Mobile client VPN

[jeniczech92]

Hello community!

I am currently desperately trying to make Mobile IKEv2 work... and actually happened, but only on Win10 clients... with iOS I am still out of luck. Here's log when win client is connecting:

Code: [Select]

Mar  1 17:37:13 helios charon: 15[NET] <1> received packet: from 46.135.2.26[9127] to 192.168.0.2[500] (1104 bytes)
Mar  1 17:37:13 helios charon: 15[ENC] <1> parsed IKE_SA_INIT request 0 [ SA KE No N(FRAG_SUP) N(NATD_S_IP) N(NATD_D_IP) V V V V ]
Mar  1 17:37:13 helios charon: 15[IKE] <1> received MS NT5 ISAKMPOAKLEY v9 vendor ID
Mar  1 17:37:13 helios charon: 15[IKE] <1> received MS-Negotiation Discovery Capable vendor ID
Mar  1 17:37:13 helios charon: 15[IKE] <1> received Vid-Initial-Contact vendor ID
Mar  1 17:37:13 helios charon: 15[ENC] <1> received unknown vendor ID: 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:02
Mar  1 17:37:13 helios charon: 15[IKE] <1> 46.135.2.26 is initiating an IKE_SA
Mar  1 17:37:13 helios charon: 15[CFG] <1> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024
Mar  1 17:37:13 helios charon: 15[IKE] <1> local host is behind NAT, sending keep alives
Mar  1 17:37:13 helios charon: 15[IKE] <1> remote host is behind NAT
Mar  1 17:37:13 helios charon: 15[IKE] <1> sending cert request for "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"
Mar  1 17:37:13 helios charon: 15[IKE] <1> sending cert request for "C=CZ, ST=Prague, L=Prague, O=Home, E=my@e-mail.com, CN=Helios VPN"
Mar  1 17:37:13 helios charon: 15[ENC] <1> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(CHDLESS_SUP) N(MULT_AUTH) ]
Mar  1 17:37:13 helios charon: 15[NET] <1> sending packet: from 192.168.0.2[500] to 46.135.2.26[9127] (373 bytes)
Mar  1 17:37:13 helios charon: 15[NET] <1> received packet: from 46.135.2.26[9198] to 192.168.0.2[4500] (580 bytes)
Mar  1 17:37:13 helios charon: 15[ENC] <1> parsed IKE_AUTH request 1 [ EF(2/4) ]
Mar  1 17:37:13 helios charon: 15[ENC] <1> received fragment #2 of 4, waiting for complete IKE message
Mar  1 17:37:13 helios charon: 12[NET] <1> received packet: from 46.135.2.26[9198] to 192.168.0.2[4500] (580 bytes)
Mar  1 17:37:13 helios charon: 12[ENC] <1> parsed IKE_AUTH request 1 [ EF(3/4) ]
Mar  1 17:37:13 helios charon: 12[ENC] <1> received fragment #3 of 4, waiting for complete IKE message
Mar  1 17:37:13 helios charon: 13[NET] <1> received packet: from 46.135.2.26[9198] to 192.168.0.2[4500] (372 bytes)
Mar  1 17:37:13 helios charon: 13[ENC] <1> parsed IKE_AUTH request 1 [ EF(4/4) ]
Mar  1 17:37:13 helios charon: 13[ENC] <1> received fragment #4 of 4, waiting for complete IKE message
Mar  1 17:37:13 helios charon: 14[NET] <1> received packet: from 46.135.2.26[9198] to 192.168.0.2[4500] (580 bytes)
Mar  1 17:37:13 helios charon: 14[ENC] <1> parsed IKE_AUTH request 1 [ EF(1/4) ]
Mar  1 17:37:13 helios charon: 14[ENC] <1> received fragment #1 of 4, reassembled fragmented IKE message (1856 bytes)
Mar  1 17:37:13 helios charon: 14[ENC] <1> parsed IKE_AUTH request 1 [ IDi CERTREQ N(MOBIKE_SUP) CPRQ(ADDR DNS NBNS SRV) SA TSi TSr ]
Mar  1 17:37:13 helios charon: 14[IKE] <1> received cert request for "C=CZ, ST=Prague, L=Prague, O=Home, E=my@e-mail.com, CN=94.241.112.20, subjectAltName=IP:94.241.112.20"
Mar  1 17:37:13 helios charon: 14[IKE] <1> received cert request for "C=CZ, ST=Prague, L=Prague, O=Home, E=my@e-mail.com, CN=Helios VPN"
Mar  1 17:37:13 helios charon: 14[IKE] <1> received 69 cert requests for an unknown ca
Mar  1 17:37:13 helios charon: 14[CFG] <1> looking for peer configs matching 192.168.0.2[%any]...46.135.2.26[172.20.10.2]
Mar  1 17:37:13 helios charon: 14[CFG] <con1|1> selected peer config 'con1'
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> initiating EAP_IDENTITY method (id 0x00)
