OPNsense Forum

Archive => 16.7 Legacy Series => Topic started by: miclan on October 24, 2016, 03:23:57 pm

Title: Setup IPsec Road-Warrior: Peer identifier doesn't appear
Post by: miclan on October 24, 2016, 03:23:57 pm
Hi, i'm new here. I just finished to setup my first OPNsense firewall and all the configurations i made start working as expected EXCEPT IPsec Road-Warrior for mobile client.
I follow this guide https://docs.opnsense.org/manual/how-tos/ipsec-road.html but i didn't find in webgui configuration the "Peer identifier" voice as shown on "Phase 1 proposal (Authentication)". I attached my screenshot.
Is it a bug? How can i setup "Peer identifier" in order to have a working configuration?
Could please someone help me?
Thanks!
Title: Re: Setup IPsec Road-Warrior: Peer identifier doesn't appear
Post by: franco on October 24, 2016, 07:44:05 pm
Hi miclan,

According to Ad our IPsec guy the peer identifier wasn't used for mobile clients and it was therefore removed.

Apart from the docs that will be fixed, why are you trying to set a peer identifier?


Cheers,
Franco
Title: Re: Setup IPsec Road-Warrior: Peer identifier doesn't appear
Post by: miclan on October 25, 2016, 10:37:32 am
I followed exactly this guide https://docs.opnsense.org/manual/how-tos/ipsec-road.html but i can't connect from my MacBook and from iPhone to my OPNsense firewall.
The only difference i noticed was the one related with "Peer identifier". That's why i asked about that.
Today i checked again the configuration. Everything is exactly as in the guide.
I have 2 working IPsec site to site tunnel configuration, but IPsec Road-Warrior doesn't work.

These are IPsec logs (i changed public ip with x.x.x.x):

Oct 25 10:18:45   charon: 04[NET] sending packet: from x.x.x.x[500] to x.x.x.x[500] (92 bytes)
Oct 25 10:18:45   charon: 04[ENC] generating INFORMATIONAL_V1 request 655026278 [ HASH N(AUTH_FAILED) ]
Oct 25 10:18:45   charon: 04[IKE] found 1 matching config, but none allows XAuthInitPSK authentication using Main Mode
Oct 25 10:18:45   charon: 04[IKE] <23> found 1 matching config, but none allows XAuthInitPSK authentication using Main Mode
Oct 25 10:18:45   charon: 04[CFG] looking for XAuthInitPSK peer configs matching x.x.x.x...x.x.x.x[x.x.x.x]
Oct 25 10:18:45   charon: 04[ENC] parsed ID_PROT request 0 [ ID HASH ]
Oct 25 10:18:45   charon: 04[NET] received packet: from x.x.x.x[500] to x.x.x.x[500] (76 bytes)
Oct 25 10:18:45   charon: 04[NET] sending packet: from x.x.x.x[500] to x.x.x.x[500] (244 bytes)
Oct 25 10:18:45   charon: 04[ENC] generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
Oct 25 10:18:45   charon: 04[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
Oct 25 10:18:45   charon: 04[NET] received packet: from x.x.x.x[500] to x.x.x.x[500] (228 bytes)
Oct 25 10:18:45   charon: 12[NET] sending packet: from x.x.x.x[500] to x.x.x.x[500] (160 bytes)
Oct 25 10:18:45   charon: 12[ENC] generating ID_PROT response 0 [ SA V V V V ]
Oct 25 10:18:45   charon: 12[IKE] x.x.x.x is initiating a Main Mode IKE_SA
Oct 25 10:18:45   charon: 12[IKE] <23> x.x.x.x is initiating a Main Mode IKE_SA
Oct 25 10:18:45   charon: 12[IKE] received DPD vendor ID
Oct 25 10:18:45   charon: 12[IKE] <23> received DPD vendor ID
Oct 25 10:18:45   charon: 12[IKE] received FRAGMENTATION vendor ID
Oct 25 10:18:45   charon: 12[IKE] <23> received FRAGMENTATION vendor ID
Oct 25 10:18:45   charon: 12[IKE] received Cisco Unity vendor ID
Oct 25 10:18:45   charon: 12[IKE] <23> received Cisco Unity vendor ID
Oct 25 10:18:45   charon: 12[IKE] received XAuth vendor ID
Oct 25 10:18:45   charon: 12[IKE] <23> received XAuth vendor ID
Oct 25 10:18:45   charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Oct 25 10:18:45   charon: 12[IKE] <23> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Oct 25 10:18:45   charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID
Oct 25 10:18:45   charon: 12[IKE] <23> received draft-ietf-ipsec-nat-t-ike-02 vendor ID
Oct 25 10:18:45   charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID
Oct 25 10:18:45   charon: 12[IKE] <23> received draft-ietf-ipsec-nat-t-ike-03 vendor ID
Oct 25 10:18:45   charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-04 vendor ID
Oct 25 10:18:45   charon: 12[IKE] <23> received draft-ietf-ipsec-nat-t-ike-04 vendor ID
Oct 25 10:18:45   charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-05 vendor ID
Oct 25 10:18:45   charon: 12[IKE] <23> received draft-ietf-ipsec-nat-t-ike-05 vendor ID
Oct 25 10:18:45   charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-06 vendor ID
Oct 25 10:18:45   charon: 12[IKE] <23> received draft-ietf-ipsec-nat-t-ike-06 vendor ID
Oct 25 10:18:45   charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-07 vendor ID
Oct 25 10:18:45   charon: 12[IKE] <23> received draft-ietf-ipsec-nat-t-ike-07 vendor ID
Oct 25 10:18:45   charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-08 vendor ID
Oct 25 10:18:45   charon: 12[IKE] <23> received draft-ietf-ipsec-nat-t-ike-08 vendor ID
Oct 25 10:18:45   charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike vendor ID
Oct 25 10:18:45   charon: 12[IKE] <23> received draft-ietf-ipsec-nat-t-ike vendor ID
Oct 25 10:18:45   charon: 12[IKE] received NAT-T (RFC 3947) vendor ID
Oct 25 10:18:45   charon: 12[IKE] <23> received NAT-T (RFC 3947) vendor ID
Oct 25 10:18:45   charon: 12[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V V V V V V ]
Oct 25 10:18:45   charon: 12[NET] received packet: from x.x.x.x[500] to x.x.x.x[500] (848 bytes)
Title: Re: Setup IPsec Road-Warrior: Peer identifier doesn't appear
Post by: franco on October 26, 2016, 11:52:40 am
It looks like this is "Negotiation mode" set to main, not to aggressive as the docs state:

Oct 25 10:18:45   charon: 04[IKE] found 1 matching config, but none allows XAuthInitPSK authentication using Main Mode

As far as the peer identifier goes: since OPNsense is the server for mobile, there is no concept of a peer so the setting was never used, so it was shown and documented by accident.


Cheers,
Franco
Title: Re: Setup IPsec Road-Warrior: Peer identifier doesn't appear
Post by: miclan on October 26, 2016, 12:20:09 pm
Yes Franco, i thought the same but i checked again and i set "Aggressive Mode" on Phase 1 proposal (Authentication).
Could be a bug?
What can i do to be sure to have set "Aggressive Mode"?
Title: Re: Setup IPsec Road-Warrior: Peer identifier doesn't appear
Post by: miclan on October 26, 2016, 01:30:34 pm
I tried with "Main" instead of "Aggressive" on Negotiation Mode (Phase 1 proposal Authentication) and everything works correctly. Now i can connect using native IPsec VPN on iPhone and Mac without any problem.
Do you think is a "normal" behavior?
Is it OK to use VPN IPsec Mobile Clients connection with "Main" Negotiation Mode instead of "Aggressive" (suggested in the guide)?
Title: Re: Setup IPsec Road-Warrior: Peer identifier doesn't appear
Post by: franco on October 26, 2016, 06:29:34 pm
Hmmm, what's the output of:

# grep i_dont_care_about_security_and_use_aggressive_mode_psk /usr/local/etc/strongswan.conf

(not kidding....)


Cheers,
Franco
Title: Re: Setup IPsec Road-Warrior: Peer identifier doesn't appear
Post by: miclan on October 27, 2016, 08:53:57 am
# grep i_dont_care_about_security_and_use_aggressive_mode_psk /usr/local/etc/strongswan.conf
gave me back nothing

So I want to watch stongswan.conf

# cat /usr/local/etc/strongswan.conf

#Automatically generated please do not modify
starter {
    load_warning = no
}

charon {

    # number of worker threads in charon
    threads = 16
    ikesa_table_size = 32
    ikesa_table_segments = 4
    init_limit_half_open = 1000;

    # And two loggers using syslog. The subsections define the facility to log
    # to, currently one of: daemon, auth.
    syslog {
      identifier = charon
      # default level to the LOG_DAEMON facility
      daemon {
      }
      # very minimalistic IKE auditing logs to LOG_AUTHPRIV
      auth {
        default = -1
        ike = 1
        ike_name = yes
      }
    }   plugins {
      attr {
      subnet = 10.0.0.0/24
      }
   xauth-generic {
      script = /usr/local/etc/inc/ipsec.auth-user.php
      authcfg = Local Database
   }
   }
}


I read some useful informations about "Aggressive" mode from here https://wiki.strongswan.org/projects/strongswan/wiki/FAQ#Aggressive-Mode and i understood that is a very insicure way to configure IPsec connections.

Quote
Aggressive Mode
Q: Does strongSwan support IKEv1 Aggressive Mode?

A: Since version 5.0.0 the answer is yes. For previous releases, where the IKEv1 protocol was handled by the pluto daemon, the answer is and remains no.
However, the strongSwan developers still recommend to avoid its use with pre-shared keys. This is due to a known weakness of the protocol. With Aggressive Mode, a hash of the pre-shared key is transmitted in clear-text. An eavesdropper can capture this hash and run an offline brute-force attack against it. Once the pre-shared key is known MITM attacks to gather the XAuth credentials can easily be executed. Aggressive Mode is therefore incompatible with the basic principles of the strongSwan project which is to deliver a product that meets high security standards. That's why, in order to use Aggressive Mode with pre-shared keys as responder (i.e. on gateways) it is required to set charon.i_dont_care_about_security_and_use_aggressive_mode_psk=yes in strongswan.conf. As promised often in numerous public and private talks strongSwan then changes its name to weakSwan. It is not required to set this option for clients as they often have no other choice.

To avoid Aggressive Mode with pre-shared keys (and other short-comings of IKEv1 Main or Aggressive Mode) the best option is to switch to IKEv2. But even for IKEv1 strongSwan 5.0.0 now provides an easy to deploy alternative: hybrid authentication. This mode uses a certificate to authenticate the gateway and only XAuth to authenticate the client, during Phase 1 (Main or Aggressive Mode) the client is not authenticated.

So now my questions are:
- Is it correct that now with "Main Mode" instead of "Aggressive Mode" my Mobile IPsec VPN is working without any problems?
- Is it correct that in my strongswan.conf i miss "i_dont_care_about_security_and_use_aggressive_mode_psk"
- Is this a secure configuration and the only reccomended in OPNsense official documentation?

Thanks.