Need Help: IPSec VPN issues
There are 3 issues with my IPSec(Strongswan) VPN on Debian 8:
1,It can be connected by Mac, but failed with iphone.
2, After connected, the networks is down, no ping except the VPN ip.
3,ipsec restart
Stopping strongSwan IPsec…
Starting strongSwan 5.3.5 IPsec [starter]…
sh: 1: modprobe: not found
sh: 1: modprobe: not found
sh: 1: modprobe: not found
sh: 1: modprobe: not found
sh: 1: modprobe: not found
Syslog:
1, Mac
Feb 14 17:00:01 localhost charon: 10[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (76 bytes)
Feb 14 17:00:01 localhost charon: 10[ENC] parsed INFORMATIONAL_V1 request 3819093245 [ HASH D ]
Feb 14 17:00:01 localhost charon: 10[IKE] received DELETE for ESP CHILD_SA with SPI 0b31ff6c
Feb 14 17:00:01 localhost charon: 10[IKE] closing CHILDSA psk{2} with SPIs cc544626i (6458 bytes) 0b31ff6c_o (522 bytes) and TS 0.0.0.0/0 === 10.0.0.1/32
Feb 14 17:00:01 localhost charon: 10[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (92 bytes)
Feb 14 17:00:01 localhost charon: 10[ENC] parsed INFORMATIONAL_V1 request 3546660056 [ HASH D ]
Feb 14 17:00:01 localhost charon: 10[IKE] received DELETE for IKE_SA psk[7]
Feb 14 17:00:01 localhost charon: 10[IKE] deleting IKE_SA psk[7] between 45.45.45.45[45.45.45.45]…66.66.66.66[192.168.1.4]
Feb 14 17:00:01 localhost charon: 10[CFG] lease 10.0.0.1 by 'sample01' went offline
Feb 14 17:05:01 localhost CRON[3863]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Feb 14 17:06:15 localhost charon: 12[NET] received packet: from 66.66.66.66[500] to 45.45.45.45[500] (596 bytes)
Feb 14 17:06:15 localhost charon: 12[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V V V V V V ]
Feb 14 17:06:15 localhost charon: 12[IKE] received NAT-T (RFC 3947) vendor ID
Feb 14 17:06:15 localhost charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike vendor ID
Feb 14 17:06:15 localhost charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-08 vendor ID
Feb 14 17:06:15 localhost charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-07 vendor ID
Feb 14 17:06:15 localhost charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-06 vendor ID
Feb 14 17:06:15 localhost charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-05 vendor ID
Feb 14 17:06:15 localhost charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-04 vendor ID
Feb 14 17:06:15 localhost charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID
Feb 14 17:06:15 localhost charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID
Feb 14 17:06:15 localhost charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Feb 14 17:06:15 localhost charon: 12[IKE] received XAuth vendor ID
Feb 14 17:06:15 localhost charon: 12[IKE] received Cisco Unity vendor ID
Feb 14 17:06:15 localhost charon: 12[IKE] received FRAGMENTATION vendor ID
Feb 14 17:06:15 localhost charon: 12[IKE] received DPD vendor ID
Feb 14 17:06:15 localhost charon: 12[IKE] 66.66.66.66 is initiating a Main Mode IKE_SA
Feb 14 17:06:15 localhost charon: 12[ENC] generating ID_PROT response 0 [ SA V V V ]
Feb 14 17:06:15 localhost charon: 12[NET] sending packet: from 45.45.45.45[500] to 66.66.66.66[500] (136 bytes)
Feb 14 17:06:15 localhost charon: 11[NET] received packet: from 66.66.66.66[500] to 45.45.45.45[500] (228 bytes)
Feb 14 17:06:15 localhost charon: 11[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
Feb 14 17:06:15 localhost charon: 11[IKE] remote host is behind NAT
Feb 14 17:06:15 localhost charon: 11[ENC] generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