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> peer supports MOBIKE
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> authentication of 'C=CZ, ST=Prague, L=Prague, O=Home, E=my@e-mail.com, CN=94.241.112.20, subjectAltName=IP:94.241.112.20' (myself) with RSA signature successful
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> sending end entity cert "C=CZ, ST=Prague, L=Prague, O=Home, E=my@e-mail.com, CN=94.241.112.20, subjectAltName=IP:94.241.112.20"
Mar  1 17:37:13 helios charon: 14[ENC] <con1|1> generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
Mar  1 17:37:13 helios charon: 14[ENC] <con1|1> splitting IKE message (1760 bytes) into 2 fragments
Mar  1 17:37:13 helios charon: 14[ENC] <con1|1> generating IKE_AUTH response 1 [ EF(1/2) ]
Mar  1 17:37:13 helios charon: 14[ENC] <con1|1> generating IKE_AUTH response 1 [ EF(2/2) ]
Mar  1 17:37:13 helios charon: 14[NET] <con1|1> sending packet: from 192.168.0.2[4500] to 46.135.2.26[9198] (1236 bytes)
Mar  1 17:37:13 helios charon: 14[NET] <con1|1> sending packet: from 192.168.0.2[4500] to 46.135.2.26[9198] (612 bytes)
Mar  1 17:37:13 helios charon: 14[NET] <con1|1> received packet: from 46.135.2.26[9198] to 192.168.0.2[4500] (96 bytes)
Mar  1 17:37:13 helios charon: 14[ENC] <con1|1> parsed IKE_AUTH request 2 [ EAP/RES/ID ]
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> received EAP identity 'my@e-mail.com'
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> initiating EAP_MSCHAPV2 method (id 0xAE)
Mar  1 17:37:13 helios charon: 14[ENC] <con1|1> generating IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]
Mar  1 17:37:13 helios charon: 14[NET] <con1|1> sending packet: from 192.168.0.2[4500] to 46.135.2.26[9198] (112 bytes)
Mar  1 17:37:13 helios charon: 14[NET] <con1|1> received packet: from 46.135.2.26[9198] to 192.168.0.2[4500] (160 bytes)
Mar  1 17:37:13 helios charon: 14[ENC] <con1|1> parsed IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]
Mar  1 17:37:13 helios charon: 14[ENC] <con1|1> generating IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]
Mar  1 17:37:13 helios charon: 14[NET] <con1|1> sending packet: from 192.168.0.2[4500] to 46.135.2.26[9198] (144 bytes)
Mar  1 17:37:13 helios charon: 14[NET] <con1|1> received packet: from 46.135.2.26[9198] to 192.168.0.2[4500] (80 bytes)
Mar  1 17:37:13 helios charon: 14[ENC] <con1|1> parsed IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> EAP method EAP_MSCHAPV2 succeeded, MSK established
Mar  1 17:37:13 helios charon: 14[ENC] <con1|1> generating IKE_AUTH response 4 [ EAP/SUCC ]
Mar  1 17:37:13 helios charon: 14[NET] <con1|1> sending packet: from 192.168.0.2[4500] to 46.135.2.26[9198] (80 bytes)
Mar  1 17:37:13 helios charon: 14[NET] <con1|1> received packet: from 46.135.2.26[9198] to 192.168.0.2[4500] (112 bytes)
Mar  1 17:37:13 helios charon: 14[ENC] <con1|1> parsed IKE_AUTH request 5 [ AUTH ]
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> authentication of '172.20.10.2' with EAP successful
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> authentication of 'C=CZ, ST=Prague, L=Prague, O=Home, E=my@e-mail.com, CN=94.241.112.20, subjectAltName=IP:94.241.112.20' (myself) with EAP
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> IKE_SA con1[1] established between 192.168.0.2[C=CZ, ST=Prague, L=Prague, O=Home, E=my@e-mail.com, CN=94.241.112.20, subjectAltName=IP:94.241.112.20]...46.135.2.26[172.20.10.2]
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> scheduling reauthentication in 28249s
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> maximum IKE_SA lifetime 28789s
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> peer requested virtual IP %any
