Print Page - IPSEC with Radius no IKE config found

Title: IPSEC with Radius no IKE config found
Post by: lirees on March 14, 2023, 08:43:50 AM

i would migrate my pfsense installation to opnsense, all good but the configuration of the ipsec is a nightmare that i can't get over

i have always configure the ipsec with radius on pfsense in this way without problem, so i have reported all the steps on opnsense 23.1 ( fresh installation ) but not work ... i don't understand where i wrong

FQDN : vpn.mydomain.com ( for the external dns and as hostname of the opnsense machine )

System > Trust > Authorities
   Descriptive name : CA_IPSEC
   Common Name : vpn.mydomain.com
   Lifetime : 3650

System > Trust > Certificates
   Descriptive name : vpn.mydomain.com
   Type : Server Cerificate
   Lifetime : 3650
   Common Name : vpn.mydomain.com
   Alternative Names ( DNS ) : vpn.mydomain.com

- System > Access > Servers
   add and test the connection of the radius server

- Firewall > Rules > WAN
   open ports 500 and 4500 tpc/udp ipv4

- VPN > IPsec > Mobile Clients
   Enable : checked
   Backend for authentication : my_radius_server
   Virtual IPv4 Address Pool : 192.168.100.0/24
   Network List : checked
   DNS Default Domain : checked ( mydomain.loc )
   DNS Servers checked : 172.16.10.1
   Phase 2 PFS Group : OFF

- VPN > IPsec > Tunnel Settings ( phase 1 )
   Connection method : start on traffic ( try also the other )
   Key Exchange version : V2
   Authentication method : EAP-RADIUS
   My identifier ( DN ) : vpn.mydomain.com
   My Certificate : vpn.mydomain.com
   Radius servers : my_radius_server
   Hash algorithm : SHA256
   DH key group : 14
   Dead Peer Detection : checked
   Lifetime : 28800

- VPN > IPsec > Tunnel Settings ( phase 2 )
   Type : LAN Subnet
   Protocol : ESP
   Encryption algorithms : AES256
   Hash algorithms : SHA1, SHA256
   PFS key group : OFF
   Lifetime : 3600


then i download the CA_IPSEC cert on the windows 10/11 client and install on Local Machine under Trusted Root Certification Authorities

for the configuration of the ipsec connection client side i use a simply power shell script run as administrator

Add-VpnConnection -Name "MYOFFICE" -ServerAddress "vpn.mydomain.com" -TunnelType IKEv2 -AuthenticationMethod EAP -EncryptionLevel "Required" -SplitTunneling -AllUserConnection
Set-VpnConnectionIPsecConfiguration -ConnectionName "MYOFFICE" -AuthenticationTransformConstants SHA256128 -CipherTransformConstants AES256 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -DHGroup Group14 -PfsGroup None -PassThru -Force
Add-VpnConnectionRoute -ConnectionName "MYOFFICE" -DestinationPrefix 172.16.10.0/24 -PassThru

with pfsense this procedure work like charm, with opnsense the error when i try to connect is always ( opnsense side ):

[IKE] no IKE config found for xx.xx.xx.xxx. ...yyy.yyy.y.y..y.y, sending NO_PROPOSAL_CHOSEN
[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(FRAG_SUP) N(NATD_S_IP) N(NATD_D_IP) V V V V ]

on windows side :

The user [username] dialed a connection named [connection name] which has failed. The error code returned on failure is 13868.

i understand that the error in the logs is indicates that the IKEv2 security policy on the client did not match the configuration on the server but i can't don't understand where is the error and why whit pfsense work

Thanks in advance

P.S. why the IPEC service doesn't start automatically .. i need to run the command /usr/local/sbin/ipsec start from shell for have the service up and running

thanks

Title: Re: IPSEC with Radius no IKE config found
Post by: atom on March 14, 2023, 09:53:17 AM

Firewall > Rules > WAN
open ports 500 and 4500 tpc/udp ipv4

You need to open 500 and 4500 only for UDP, but the ESP rule is missing.

Title: Re: IPSEC with Radius no IKE config found
Post by: lirees on March 14, 2023, 10:06:53 AM

thanks for your reply

if you referring to ESP in phase 2 it is specified ..

- VPN > IPsec > Tunnel Settings ( phase 2 )
Type : LAN Subnet
Protocol : ESP
Encryption algorithms : AES256
Hash algorithms : SHA1, SHA256
PFS key group : OFF
Lifetime : 3600

i have changed the rule for port 500 and 4500 only udp but nothing change

Title: Re: IPSEC with Radius no IKE config found
Post by: lirees on March 14, 2023, 10:11:24 AM

sorry for the mistake

you refer to the ESP rule on wan interface... rule added problem still persist

Title: Re: IPSEC with Radius no IKE config found
Post by: atom on March 14, 2023, 11:04:39 AM

Please remove.
- VPN > IPsec > Mobile Clients
Virtual IPv4 Address Pool : 192.168.100.0/24
The IP address should be provided by the Radius server

- VPN > IPsec > Tunnel Settings ( phase 2 )
Type : LAN Subnet
Enter Network and 0.0.0.0/0 here

Title: Re: IPSEC with Radius no IKE config found
Post by: lirees on March 14, 2023, 11:24:22 AM

done .. no IKE config found for xxxxxxxx...xxxxxxx, sending NO_PROPOSAL_CHOSEN

Title: Re: IPSEC with Radius no IKE config found
Post by: atom on March 14, 2023, 11:45:21 AM

Maybe there is an issue with your certificates. Please run a trace.

Netsh trace start VpnClient per=yes maxsize=0 filemode=single

.... connection test ...

Netsh trace stop

The trace file file can be read with the Event Viewer. Use filter RRAS-Provider .

Title: Re: IPSEC with Radius no IKE config found
Post by: lirees on March 14, 2023, 12:37:43 PM

done ... this is the complete log

OPNsense Forum

English Forums => Virtual private networks => Topic started by: lirees on March 14, 2023, 08:43:50 AM