strongSwan

= Frequently Asked Questions =

'''Q:''' ''I'm trying to set up a VPN tunnel with a ZyXELL/Linksys/X router but the other side keeps on telling me "no proposal chosen" when strongSwan initiates the connection.''

'''A:''' Make sure that the peer supports all the algorithms (including the key lengths) which strongSwan proposes for IKE and ESP. In terms of IKE, the proposal consists of the following parts: Encryption algorithm, hash algorithm (PRF) and DH group. In terms of ESP the proposal includes the following: Encryption algorithm, hash algorithm, pfs group (DH group) and '''compression algorithm'''. There are lots of IPSec implementations out there that do '''not''' support compression or have implemented it erronously. So the first thing to try in this situation is to switch compression off on the peer. strongSwan's default setting is

{{{

compress=no

}}} 

See also Chapter [http://www.strongswan.org/docs/readme4.htm#section_14.1 14.1 Authentication and encryption algorithms] of the strongSwan documentation. It has good information about the relevant parameters.

'''Q:''' ''I'm getting the error message "no RSA public key known for '....' ". What am I doing wrong? ''

'''A:''' If you are using RSA based signatures for authentication strongSwan needs to have the peer's RSA public key in order to verify its authentication. This public key can be provided either by using the {{{rightrsasigkey}}} directive in the configuration file which was popular with FreeS/WAN or it can be extracted from the peer's X.509 certificate. This certificate can in turn be preloaded via the {{{rightcert}}} directive if it is available locally or it can be requested from the remote end by a ''certificate request''. Now if the certificate is missing one reason might be that the remote end refused to send it. Another reason could be that strongSwan did not send a ''certificate request''. This happens if you set the {{{nocrsend}}} option to {{{yes}}}. The Astaro Security Gateway which uses strongSwan behind the scene is known to do that. In order to make the IPSec connection work in that scenario you need to set {{{leftsendcert}}} to {{{yes}}} on the other end. With {{{leftsendcert=yes}}} strongSwan sends its certificate across even if no ''certificate request'' was received. This helps to interoperate with some misconfigured peers.

'''Q:''' ''I want to set up strongSwan to interoperate with Microsoft Windows using L2TP/IPsec. I'm getting the error message "NAT-Traversal: Transport mode disabled due to security concerns" which results in strongSwan sending an encrypted notification BAD_PROPOSAL_SYNTAX''

'''A:''' Here is a quote from strongSwan lead developer Andres Steffen on how to deal with this problem:

NAT-Traversal with IPsec transport mode has some inherent security risks.

Since Microsoft doesn't care about this please compile strongSwan with the option

{{{

./configure  --enable-nat-transport

}}}

end of quote

'''Q:''' ''Does strongSwan support IKEv1 Aggressive Mode?''

'''A:''' Quote from Andreas Steffen: "No, strongSwan does '''not''' support IKEv1 Aggressive Mode and '''never''' will. Otherwise we would have called the project "weakSwan". "