Mar  1 17:37:13 helios charon: 14[CFG] <con1|1> assigning new lease to 'my@e-mail.com'
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> assigning virtual IP 172.16.17.1 to peer 'my@e-mail.com'
Mar  1 17:37:13 helios charon: 14[CFG] <con1|1> selected proposal: ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ
Mar  1 17:37:13 helios charon: 14[IKE] <con1|1> CHILD_SA con1{1} established with SPIs c860689d_i d6e694d6_o and TS 172.16.16.0/24 === 172.16.17.1/32
Mar  1 17:37:13 helios charon: 14[ENC] <con1|1> generating IKE_AUTH response 5 [ AUTH CPRP(ADDR SUBNET DNS) N(ESP_TFC_PAD_N) SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) ]
Mar  1 17:37:13 helios charon: 14[NET] <con1|1> sending packet: from 192.168.0.2[4500] to 46.135.2.26[9198] (288 bytes)
Mar  1 17:38:00 helios charon: 12[IKE] <con1|1> sending DPD request
Mar  1 17:38:00 helios charon: 12[ENC] <con1|1> generating INFORMATIONAL request 0 [ ]
Mar  1 17:38:00 helios charon: 12[NET] <con1|1> sending packet: from 192.168.0.2[4500] to 46.135.2.26[9198] (80 bytes)
Mar  1 17:38:00 helios charon: 12[NET] <con1|1> received packet: from 46.135.2.26[9198] to 192.168.0.2[4500] (80 bytes)
Mar  1 17:38:00 helios charon: 12[ENC] <con1|1> parsed INFORMATIONAL response 0 [ ]
Mar  1 17:38:14 helios charon: 12[IKE] <con1|1> sending DPD request
Mar  1 17:38:14 helios charon: 12[ENC] <con1|1> generating INFORMATIONAL request 1 [ ]
Mar  1 17:38:14 helios charon: 12[NET] <con1|1> sending packet: from 192.168.0.2[4500] to 46.135.2.26[9198] (80 bytes)
Mar  1 17:38:15 helios charon: 12[NET] <con1|1> received packet: from 46.135.2.26[9198] to 192.168.0.2[4500] (80 bytes)
Mar  1 17:38:15 helios charon: 12[ENC] <con1|1> parsed INFORMATIONAL response 1 [ ]
Mar  1 17:38:16 helios charon: 12[NET] <con1|1> received packet: from 46.135.2.26[9198] to 192.168.0.2[4500] (80 bytes)
Mar  1 17:38:16 helios charon: 12[ENC] <con1|1> parsed INFORMATIONAL request 6 [ ]
Mar  1 17:38:16 helios charon: 12[ENC] <con1|1> generating INFORMATIONAL response 6 [ ]
Mar  1 17:38:16 helios charon: 12[NET] <con1|1> sending packet: from 192.168.0.2[4500] to 46.135.2.26[9198] (80 bytes)
Mar  1 17:38:25 helios charon: 12[NET] <con1|1> received packet: from 46.135.2.26[9198] to 192.168.0.2[4500] (80 bytes)
Mar  1 17:38:25 helios charon: 12[ENC] <con1|1> parsed INFORMATIONAL request 7 [ ]
Mar  1 17:38:25 helios charon: 12[ENC] <con1|1> generating INFORMATIONAL response 7 [ ]
Mar  1 17:38:25 helios charon: 12[NET] <con1|1> sending packet: from 192.168.0.2[4500] to 46.135.2.26[9198] (80 bytes)
Mar  1 17:38:35 helios charon: 15[IKE] <con1|1> sending DPD request
Mar  1 17:38:35 helios charon: 15[ENC] <con1|1> generating INFORMATIONAL request 2 [ ]
Mar  1 17:38:35 helios charon: 15[NET] <con1|1> sending packet: from 192.168.0.2[4500] to 46.135.2.26[9198] (80 bytes)
Mar  1 17:38:37 helios charon: 15[NET] <con1|1> received packet: from 46.135.2.26[9198] to 192.168.0.2[4500] (80 bytes)
Mar  1 17:38:37 helios charon: 15[ENC] <con1|1> parsed INFORMATIONAL request 8 [ D ]
Mar  1 17:38:37 helios charon: 15[IKE] <con1|1> received DELETE for IKE_SA con1[1]
Mar  1 17:38:37 helios charon: 15[IKE] <con1|1> deleting IKE_SA con1[1] between 192.168.0.2[C=CZ, ST=Prague, L=Prague, O=Home, E=my@e-mail.com, CN=94.241.112.20, subjectAltName=IP:94.241.112.20]...46.135.2.26[172.20.10.2]
Mar  1 17:38:37 helios charon: 15[IKE] <con1|1> IKE_SA deleted
Mar  1 17:38:37 helios charon: 15[ENC] <con1|1> generating INFORMATIONAL response 8 [ ]
Mar  1 17:38:37 helios charon: 15[NET] <con1|1> sending packet: from 192.168.0.2[4500] to 46.135.2.26[9198] (80 bytes)
Mar  1 17:38:37 helios charon: 15[CFG] <con1|1> lease 172.16.17.1 by 'my@e-mail.com' went offline

