StrongSwan VPN: WIN7 Client löscht CHILD_SA

der_harry

der_harry

New Member
Hallo.

Ich habe ein auf StrongSwan basierendes VPN Gateway(Konfig siehe hier.)

Wenn sich ein WIN7 Client verbindet ist alles gut. Nur leider löscht der nach ca. 6 min die CHILD_SA und somit entfernt StrongSwan auch die Route zu diesem Client wieder. Das ist blöd. Hier aus dem Log:
Code: 
Jan 30 17:12:23 Ubuntu-1004-lucid-32-minimal charon: 13[IKE] authentication of 'C=DE, ST=SH, O=O, OU=OU, CN=Laptop-Harry' with RSA signature successful
Jan 30 17:12:23 Ubuntu-1004-lucid-32-minimal charon: 13[IKE] peer supports MOBIKE
Jan 30 17:12:23 Ubuntu-1004-lucid-32-minimal charon: 13[IKE] authentication of 'C=DE, ST=SH, O=O, OU=OU, CN=123.123.123.123' (myself) with RSA signature successful
Jan 30 17:12:23 Ubuntu-1004-lucid-32-minimal charon: 13[IKE] scheduling reauthentication in 10197s
Jan 30 17:12:23 Ubuntu-1004-lucid-32-minimal charon: 13[IKE] maximum IKE_SA lifetime 10737s
Jan 30 17:12:23 Ubuntu-1004-lucid-32-minimal charon: 13[IKE] IKE_SA rw[7] established between 123.123.123.123[C=DE, ST=SH, O=O, OU=OU, CN=123.123.123.123]...80.187.95.5[C=DE, ST=SH, O=O, OU=OU, CN=Laptop-Harry]
Jan 30 17:12:23 Ubuntu-1004-lucid-32-minimal charon: 13[IKE] sending end entity cert "C=DE, ST=SH, O=O, OU=OU, CN=123.123.123.123"
Jan 30 17:12:23 Ubuntu-1004-lucid-32-minimal charon: 13[IKE] peer requested virtual IP %any
Jan 30 17:12:23 Ubuntu-1004-lucid-32-minimal charon: 13[CFG] reassigning offline lease to 'C=DE, ST=SH, O=O, OU=OU, CN=Laptop-Harry'
Jan 30 17:12:23 Ubuntu-1004-lucid-32-minimal charon: 13[IKE] assigning virtual IP 172.32.0.2 to peer
Jan 30 17:12:23 Ubuntu-1004-lucid-32-minimal vpn: + C=DE, ST=SH, O=O, OU=OU, CN=Laptop-Harry 172.32.0.2/32 == 80.187.95.5 -- 123.123.123.123
Jan 30 17:12:23 Ubuntu-1004-lucid-32-minimal charon: 13[IKE] CHILD_SA rw{7} established with SPIs cf76699c_i bf4e0907_o and TS 123.123.123.123/32 === 172.32.0.2/32
Jan 30 17:12:23 Ubuntu-1004-lucid-32-minimal charon: 13[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH CP SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(NO_ADD_ADDR) ]
Jan 30 17:12:23 Ubuntu-1004-lucid-32-minimal charon: 13[NET] sending packet: from 123.123.123.123[4500] to 80.187.95.5[4500]
Jan 30 17:17:01 Ubuntu-1004-lucid-32-minimal CRON[20606]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Jan 30 17:17:24 Ubuntu-1004-lucid-32-minimal charon: 11[NET] received packet: from 80.187.95.5[4500] to 123.123.123.123[4500]
Jan 30 17:17:24 Ubuntu-1004-lucid-32-minimal charon: 11[ENC] parsed INFORMATIONAL request 2 [ D ]
Jan 30 17:17:24 Ubuntu-1004-lucid-32-minimal charon: 11[IKE] received DELETE for ESP CHILD_SA with SPI bf4e0907
Jan 30 17:17:24 Ubuntu-1004-lucid-32-minimal charon: 11[IKE] closing CHILD_SA rw{7} with SPIs cf76699c_i bf4e0907_o and TS 123.123.123.123/32 === 172.32.0.2/32
Jan 30 17:17:24 Ubuntu-1004-lucid-32-minimal charon: 11[IKE] sending DELETE for ESP CHILD_SA with SPI cf76699c
Jan 30 17:17:24 Ubuntu-1004-lucid-32-minimal vpn: - C=DE, ST=SH, O=O, OU=OU, CN=Laptop-Harry 172.32.0.2/32 == 80.187.95.5 -- 123.123.123.123
Jan 30 17:17:24 Ubuntu-1004-lucid-32-minimal charon: 11[IKE] CHILD_SA closed
Jan 30 17:17:24 Ubuntu-1004-lucid-32-minimal charon: 11[CHD] updown: iptables: Bad rule (does a matching rule exist in that chain?).
Jan 30 17:17:24 Ubuntu-1004-lucid-32-minimal charon: 11[CHD] updown: iptables: Bad rule (does a matching rule exist in that chain?).
Jan 30 17:17:24 Ubuntu-1004-lucid-32-minimal vpn: - C=DE, ST=SH, O=O, OU=OU, CN=Laptop-Harry 172.32.0.2/32 == 80.187.95.5 -- 123.123.123.123
Jan 30 17:17:24 Ubuntu-1004-lucid-32-minimal charon: 11[ENC] generating INFORMATIONAL response 2 [ D ]
Jan 30 17:17:24 Ubuntu-1004-lucid-32-minimal charon: 11[NET] sending packet: from 123.123.123.123[4500] to 80.187.95.5[4500]

Weiß einer was das soll, bzw. wie man das verhindert?
 
Damit die Frage beantwortet wird hier die Lösung:

Fehler war hier, dass bei Definition der Verbindung in der ipsec.conf für WIN7 Roadwarrior das rekying deaktiviert werden muss. Alles andere mag WIN7 nicht.

Also so:
Code: 
conn rwWIN7 # WIN7 Roadwarrior
        rekey=no
        leftsubnet=0.0.0.0/0
        rightsourceip=172.16.1.0/24
 
You must log in or register to reply here.
Back
Top