ipsec config with x509 certificates

[Eric Belhomme]

Hi,

I'm in the process of upgrading and existing netBSD gateway to a fresh
new openBSD gateway.
So I have to re-create IPSec tunnel between other netBSD and Linux
gateways.

I have to precise I am more familiar with racoon/setkey than
ipsectl/isakmpd couple (in fact, it's the first time I use ipsec on
openbsd)

So here is the way I proceed :

o I created gif interfaces for tunneling traffic between my gateways :

ifconfig gif0 create 10.20.31.1 10.20.31.2 netmask 255.255.255.255
tunnel x.x.x.190 x.x.x.145

The gif tunnels are working on both netBSD and Linux endpoints.
Then I tried to convert my racoon and ipsec setup to openBSD scheme :

- copying my ca cert on /etc/isakmpd/ca/ca.crt
- copying my host private key on /etc/isakmpd/private/local.key
- copying my host public key on /etc/isakmpd/keynote/<my
FQDN>/credentials
- editing /etc/ipsec.conf like this :

ike dynamic esp transport from 10.20.31.1 to 10.20.31.2 \
local x.x.x.190 peer x.x.x.145 \
main auth hmac-sha1 enc 3des group modp1024

The thing I can't figure is HOW the x509 certificates are handled,
because I'm not sure I did the right things :

on the racoon side I get these errors :

Mar 13 18:09:49 gw racoon: ERROR: no peer's CERT payload found.
Mar 13 18:09:56 gw racoon: WARNING: ignore INITIAL-CONTACT notification,
because it is only accepted after phase1.
Mar 13 18:09:56 gw racoon: WARNING: No ID match.
Mar 13 18:09:56 gw racoon: ERROR: no peer's CERT payload found.
Mar 13 18:10:39 gw racoon: ERROR: phase1 negotiation failed due to time
up. 69f8819d392c1514:0d37bc20084a06be
Mar 13 18:11:12 gw racoon: ERROR: Invalid CERT type 11

Thanks for any pointers you could provide !

--
Eric Belhomme

[demime 1.01d removed an attachment of type application/x-pkcs7-signature which had a name of smime.p7s]

[Toni Mueller]

Hi Eric,

Post by Eric Belhomme
- copying my host private key on /etc/isakmpd/private/local.key
- copying my host public key on /etc/isakmpd/keynote/<my FQDN>/credentials

I was so far unable to get this keynote-credentials stuff working.
Therefore I set up X.509 authentication like this:

With the x509 cert consisting of the two parts cert.crt and cert.key, I
place the cert.key file in /etc/isakmpd/private and the cert.crt file
in /etcisakmpd/certs. The cert has to be issued by a CA a cert of which
is present in /etc/isakmpd/ca, and the name of the files has to
correspond to the value of the SubjectAlternativeName section, which I
mention in my isakmpd.conf and isakmpd.policy files.

Post by Eric Belhomme
The thing I can't figure is HOW the x509 certificates are handled,

On OpenBSD, you can watch the negotiation using this command (assuming
that fxp0 is your Internet-facing NIC:

# tcpdump -s1500 -vvv -ni fxp0 host <your_peer> and \( port 500 or port 4500 or esp \)



Kind regards,
--Toni++