Revision 96b7fc0f-8c4e-4323-bd0d-422841b8b573 - elementary OS Stack Exchange

I'm trying to configure a elementary OS Hera client to connect to an existing VPN using IKEv2 EAP - but I can't get it working.

**Can anyone tell me what's wrong? (see Update below for further information on the cert and how I imported it on the client side)**

Here's what I did:

 1. Open AppCenter and **install "strongSwan VPN client"**
 2. Open **"System Settings > Network > VPN"**
 3. **Add a new VPN connection** by tapping on "+"
 4. Select **"IPSEC/IKEv2 (Strongswan)"**
 5. Hit "Create..."
 6. **Enter the following information:**
 7. **Address:** my.domain.tld
 8. **Certificate:** /path/to/my/certificate.pem
 9. **Authentication: EAP**
 10. **Username**: my-username
 11. Hit "Save"

Open a Terminal and execute **tail -f /var/log/syslog** - then **Hit "Connect"** for the newly created VPN connection - enter the user password when prompted (FWIW: I double checked the users password, it's correct). The Terminal prints the following:

    Jan 14 11:34:49 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
    Jan 14 11:34:49 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
    Jan 14 11:34:49 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
    Jan 14 11:34:51 MyMachine NetworkManager[959]: <info>  [1578998091.8162] audit: op="connection-activate" uuid="93ddc7bd-20e3-407e-8161-c1df393d30ab" name="my.domain.tld" pid=11945 uid=1001 result="success"
    Jan 14 11:34:51 MyMachine NetworkManager[959]: <info>  [1578998091.8315] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: Saw the service appear; activating connection
    Jan 14 11:34:51 MyMachine wingpanel[2354]: VpnMenuItem.vala:93: An VPN is being connected but not active.
    Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
    Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
    Jan 14 11:34:51 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
    Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
    Jan 14 11:34:51 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
    Jan 14 11:34:51 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
    Jan 14 11:34:51 MyMachine nm-strongswan-a[12100]: GtkDialog mapped without a transient parent. This is discouraged.
    Jan 14 11:34:55 MyMachine NetworkManager[959]: <info>  [1578998095.1872] settings-connection[0x55c9a7ef5990,93ddc7bd-20e3-407e-8161-c1df393d30ab]: write: successfully updated (keyfile: update /etc/NetworkManager/system-connections/my.domain.tld (93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld")), connection was modified in the process
    Jan 14 11:34:55 MyMachine wingpanel[2354]: VpnMenuItem.vala:93: An VPN is being connected but not active.
    Jan 14 11:34:55 MyMachine NetworkManager[959]: <info>  [1578998095.1950] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN connection: (ConnectInteractive) reply received
    Jan 14 11:34:55 MyMachine charon-nm: 05[CFG] received initiate for NetworkManager connection my.domain.tld
    Jan 14 11:34:55 MyMachine charon-nm: 05[CFG] using CA certificate, gateway identity 'my.domain.tld'
    Jan 14 11:34:55 MyMachine charon-nm: 05[IKE] initiating IKE_SA my.domain.tld[12] to 123.231.132.123
    Jan 14 11:34:55 MyMachine charon-nm: 05[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
    Jan 14 11:34:55 MyMachine charon-nm: 05[NET] sending packet: from 118.181.10.18[41265] to 123.231.132.123[500] (1116 bytes)
    Jan 14 11:34:55 MyMachine NetworkManager[959]: <info>  [1578998095.1973] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: state changed: starting (3)
    Jan 14 11:34:55 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
    Jan 14 11:34:55 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
    Jan 14 11:34:55 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent
    Jan 14 11:34:55 MyMachine charon-nm: 12[NET] received packet: from 123.231.132.123[500] to 118.181.10.18[41265] (38 bytes)
    Jan 14 11:34:55 MyMachine charon-nm: 12[ENC] parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]
    Jan 14 11:34:55 MyMachine charon-nm: 12[IKE] peer didn't accept DH group ECP_256, it requested MODP_2048
    Jan 14 11:34:55 MyMachine charon-nm: 12[IKE] initiating IKE_SA my.domain.tld[12] to 123.231.132.123
    Jan 14 11:34:55 MyMachine charon-nm: 12[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
    Jan 14 11:34:55 MyMachine charon-nm: 12[NET] sending packet: from 118.181.10.18[41265] to 123.231.132.123[500] (1308 bytes)
    Jan 14 11:34:56 MyMachine charon-nm: 08[NET] received packet: from 123.231.132.123[500] to 118.181.10.18[41265] (681 bytes)
    Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HTTP_CERT_LOOK) CERTREQ V V V ]
    Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] received unknown vendor ID: f7:58:f2:26:68:75:0f:03:b0:8d:f6:eb:e1:d0:04:03
    Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] received unknown vendor ID: f9:19:6d:f8:6b:81:2f:b0:f6:80:26:d8:87:6d:cb:7b:00:04:32:00
    Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] received unknown vendor ID: ac:40:f8:c4:38:99:27:c6:e8:ac:24:53:1b:b7:8b:2b:a1:ba:53:43:94:cc:20:8c:04:0d:fe:24:b7:99:7d:2b:73:61:0a:33:bd:6f:7b:4f:6f:1f:9c:06:45:24:83:ae:9b:a5:0b:ad:84:fd:f0:dd:3b:f4:19:c5:6c:54:cb:ba:d3:fa:8a:ad:9f:e8:40:a7:bd:4f:47:41:23:d7:22:e3:9e:16:b1:04:31:f9:ad:24:bf:60:ac:32:40:09:d5:41:58:4a:6b:a5:ce:1c:50:69:be:e8:92:49:56:37:48:d2:0e:f0:ef:89:df:2a:5f:49:1c:29:41:8a:b6:f2:e9:be
    Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] local host is behind NAT, sending keep alives
    Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] received cert request for "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
    Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] received 2 cert requests for an unknown ca
    Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] sending cert request for "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
    Jan 14 11:34:56 MyMachine charon-nm: 08[IKE] establishing CHILD_SA my.domain.tld{12}
    Jan 14 11:34:56 MyMachine charon-nm: 08[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
    Jan 14 11:34:56 MyMachine charon-nm: 08[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (304 bytes)
    Jan 14 11:34:58 MyMachine charon-nm: 09[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (1408 bytes)
    Jan 14 11:34:58 MyMachine charon-nm: 09[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
    Jan 14 11:34:58 MyMachine charon-nm: 09[IKE] received end entity cert "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
    Jan 14 11:34:58 MyMachine charon-nm: 09[CFG]   using trusted certificate "CN=my.domain.tld, C=Country, ST=State, L=City, O=My Organization, OU=IT"
    Jan 14 11:34:58 MyMachine charon-nm: 09[IKE] authentication of 'my.domain.tld' with RSA signature successful
    Jan 14 11:34:58 MyMachine charon-nm: 09[IKE] server requested EAP_IDENTITY (id 0x2A), sending 'my-username'
    Jan 14 11:34:58 MyMachine charon-nm: 09[ENC] generating IKE_AUTH request 2 [ EAP/RES/ID ]
    Jan 14 11:34:58 MyMachine charon-nm: 09[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (80 bytes)
    Jan 14 11:34:58 MyMachine charon-nm: 15[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (80 bytes)
    Jan 14 11:34:58 MyMachine charon-nm: 15[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/PEAP ]
    Jan 14 11:34:58 MyMachine charon-nm: 15[IKE] server requested EAP_PEAP authentication (id 0x2B)
    Jan 14 11:34:58 MyMachine charon-nm: 15[TLS] EAP_PEAP version is v0
    Jan 14 11:34:58 MyMachine charon-nm: 15[ENC] generating IKE_AUTH request 3 [ EAP/RES/PEAP ]
    Jan 14 11:34:58 MyMachine charon-nm: 15[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (272 bytes)
    Jan 14 11:34:59 MyMachine charon-nm: 11[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (1104 bytes)
    Jan 14 11:34:59 MyMachine charon-nm: 11[ENC] parsed IKE_AUTH response 3 [ EAP/REQ/PEAP ]
    Jan 14 11:34:59 MyMachine charon-nm: 11[TLS] negotiated TLS 1.0 using suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
    Jan 14 11:34:59 MyMachine charon-nm: 11[TLS] server certificate does not match to 'my.domain.tld'
    Jan 14 11:34:59 MyMachine charon-nm: 11[TLS] sending fatal TLS alert 'access denied'
    Jan 14 11:34:59 MyMachine charon-nm: 11[ENC] generating IKE_AUTH request 4 [ EAP/RES/PEAP ]
    Jan 14 11:34:59 MyMachine charon-nm: 11[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (96 bytes)
    Jan 14 11:34:59 MyMachine charon-nm: 10[NET] received packet: from 123.231.132.123[4500] to 118.181.10.18[54448] (80 bytes)
    Jan 14 11:34:59 MyMachine charon-nm: 10[ENC] parsed IKE_AUTH response 4 [ EAP/FAIL ]
    Jan 14 11:34:59 MyMachine charon-nm: 10[IKE] received EAP_FAILURE, EAP authentication failed
    Jan 14 11:34:59 MyMachine charon-nm: 10[ENC] generating INFORMATIONAL request 5 [ N(AUTH_FAILED) ]
    Jan 14 11:34:59 MyMachine charon-nm: 10[NET] sending packet: from 118.181.10.18[54448] to 123.231.132.123[4500] (80 bytes)
    Jan 14 11:34:59 MyMachine NetworkManager[959]: <warn>  [1578998099.1459] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: failed: connect-failed (1)
    Jan 14 11:34:59 MyMachine NetworkManager[959]: <warn>  [1578998099.1460] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: failed: connect-failed (1)
    Jan 14 11:34:59 MyMachine NetworkManager[959]: <info>  [1578998099.1463] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: state changed: stopping (5)
    Jan 14 11:34:59 MyMachine NetworkManager[959]: <info>  [1578998099.1465] vpn-connection[0x55c9a8000870,93ddc7bd-20e3-407e-8161-c1df393d30ab,"my.domain.tld",0]: VPN plugin: state changed: stopped (6)
    Jan 14 11:34:59 MyMachine wingpanel[2354]: VpnMenuItem.vala:93: An VPN is being connected but not active.
    Jan 14 11:34:59 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
    Jan 14 11:34:59 MyMachine nm-applet[2383]: gtk_widget_destroy: assertion 'GTK_IS_WIDGET (widget)' failed
    Jan 14 11:34:59 MyMachine nm-applet[2383]: Can't set a parent on widget which has a parent

While in the router I can see the following log output:

[![enter image description here][1]][1]


**UPDATE:** The following screenshot shows how the certifacte on the Zyxel USG is setup. All blackened parts are set to `my.domain.tld`. As you can see there, it seems the `Subject Alternative Name` of the certificate is set correctly (means: it is equal to the FQDN of the Zyxel device which serves the VPN connection and I'm trying to connect to):

[![enter image description here][2]][2]

I downloaded this cert and imported it on the client side with the following commands:

```
sudo cp ~/Downloads/VPN_my.domain.tld.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates
```

And then in Network Manager I selected the generated `/etc/ssl/certs/VPN_my.domain.tld.pem`.

Unfortunately I still get the same output as described above.


  [1]: https://i.sstatic.net/wqLaq.png
  [2]: https://i.sstatic.net/Rg2ZO.png