And the iPhone strangely gets stuck during ph1, so apparently there's something wrong with iPhone config, but i'm not really sure what exactly as the "no matching peer config found" sounds quite vague, and I can't really bend my head over the issue, as I believe I have already tried virtually every combination possible... So I hope someone more experienced might poke me in the right direction here

Code: [Select]

Mar  1 17:55:09 helios charon: 10[NET] <4> received packet: from 46.135.2.26[11867] to 192.168.0.2[500] (604 bytes)
Mar  1 17:55:09 helios charon: 10[ENC] <4> parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]
Mar  1 17:55:09 helios charon: 10[IKE] <4> 46.135.2.26 is initiating an IKE_SA
Mar  1 17:55:09 helios charon: 10[CFG] <4> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Mar  1 17:55:09 helios charon: 10[IKE] <4> local host is behind NAT, sending keep alives
Mar  1 17:55:09 helios charon: 10[IKE] <4> remote host is behind NAT
Mar  1 17:55:09 helios charon: 10[IKE] <4> sending cert request for "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"
Mar  1 17:55:09 helios charon: 10[IKE] <4> sending cert request for "C=CZ, ST=Prague, L=Prague, O=Home, E=my@e-mail.com, CN=Helios VPN"
Mar  1 17:55:09 helios charon: 10[ENC] <4> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(CHDLESS_SUP) N(MULT_AUTH) ]
Mar  1 17:55:09 helios charon: 10[NET] <4> sending packet: from 192.168.0.2[500] to 46.135.2.26[11867] (501 bytes)
Mar  1 17:55:09 helios charon: 10[NET] <4> received packet: from 46.135.2.26[11868] to 192.168.0.2[4500] (496 bytes)
Mar  1 17:55:09 helios charon: 10[ENC] <4> unknown attribute type INTERNAL_DNS_DOMAIN
Mar  1 17:55:09 helios charon: 10[ENC] <4> parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr CPRQ(ADDR MASK DHCP DNS ADDR6 DHCP6 DNS6 DOMAIN) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr N(MOBIKE_SUP) ]
Mar  1 17:55:09 helios charon: 10[CFG] <4> looking for peer configs matching 192.168.0.2[94.241.112.20]...46.135.2.26[10.132.115.89]
Mar  1 17:55:09 helios charon: 10[CFG] <4> no matching peer config found
Mar  1 17:55:10 helios charon: 10[IKE] <4> received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Mar  1 17:55:10 helios charon: 10[IKE] <4> peer supports MOBIKE
Mar  1 17:55:10 helios charon: 10[ENC] <4> generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
Mar  1 17:55:10 helios charon: 10[NET] <4> sending packet: from 192.168.0.2[4500] to 46.135.2.26[11868] (80 bytes)

[Plumber2]

Hello... I have the same issue ... did you manage to solve it ?