Feb 14 17:06:15 localhost charon: 11[NET] sending packet: from 45.45.45.45[500] to 66.66.66.66[500] (244 bytes)
Feb 14 17:06:16 localhost charon: 03[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (108 bytes)
Feb 14 17:06:16 localhost charon: 03[ENC] parsed IDPROT request 0 [ ID HASH N(INITIALCONTACT) ]
Feb 14 17:06:16 localhost charon: 03[CFG] looking for XAuthInitPSK peer configs matching 45.45.45.45…66.66.66.66[192.168.1.4]
Feb 14 17:06:16 localhost charon: 03[CFG] selected peer config "psk"
Feb 14 17:06:16 localhost charon: 03[ENC] generating ID_PROT response 0 [ ID HASH ]
Feb 14 17:06:16 localhost charon: 03[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (76 bytes)
Feb 14 17:06:16 localhost charon: 03[ENC] generating TRANSACTION request 1778650174 [ HASH CPRQ(XUSER XPWD) ]
Feb 14 17:06:16 localhost charon: 03[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (76 bytes)
Feb 14 17:06:16 localhost charon: 04[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (92 bytes)
Feb 14 17:06:16 localhost charon: 04[ENC] parsed TRANSACTION response 1778650174 [ HASH CPRP(XUSER XPWD) ]
Feb 14 17:06:16 localhost charon: 04[IKE] XAuth authentication of 'sample01' successful
Feb 14 17:06:16 localhost charon: 04[ENC] generating TRANSACTION request 3231589199 [ HASH CPS(X_STATUS) ]
Feb 14 17:06:16 localhost charon: 04[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (76 bytes)
Feb 14 17:06:17 localhost charon: 01[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (76 bytes)
Feb 14 17:06:17 localhost charon: 01[ENC] parsed TRANSACTION response 3231589199 [ HASH CPA(X_STATUS) ]
Feb 14 17:06:17 localhost charon: 01[IKE] IKE_SA psk[8] established between 45.45.45.45[45.45.45.45]…66.66.66.66[192.168.1.4]
Feb 14 17:06:17 localhost charon: 01[IKE] scheduling reauthentication in 9988s
Feb 14 17:06:17 localhost charon: 01[IKE] maximum IKE_SA lifetime 10528s
Feb 14 17:06:17 localhost charon: 01[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (172 bytes)
Feb 14 17:06:17 localhost charon: 01[ENC] unknown attribute type (28683)
Feb 14 17:06:17 localhost charon: 01[ENC] parsed TRANSACTION request 3374398621 [ HASH CPRQ(ADDR MASK DNS NBNS EXP VER UBANNER UDEFDOM USPLITDNS USPLITINC ULOCALLAN UPFS USAVEPWD UFWTYPE U_BKPSRV (28683)) ]
Feb 14 17:06:17 localhost charon: 01[IKE] peer requested virtual IP %any
Feb 14 17:06:17 localhost charon: 01[CFG] reassigning offline lease to 'sample01'
Feb 14 17:06:17 localhost charon: 01[IKE] assigning virtual IP 10.0.0.1 to peer 'sample01'
Feb 14 17:06:17 localhost charon: 01[ENC] generating TRANSACTION response 3374398621 [ HASH CPRP(ADDR DNS NBNS DNS NBNS) ]
Feb 14 17:06:17 localhost charon: 01[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (108 bytes)
Feb 14 17:06:17 localhost charon: 06[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (300 bytes)
Feb 14 17:06:17 localhost charon: 06[ENC] parsed QUICK_MODE request 2376648594 [ HASH SA No ID ID ]
Feb 14 17:06:17 localhost charon: 06[ENC] generating QUICK_MODE response 2376648594 [ HASH SA No ID ID ]
Feb 14 17:06:17 localhost charon: 06[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (172 bytes)
Feb 14 17:06:17 localhost charon: 10[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (60 bytes)
Feb 14 17:06:17 localhost charon: 10[ENC] parsed QUICK_MODE request 2376648594 [ HASH ]
Feb 14 17:06:17 localhost charon: 10[IKE] CHILDSA psk{3} established with SPIs caf2451ai 05a9e141_o and TS 0.0.0.0/0 === 10.0.0.1/32
Feb 14 17:06:59 localhost charon: 04[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (92 bytes)
