pfSense Gold Subscription

Author Topic: Tunnel with PFS and a WatchGuard Firebox XTM 850  (Read 166 times)

0 Members and 1 Guest are viewing this topic.

Offline ngee

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
    • View Profile
Tunnel with PFS and a WatchGuard Firebox XTM 850
« on: November 30, 2017, 04:55:29 am »
Hey guys,

I fail to configure an IPsec tunnel between a virtualized PFsense and a watchguard hardware appliance in Phase 2.

It doesn't seem to matter what the opposite side and I configure in phase 1 or phase 2. Whenever Perfect Forward Secrecy is enabled, the connection fails with the error message below. I have tried all other variants of DH groups and hash algorithms. If PFS is active, the connection fails. We are able to transfer data with the same config but without PFS.


Does anyone have an idea? I am very grateful for all ideas and hints.


Code: [Select]
Nov 30 11:31:50 charon 10[IKE] <con1|2> initiating IKE_SA con1[2] to 2.2.2.2
Nov 30 11:31:50 charon 10[ENC] <con1|2> generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Nov 30 11:31:50 charon 10[NET] <con1|2> sending packet: from 1.1.1.1[500] to 2.2.2.2[500] (466 bytes)
Nov 30 11:31:50 charon 10[NET] <con1|2> received packet: from 2.2.2.2[500] to 1.1.1.1[500] (452 bytes)
Nov 30 11:31:50 charon 10[ENC] <con1|2> parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) V ]
Nov 30 11:31:50 charon 10[ENC] <con1|2> received unknown vendor ID: -snip-
Nov 30 11:31:50 charon 10[IKE] <con1|2> local host is behind NAT, sending keep alives
Nov 30 11:31:50 charon 10[IKE] <con1|2> authentication of '1.1.1.1' (myself) with pre-shared key
Nov 30 11:31:50 charon 10[IKE] <con1|2> establishing CHILD_SA con1{3}
Nov 30 11:31:50 charon 10[ENC] <con1|2> generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH N(ESP_TFC_PAD_N) SA TSi TSr N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
Nov 30 11:31:50 charon 10[NET] <con1|2> sending packet: from 1.1.1.1[4500] to 2.2.2.2[4500] (304 bytes)
Nov 30 11:31:50 charon 10[NET] <con1|2> received packet: from 2.2.2.2[4500] to 1.1.1.1[4500] (80 bytes)
Nov 30 11:31:50 charon 10[ENC] <con1|2> parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]
Nov 30 11:31:50 charon 10[IKE] <con1|2> received AUTHENTICATION_FAILED notify error


Current configuration:

P1
IKEv2
IPv4
Remote Gateway 2.2.2.2
Mutual PSK
My identifier 1.1.1.1
Peer identifier 2.2.2.2
Pre-Shared Key -snip-
Encryption Algorithm AES / 256 bits
Hash Algorithm SHA256
DH Group 14
Lifetime (Seconds) 28800
Margintime (Seconds) 3600
Dead Peer Detection Enabled


P2
Mode Tunnel IPv4
Local Network 10.10.10.0/24
Remote Network 11.11.11.0/24
Protocol ESP
Encryption Algorithms AES 256 bits
Hash Algorithms SHA256
PFS key group 14
Lifetime 3600 Seconds
« Last Edit: November 30, 2017, 05:43:56 am by ngee »

Offline ngee

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
    • View Profile
Re: Tunnel with PFS and a WatchGuard Firebox XTM 850
« Reply #1 on: December 01, 2017, 03:10:37 am »
Update, this is what the Firebox says:

