine charon-nm: 12[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Jan 14 11:34:55 MyMachine charon-nm: 12[NET] sending packet: from 118.181.10.18[41265] to 123.231.132.123[500] (1308 bytes)
Jan 14 11:34:56 MyMachine charon-nm: 08[NET] received packet: from 123.231.132.123[500] to 118.181.10.18[41265] (681 bytes)
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HTTP_CERT_LOOK) CERTREQ V V V ]
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] received unknown vendor ID: f7:58:f2:26:68:75:0f:03:b0:8d:f6:eb:e1:d0:04:03
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] received unknown vendor ID: f9:19:6d:f8:6b:81:2f:b0:f6:80:26:d8:87:6d:cb:7b:00:04:32:00
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] received unknown vendor ID: ac:40:f8:c4:38:99:27:c6:e8:ac:24:53:1b:b7:8b:2b:a1:ba:53:43:94:cc:20:8c:04:0d:fe:24:b7:99:7d:2b:73:61:0a:33:bd:6f:7b:4f:6f:1f:9c:06:45:24:83:ae:9b:a5:0b:ad:84:fd:f0:dd:3b:f4:19:c5:6c:54:cb:ba:d3:fa:8a:ad:9f:e8:40:a7:bd:4f:47:41:23:d7:22:e3:9e:16:b1:04:31:f9:ad:24:bf:60:ac:32:40:09:d5:41:58:4a:6b:a5:ce:1c:50:69:be:e8:92:49:56:37:48:d2:0e:f0:ef:89:df:2a:5f:49:1c:29:41:8a:b6:f2:e9:be
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] local host is behind NAT, sending keep alives
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] received cert request for "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] received 2 cert requests for an unknown ca
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] sending cert request for "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] establishing CHILD_SA my.domain.tld{12}
Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
Jan 14 11:34:56 MyMachine charon-nm: 08[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (304 bytes)
Jan 14 11:34:58 MyMachine charon-nm: 09[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (1408 bytes)
Jan 14 11:34:58 MyMachine charon-nm: 09[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
Jan 14 11:34:58 MyMachine charon-nm: 09[IKE] received end entity cert "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
Jan 14 11:34:58 MyMachine charon-nm: 09[CFG] using trusted certificate "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
Jan 14 11:34:58 MyMachine charon-nm: 09[IKE] authentication of 'my.domain.tld' with RSA signature successful
Jan 14 11:34:58 MyMachine charon-nm: 09[IKE] server requested EAP_IDENTITY (id 0x2A), sending 'my-username'
Jan 14 11:34:58 MyMachine charon-nm: 09[ENC] generating IKE_AUTH request 2 [ EAP/RES/ID ]
Jan 14 11:34:58 MyMachine charon-nm: 09[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (80 bytes)
Jan 14 11:34:58 MyMachine charon-nm: 15[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (80 bytes)
Jan 14 11:34:58 MyMachine charon-nm: 15[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/PEAP ]
Jan 14 11:34:58 MyMachine charon-nm: 15[IKE] server requested EAP_PEAP authentication (id 0x2B)
Jan 14 11:34:58 MyMachine charon-nm: 15[TLS] EAP_PEAP version is v0
Jan 14 11:34:58 MyMachine charon-nm: 15[ENC] generating IKE_AUTH request 3 [ EAP/RES/PEAP ]
Jan 14 11:34:58 MyMachine charon-nm: 15[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (272 bytes)
Jan 14 11:34:59 MyMachine charon-nm: 11[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (1104 bytes)
Jan 14 11:34:59 MyMachine charon-nm: 11[ENC] parsed IKE_AUTH response 3 [ EAP/REQ/PEAP ]
Jan 14 11:34:59 MyMachine charon-nm: 11[TLS] negotiated TLS 1.0 using suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
Jan 14 11:34:59 MyMachine charon-nm: 11[TLS] server certificate does not match to 'my.domain.tld'
Jan 14 11:34:59 MyMachine charon-nm: 11[TLS] sending fatal TLS alert 'access denied'
Jan 14 11:34:59 MyMachine charon-nm: 11[ENC] generating IKE_AUTH request 4 [ EAP/RES/PEAP ]
Jan 14 11:34:59 MyMachine charon-nm: 11[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (96 bytes)
Jan 14 11:34:59 MyMachine charon-nm: 10[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (80 bytes)
Jan 14 11:34:59 MyMachine charon-nm: 10[ENC] parsed IKE_AUTH response 4 [ EAP/FAIL ]
Jan 14 11:34:59 MyMachine charon-nm: 10[IKE] received EAP_FAILURE, EAP authentication failed
Jan 14 11:34:59 MyMachine charon-nm: 10[ENC] generating INFORMATIONAL request 5 [ N(AUTH_FAILED) ]
Jan 14 11:34:59 MyMachine charon-nm: 10[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (80 bytes)
Jan 14 11:34:59 MyMachine NetworkManager[959]: <warn> [1578998099.1459] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: failed: connect-failed (1)
Jan 14 11:34:59 MyMachine NetworkManager[959]: <warn> [1578998099.1460] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: failed: connect-failed (1)
Jan 14 11:34:59 MyMachine NetworkManager[959]: <info> [1578998099.1463] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: state changed: stopping (5)
Jan 14 11:34:59 MyMachine NetworkManager[959]: <info> [1578998099.1465] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: state changed: stopped (6)
Jan 14 11:34:59 MyMachine wingpanel[2354]: VpnMenuItem.vala:93: An VPN is being connected but not active.
Jan 14 11:34:59 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:59 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
Jan 14 11:34:59 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
While in the router I can see the following log output:
UPDATE: The following screenshot shows how the certifacte on the Zyxel USG is setup. All blackened parts are set to my.domain.tld. As you can see there, it seems the Subject Alternative Name of the certificate is set correctly:
I downloaded this cert and imported it on the client side with the following commands:
sudo cp ~/Downloads/VPN_my.domain.tld.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates
And then in Network Manager I selected the generated /etc/ssl/certs/VPN_my.domain.tld.pem.
Unfortunately I still get the same output as described above.