Feb 14 17:06:59 localhost charon: 04[ENC] parsed INFORMATIONAL_V1 request 2905486511 [ HASH N(DPD) ]
Feb 14 17:06:59 localhost charon: 04[ENC] generating INFORMATIONALV1 request 321724978 [ HASH N(DPDACK) ]
Feb 14 17:06:59 localhost charon: 04[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (92 bytes)
Feb 14 17:07:41 localhost charon: 01[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (92 bytes)
Feb 14 17:07:41 localhost charon: 01[ENC] parsed INFORMATIONAL_V1 request 3322235515 [ HASH N(DPD) ]
Feb 14 17:07:41 localhost charon: 01[ENC] generating INFORMATIONALV1 request 172358178 [ HASH N(DPDACK) ]
Feb 14 17:07:41 localhost charon: 01[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (92 bytes)
Feb 14 17:08:03 localhost charon: 06[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (92 bytes)
Feb 14 17:08:03 localhost charon: 06[ENC] parsed INFORMATIONAL_V1 request 3128810889 [ HASH N(DPD) ]
Feb 14 17:08:03 localhost charon: 06[ENC] generating INFORMATIONALV1 request 2464718056 [ HASH N(DPDACK) ]
Feb 14 17:08:03 localhost charon: 06[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (92 bytes)
Feb 14 17:08:25 localhost charon: 07[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (92 bytes)
Feb 14 17:08:25 localhost charon: 07[ENC] parsed INFORMATIONAL_V1 request 3700396962 [ HASH N(DPD) ]
Feb 14 17:08:25 localhost charon: 07[ENC] generating INFORMATIONALV1 request 241361049 [ HASH N(DPDACK) ]
Feb 14 17:08:25 localhost charon: 07[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (92 bytes)
Feb 14 17:08:48 localhost charon: 08[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (92 bytes)
Feb 14 17:08:48 localhost charon: 08[ENC] parsed INFORMATIONAL_V1 request 3317282187 [ HASH N(DPD) ]
Feb 14 17:08:48 localhost charon: 08[ENC] generating INFORMATIONALV1 request 3900608105 [ HASH N(DPDACK) ]
Feb 14 17:08:48 localhost charon: 08[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (92 bytes)
Feb 14 17:09:08 localhost charon: 11[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (92 bytes)
Feb 14 17:09:08 localhost charon: 11[ENC] parsed INFORMATIONAL_V1 request 2998623757 [ HASH N(DPD) ]
Feb 14 17:09:08 localhost charon: 11[ENC] generating INFORMATIONALV1 request 2641908704 [ HASH N(DPDACK) ]
Feb 14 17:09:08 localhost charon: 11[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (92 bytes)
Feb 14 17:09:53 localhost charon: 04[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (92 bytes)
Feb 14 17:09:53 localhost charon: 04[ENC] parsed INFORMATIONAL_V1 request 3282214972 [ HASH N(DPD) ]
Feb 14 17:09:53 localhost charon: 04[ENC] generating INFORMATIONALV1 request 370816459 [ HASH N(DPDACK) ]
Feb 14 17:09:53 localhost charon: 04[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (92 bytes)
Feb 14 17:10:15 localhost charon: 02[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (92 bytes)
Feb 14 17:10:15 localhost charon: 02[ENC] parsed INFORMATIONAL_V1 request 3807616116 [ HASH N(DPD) ]
Feb 14 17:10:15 localhost charon: 02[ENC] generating INFORMATIONALV1 request 99538301 [ HASH N(DPDACK) ]
Feb 14 17:10:15 localhost charon: 02[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (92 bytes)
Feb 14 17:10:35 localhost charon: 06[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (92 bytes)
Feb 14 17:10:35 localhost charon: 06[ENC] parsed INFORMATIONAL_V1 request 3758985154 [ HASH N(DPD) ]
Feb 14 17:10:35 localhost charon: 06[ENC] generating INFORMATIONALV1 request 3309740066 [ HASH N(DPDACK) ]
Feb 14 17:10:35 localhost charon: 06[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (92 bytes)