Sent from my iPhone using Tapatalk

[jeniczech92]

Not yet, I will update if I find something...

[Plumber2]

Thanks


Sent from my iPhone using Tapatalk

[RalfG]

created a quick'n dirty tutorial:

https://newsweb.w-3.de/Tutorials/Tutorial_MobIKE.pdf

IOS didn't work when using the fqdn, but the IP.

Ralf.

[jeniczech92]

Thanks for info.

Tried to re-make the configuration using tutorial provided...

One more thing: I am currently behind NAT, as unfortunately CPE provided by my ISP is not able to work as transparent bridge and I can't change the CPE due to ISP's policy. Does that need to be reflected in the certificates for example?

[RalfG]

jeniczech92,

can you provide an anonymous charon log excerpt while doing the IKE dialin? (VPN->IPSEC->Logfile)

Ralf.

[jeniczech92]

Hi RalfG,

It looks pretty much the same like before.

Code: [Select]

2020-03-02T16:14:30 charon: 13[NET] <2> sending packet: from 192.168.0.2[4500] to 80.188.77.210[4500] (80 bytes)
2020-03-02T16:14:30 charon: 13[ENC] <2> generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
2020-03-02T16:14:30 charon: 13[IKE] <2> peer supports MOBIKE
2020-03-02T16:14:30 charon: 13[IKE] <2> received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
2020-03-02T16:14:30 charon: 13[CFG] <2> no matching peer config found
2020-03-02T16:14:30 charon: 13[CFG] <2> looking for peer configs matching 192.168.0.2[94.241.112.20]...80.188.77.210[172.29.70.150]
2020-03-02T16:14:30 charon: 13[ENC] <2> parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr CPRQ(ADDR MASK DHCP DNS ADDR6 DHCP6 DNS6 DOMAIN) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr N(MOBIKE_SUP) ]
2020-03-02T16:14:30 charon: 13[ENC] <2> unknown attribute type INTERNAL_DNS_DOMAIN
2020-03-02T16:14:30 charon: 13[NET] <2> received packet: from 80.188.77.210[4500] to 192.168.0.2[4500] (496 bytes)
2020-03-02T16:14:27 charon: 13[NET] <2> sending packet: from 192.168.0.2[500] to 80.188.77.210[500] (521 bytes)
2020-03-02T16:14:27 charon: 13[ENC] <2> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(CHDLESS_SUP) N(MULT_AUTH) ]
2020-03-02T16:14:27 charon: 13[IKE] <2> sending cert request for "C=CZ, ST=Prague, L=Prague, O=Helios VPN, E=my@mail.com, CN=VPN CA"
2020-03-02T16:14:27 charon: 13[IKE] <2> sending cert request for "C=CZ, ST=Prague, L=Prague, O=Home, E=my@mail.com, CN=Helios VPN"
2020-03-02T16:14:27 charon: 13[IKE] <2> sending cert request for "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"
2020-03-02T16:14:27 charon: 13[IKE] <2> remote host is behind NAT
2020-03-02T16:14:27 charon: 13[IKE] <2> local host is behind NAT, sending keep alives
2020-03-02T16:14:27 charon: 13[CFG] <2> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
2020-03-02T16:14:27 charon: 13[IKE] <2> 80.188.77.210 is initiating an IKE_SA
2020-03-02T16:14:27 charon: 13[ENC] <2> parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]
2020-03-02T16:14:27 charon: 13[NET] <2> received packet: from 80.188.77.210[500] to 192.168.0.2[500] (604 bytes)
Anyway, thanks for your time & effort with me

[hbc]

Hey guys, please do not use DisableIKENameEduCheck and weaken your VPN setup!

Create the right vpn server certificate with correct extendedKeyUsage:

http://tiebing.blogspot.com/2012/05/windows-7-ikev2-error-13806.html?m=1