Code: [Select]
[Related Logs]
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)******** RECV an IKE packet at 2.2.2.2:500(socket=13 ifIndex=10) from Peer 1.1.1.1:500 ********
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)Received IKEv2 "IKE_SA_INIT response" message with message-ID:0 length:440 SPI[i=ef54f93877ca1242 r=ed50ae0be361cd2f]
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)"IKE_SA_INIT response" message has 6 payloads [ SA(sz=48) KE(sz=264) NONCE(sz=36) N(sz=28) N(sz=28) N(sz=8)]
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)Got IKE policy 'gateway.something' from ikeSA(0x3bbc5b8)
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)dispatch the received IKE_SA_INIT response message - IkeSA(0x3bbc5b8)'s state=SA_INIT_I
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)The peer is behind NAT
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)The local is NOT behind NAT
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)non-supported notify type: 16404(N(MULTIPLE_AUTH_SUPPORTED)), ignore it
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)ENCR: found the matched ENCR algo - ENCR_AES_CBC_256
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)IKE proposal[#1] is matched - ENCR_AES_CBC/AUTH_HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/DH_GROUP14
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)stop the retry object(0x3bb9778) for the previous request message(name=IKE_SA_INIT request, msgId=0)
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)NATT: as the initiator, we need to float UDP port (myPort: 500 -> 4500, peerPort: 500 -> 4500), local 0 remote 1
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)Starting IKE_AUTH exchange. IKE policy:gateway.something opCode:4
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)peer does NOT support childless, do ikeConnectP1
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)'IKE_AUTH request' message created successfully. length:240
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)Sent out IKE_AUTH request message (msgId=1) from 2.2.2.2:4500 to 1.1.1.1:4500 for 'gateway.something' gateway endpoint successfully.
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)ikeSA(0x3bbc5b8) state change: SA_INIT_I ==> IKE_AUTH_I, reason: "IKE_AUTH request is Out"
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)ikeSA(0x3bbc5b8)'s msgIdSend is updated: 1 -> 2
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)******** RECV an IKE packet at 2.2.2.2:4500(socket=14 ifIndex=10) from Peer 1.1.1.1:4500 ********
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)Received IKEv2 "IKE_AUTH response" message with message-ID:1 length:144 SPI[i=ef54f93877ca1242 r=ed50ae0be361cd2f]
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)"IKE_AUTH response" message has 1 payloads [ ENCR(sz=116)]
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)Got IKE policy 'gateway.something' from ikeSA(0x3bbc5b8)
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)IKEv2 "IKE_AUTH response"'s decrypted message contains 4 payloads [ IDr(sz=12) AUTH(sz=40) N(sz=12) N(sz=8)]
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)dispatch the received IKE_AUTH response message - IkeSA(0x3bbc5b8)'s state=IKE_AUTH_I
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)non-supported notify type: 16403(N(AUTH_LIFETIME)), ignore it
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)remote gatway(1.1.1.1:4500)'s proposed ID matches the configured ID in the local ikePcy(gateway.something)
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)ikeSA(0x3bbc5b8) state change: IKE_AUTH_I ==> MATURE, reason: "Validated peer's ID in IKE_AUTH_RESPONSE successfully"
<158>Dec  1 09:12:43 iked[8304]: msg_id="021A-0017" (2.2.2.2<->1.1.1.1)IKEv2 IKE SA established successfully as initiator for 'gateway.something' gateway endpoint. local-gw:2.2.2.2:4500 remote-gw:1.1.1.1:4500 SA ID:0x6c505829.
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)IKESA(0x3bbc5b8) life-time timer started. original-life-time:28800 adjusted-life-time:28795 negotiation-role:initiator
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)ike2_P1StatusChange: notify ikePcy(gateway.something ver#2)'s status becomes "UP" (ikeSA=0x3bbc5b8)
<158>Dec  1 09:12:43 iked[8304]: (2.2.2.2<->1.1.1.1)stop the retry object(0x3a361c8) for the previous request message(name=IKE_AUTH request, msgId=1)
<158>Dec  1 09:12:44 iked[8304]: ikeDoDdpAction: received INIT_DPD message for SA dir:OUT
<158>Dec  1 09:12:52 iked[8304]: ikeDoDdpAction: received INIT_DPD message for SA dir:OUT
<158>Dec  1 09:12:55 iked[8304]: ikeDoDdpAction: received INIT_DPD message for SA dir:OUT
<158>Dec  1 09:12:57 iked[8304]: ikeDoDdpAction: received INIT_DPD message for SA dir:OUT
<158>Dec  1 09:12:58 iked[8304]: ikeDoDdpAction: received INIT_DPD message for SA dir:OUT
<158>Dec  1 09:12:59 iked[8304]: Trace file (/tmp/debug/ikemsg.log) exceeds limit (51269>51200).

Offline ngee

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
    • View Profile
Re: Tunnel with PFS and a WatchGuard Firebox XTM 850
« Reply #2 on: December 10, 2017, 01:25:53 am »
No one really has an idea?