Feb 14 17:10:58 localhost charon: 10[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (92 bytes)
Feb 14 17:10:58 localhost charon: 10[ENC] parsed INFORMATIONAL_V1 request 3605372591 [ HASH N(DPD) ]
Feb 14 17:10:58 localhost charon: 10[ENC] generating INFORMATIONALV1 request 2866352648 [ HASH N(DPDACK) ]
Feb 14 17:10:58 localhost charon: 10[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (92 bytes)
Feb 14 17:11:20 localhost charon: 09[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (92 bytes)
Feb 14 17:11:20 localhost charon: 09[ENC] parsed INFORMATIONAL_V1 request 2569285624 [ HASH N(DPD) ]
Feb 14 17:11:20 localhost charon: 09[ENC] generating INFORMATIONALV1 request 4215760629 [ HASH N(DPDACK) ]
Feb 14 17:11:20 localhost charon: 09[NET] sending packet: from 45.45.45.45[4500] to 66.66.66.66[4500] (92 bytes)
Feb 14 17:11:29 localhost charon: 08[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (76 bytes)
Feb 14 17:11:29 localhost charon: 08[ENC] parsed INFORMATIONAL_V1 request 3289665516 [ HASH D ]
Feb 14 17:11:29 localhost charon: 08[IKE] received DELETE for ESP CHILD_SA with SPI 05a9e141
Feb 14 17:11:29 localhost charon: 08[IKE] closing CHILDSA psk{3} with SPIs caf2451ai (8523 bytes) 05a9e141_o (522 bytes) and TS 0.0.0.0/0 === 10.0.0.1/32
Feb 14 17:11:29 localhost charon: 11[NET] received packet: from 66.66.66.66[4500] to 45.45.45.45[4500] (92 bytes)
Feb 14 17:11:29 localhost charon: 11[ENC] parsed INFORMATIONAL_V1 request 3165614166 [ HASH D ]
Feb 14 17:11:29 localhost charon: 11[IKE] received DELETE for IKE_SA psk[8]
Feb 14 17:11:29 localhost charon: 11[IKE] deleting IKE_SA psk[8] between 45.45.45.45[45.45.45.45]…66.66.66.66[192.168.1.4]
Feb 14 17:11:29 localhost charon: 11[CFG] lease 10.0.0.1 by 'sample01' went offline
2,Iphone
Feb 14 17:22:12 localhost charon: 12[CFG] loaded certificate "C=com, O=sample, CN=45.45.45.45" from 'server.cert.pem'
Feb 14 17:22:12 localhost charon: 12[CFG] id '%any' not confirmed by certificate, defaulting to 'C=com, O=sample, CN=45.45.45.45'
Feb 14 17:22:12 localhost charon: 12[CFG] loaded certificate "C=com, O=sample, CN=45.45.45.45 Client" from 'client.cert.pem'
Feb 14 17:22:12 localhost charon: 12[CFG] id '%any' not confirmed by certificate, defaulting to 'C=com, O=sample, CN=45.45.45.45 Client'
Feb 14 17:22:12 localhost charon: 12[CFG] added configuration 'networkmanager-strongswan'
Feb 14 17:22:12 localhost charon: 14[CFG] received stroke: add connection 'windows7'
Feb 14 17:22:12 localhost charon: 14[CFG] reusing virtual IP address pool 10.31.2.0/24
Feb 14 17:22:12 localhost charon: 14[CFG] loaded certificate "C=com, O=sample, CN=45.45.45.45" from 'server.cert.pem'
Feb 14 17:22:12 localhost charon: 14[CFG] id '%any' not confirmed by certificate, defaulting to 'C=com, O=sample, CN=45.45.45.45'
Feb 14 17:22:12 localhost charon: 14[CFG] added configuration 'windows7'
Feb 14 17:25:01 localhost CRON[3937]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Feb 14 17:25:17 localhost charon: 09[NET] received packet: from 66.66.66.66[500] to 45.45.45.45[500] (596 bytes)
Feb 14 17:25:17 localhost charon: 09[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V V V V V V ]
Feb 14 17:25:17 localhost charon: 09[IKE] received NAT-T (RFC 3947) vendor ID
Feb 14 17:25:17 localhost charon: 09[IKE] received draft-ietf-ipsec-nat-t-ike vendor ID
Feb 14 17:25:17 localhost charon: 09[IKE] received draft-ietf-ipsec-nat-t-ike-08 vendor ID
Feb 14 17:25:17 localhost charon: 09[IKE] received draft-ietf-ipsec-nat-t-ike-07 vendor ID
