strongswan log analyze
1.Configuration load
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 |
Starting IKE charon daemon (strongSwan 5.2.1, Linux 2.6.32-358.el6.i686, i686) openssl FIPS mode(0) - disabled loading ca certificates from '/usr/local/etc/ipsec.d/cacerts' loaded ca certificate "C=US, O=Organization, CN=domain" from '/usr/local/etc/ipsec.d/cacerts/ca.cert.pem' loading aa certificates from '/usr/local/etc/ipsec.d/aacerts' loading ocsp signer certificates from '/usr/local/etc/ipsec.d/ocspcerts' loading attribute certificates from '/usr/local/etc/ipsec.d/acerts' loading crls from '/usr/local/etc/ipsec.d/crls' loading secrets from '/usr/local/etc/ipsec.secrets' loaded RSA private key from '/usr/local/etc/ipsec.d/private/server.pem' loaded IKE secret for %any loaded EAP secret for xxx loaded EAP secret for xxx2 loaded EAP secret for "domain\xxx" loaded EAP secret for xxx1 loaded EAP secret for "domain\xxx1" loaded 0 RADIUS server configurations loaded plugins: charon aes des rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pg unable to load 3 plugin features (3 due to unmet dependencies) spawning 16 worker threads received stroke: add connection 'iOS_cert' left nor right host is our side, assuming left=local adding virtual IP address pool 10.0.0.0/24 loaded certificate "C=US, O=Organization, CN=domain" from 'server.cert.pem' id '%any' not confirmed by certificate, defaulting to 'C=US, O=Organization, CN=domain' loaded certificate "C=US, O=Organization, CN=domain" from 'client.cert.pem' id '%any' not confirmed by certificate, defaulting to 'C=US, O=Organization, CN=domain' added configuration 'iOS_cert' received stroke: add connection 'android_xauth_psk' left nor right host is our side, assuming left=local reusing virtual IP address pool 10.0.0.0/24 added configuration 'android_xauth_psk' received stroke: add connection 'networkmanager-strongswan' left nor right host is our side, assuming left=local reusing virtual IP address pool 10.0.0.0/24 loaded certificate "C=US, O=Organization, CN=domain" from 'server.cert.pem' id '%any' not confirmed by certificate, defaulting to 'C=US, O=Organization, CN=domain' loaded certificate "C=US, O=Organization, CN=domain" from 'client.cert.pem' id '%any' not confirmed by certificate, defaulting to 'C=US, O=Organization, CN=domain' added configuration 'networkmanager-strongswan' received stroke: add connection 'windows7' left nor right host is our side, assuming left=local reusing virtual IP address pool 10.0.0.0/24 loaded certificate "C=US, O=Organization, CN=domain" from 'server.cert.pem' id '%any' not confirmed by certificate, defaulting to 'C=US, O=Organization, CN=domain' added configuration 'windows7' |
2.Connect
1)
|
1 2 3 4 5 6 7 8 9 10 11 |
received packet: from client_ip[500] to server_ip[500] (616 bytes) parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) V V V V ] received unknown vendor ID: 1e:2b:51:69:05:99:1c:7d:7c:96:fc:bf:b5:87:e4:61:00:00:00:09 received unknown vendor ID: fb:1d:e3:cd:f3:41:b7:ea:16:b7:e5:be:08:55:f1:20 received unknown vendor ID: 26:24:4d:38:ed:db:61:b3:17:2a:36:e3:d0:cf:b8:19 received unknown vendor ID: 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:02 client_ip is initiating an IKE_SA remote host is behind NAT sending cert request for "C=US, O=Organization, CN=domain" generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ] sending packet: from server_ip[500] to client_ip[500] (333 bytes) |
2)
|
1 2 3 4 5 6 7 8 9 10 11 12 |
received packet: from client_ip[41070] to server_ip[4500] (1164 bytes) parsed IKE_AUTH request 1 [ IDi CERTREQ N(MOBIKE_SUP) CPRQ(ADDR DNS NBNS SRV ADDR6 DNS6 SRV6) SA TSi TSr ] received cert request for "C=US, O=Organization, CN=domain" received 41 cert requests for an unknown ca looking for peer configs matching server_ip[%any]...client_ip[192.168.2.7] selected peer config 'windows7' initiating EAP_IDENTITY method (id 0x00) peer supports MOBIKE authentication of 'C=US, O=Organization, CN=domain' (myself) with RSA signature successful sending end entity cert "C=US, O=Organization, CN=domain" generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ] sending packet: from server_ip[4500] to client_ip[41070] (1268 bytes) |
3)
|
1 2 3 4 5 6 |
received packet: from client_ip[41070] to server_ip[4500] (84 bytes) parsed IKE_AUTH request 2 [ EAP/RES/ID ] received EAP identity 'domain\xxx' initiating EAP_MSCHAPV2 method (id 0xD2) generating IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ] sending packet: from server_ip[4500] to client_ip[41070] (100 bytes) |
4)
|
1 2 3 4 |
received packet: from client_ip[41070] to server_ip[4500] (140 bytes) parsed IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ] generating IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ] sending packet: from server_ip[4500] to client_ip[41070] (132 bytes) |
5)
|
1 2 3 4 5 |
received packet: from client_ip[41070] to server_ip[4500] (68 bytes) parsed IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ] EAP method EAP_MSCHAPV2 succeeded, MSK established generating IKE_AUTH response 4 [ EAP/SUCC ] sending packet: from server_ip[4500] to client_ip[41070] (68 bytes) |
6)
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
received packet: from client_ip[41070] to server_ip[4500] (84 bytes) parsed IKE_AUTH request 5 [ AUTH ] authentication of '192.168.2.7' with EAP successful authentication of 'C=US, O=Organization, CN=domain' (myself) with EAP IKE_SA windows7[1] established between server_ip[C=US, O=Organization, CN=domain]...client_ip[192.168.2.7] peer requested virtual IP %any assigning new lease to 'domain\xxx' assigning virtual IP 10.0.0.1 to peer 'domain\xxx' peer requested virtual IP %any6 no virtual IP found for %any6 requested by 'domain\xxx' CHILD_SA windows7{1} established with SPIs c67ad14d_i 725d3244_o and TS 0.0.0.0/0 === 10.0.0.1/32 generating IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS NBNS DNS NBNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) ] sending packet: from server_ip[4500] to client_ip[41070] (236 bytes) |
3.Disconnect
1)
|
1 2 3 4 5 6 7 8 |
received packet: from client_ip[41070] to server_ip[4500] (68 bytes) parsed INFORMATIONAL request 6 [ D ] received DELETE for ESP CHILD_SA with SPI 725d3244 closing CHILD_SA windows7{1} with SPIs c67ad14d_i (56725 bytes) 725d3244_o (289688 bytes) and TS 0.0.0.0/0 === 10.0.0.1/32 sending DELETE for ESP CHILD_SA with SPI c67ad14d CHILD_SA closed generating INFORMATIONAL response 6 [ D ] sending packet: from server_ip[4500] to client_ip[41070] (68 bytes) |
2)
|
1 2 3 4 5 6 7 8 |
received packet: from client_ip[41070] to server_ip[4500] (68 bytes) parsed INFORMATIONAL request 7 [ D ] received DELETE for IKE_SA windows7[1] deleting IKE_SA windows7[1] between server_ip[C=US, O=Organization, CN=domain]...client_ip[192.168.2.7] IKE_SA deleted generating INFORMATIONAL response 7 [ ] sending packet: from server_ip[4500] to client_ip[41070] (60 bytes) lease 10.0.0.1 by 'domain\xxx' went offline |