Feb 14 17:25:17 localhost charon: 09[IKE] received draft-ietf-ipsec-nat-t-ike-06 vendor ID
Feb 14 17:25:17 localhost charon: 09[IKE] received draft-ietf-ipsec-nat-t-ike-05 vendor ID
Feb 14 17:25:17 localhost charon: 09[IKE] received draft-ietf-ipsec-nat-t-ike-04 vendor ID
Feb 14 17:25:17 localhost charon: 09[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID
Feb 14 17:25:17 localhost charon: 09[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID
Feb 14 17:25:17 localhost charon: 09[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Feb 14 17:25:17 localhost charon: 09[IKE] received XAuth vendor ID
Feb 14 17:25:17 localhost charon: 09[IKE] received Cisco Unity vendor ID
Feb 14 17:25:17 localhost charon: 09[IKE] received FRAGMENTATION vendor ID
Feb 14 17:25:17 localhost charon: 09[IKE] received DPD vendor ID
Feb 14 17:25:17 localhost charon: 09[IKE] 66.66.66.66 is initiating a Main Mode IKE_SA
Feb 14 17:25:17 localhost charon: 09[ENC] generating ID_PROT response 0 [ SA V V V ]
Feb 14 17:25:17 localhost charon: 09[NET] sending packet: from 45.45.45.45[500] to 66.66.66.66[500] (136 bytes)
Feb 14 17:25:18 localhost charon: 13[NET] received packet: from 66.66.66.66[500] to 45.45.45.45[500] (228 bytes)
Feb 14 17:25:18 localhost charon: 13[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
Feb 14 17:25:18 localhost charon: 13[IKE] remote host is behind NAT
Feb 14 17:25:18 localhost charon: 13[ENC] generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
Feb 14 17:25:18 localhost charon: 13[NET] sending packet: from 45.45.45.45[500] to 66.66.66.66[500] (244 bytes)
Feb 14 17:25:18 localhost charon: 10[NET] received packet: from 66.66.66.66[55014] to 45.45.45.45[4500] (108 bytes)
Feb 14 17:25:18 localhost charon: 10[ENC] invalid ID_V1 payload length, decryption failed?
Feb 14 17:25:18 localhost charon: 10[ENC] could not decrypt payloads
Feb 14 17:25:18 localhost charon: 10[IKE] message parsing failed
Feb 14 17:25:18 localhost charon: 10[ENC] generating INFORMATIONALV1 request 1502940616 [ HASH N(PLDMAL) ]
Feb 14 17:25:18 localhost charon: 10[NET] sending packet: from 45.45.45.45[500] to 66.66.66.66[500] (76 bytes)
Feb 14 17:25:18 localhost charon: 10[IKE] ID_PROT request with message ID 0 processing failed
Feb 14 17:25:22 localhost charon: 12[NET] received packet: from 66.66.66.66[55014] to 45.45.45.45[4500] (108 bytes)
Feb 14 17:25:22 localhost charon: 12[ENC] invalid ID_V1 payload length, decryption failed?
Feb 14 17:25:22 localhost charon: 12[ENC] could not decrypt payloads
Feb 14 17:25:22 localhost charon: 12[IKE] message parsing failed
Feb 14 17:25:22 localhost charon: 12[ENC] generating INFORMATIONALV1 request 1807077786 [ HASH N(PLDMAL) ]
Feb 14 17:25:22 localhost charon: 12[NET] sending packet: from 45.45.45.45[500] to 66.66.66.66[500] (76 bytes)
Feb 14 17:25:22 localhost charon: 12[IKE] ID_PROT request with message ID 0 processing failed
Feb 14 17:25:25 localhost charon: 15[NET] received packet: from 66.66.66.66[55014] to 45.45.45.45[4500] (108 bytes)
Feb 14 17:25:25 localhost charon: 15[ENC] invalid ID_V1 payload length, decryption failed?
Feb 14 17:25:25 localhost charon: 15[ENC] could not decrypt payloads
Feb 14 17:25:25 localhost charon: 15[IKE] message parsing failed
Feb 14 17:25:25 localhost charon: 15[ENC] generating INFORMATIONALV1 request 2187248963 [ HASH N(PLDMAL) ]
Feb 14 17:25:25 localhost charon: 15[NET] sending packet: from 45.45.45.45[500] to 66.66.66.66[500] (76 bytes)
Feb 14 17:25:25 localhost charon: 15[IKE] ID_PROT request with message ID 0 processing failed