IPSEC VPN Linux Mint 19 does not work

Reply to IPSEC VPN Linux Mint 19 does not work on Fri, 21 Sep 2018 13:31:46 GMT

KOM — Fri, 21 Sep 2018 13:31:46 GMT

Makes sense.

And thanks for posting your solution. Many people end up fixing their problems and don't come back to update their post to help other people in the future.

Reply to IPSEC VPN Linux Mint 19 does not work on Fri, 21 Sep 2018 13:21:13 GMT

mmangiante — Fri, 21 Sep 2018 13:21:13 GMT

Hello @kom

no any reason in particular: we have few users with Linux in our company, so I started from Windows trying to resemble the vpn that we are using with our old SnapGear firewall with radius authentication; because the documentation I followed
Configuring an IPsec Remote Access Mobile VPN using IKEv2 with EAP-MSCHAPv2 has also the steps for Linux, I tried to configured the Mint 18 and 19 that our colleagues have on their notebooks.
I think that because I have seen that it was not so simple, I accepted it as a challenge and so continued until I have a working configuration; it turn out to be a great learning prove and now I have some more knowledge of ipsec and vpn.
Now I think that another step is to going with OpenVPN.

--
Regards,

Marco

Reply to IPSEC VPN Linux Mint 19 does not work on Fri, 21 Sep 2018 13:04:37 GMT

KOM — Fri, 21 Sep 2018 13:04:37 GMT

Just curious, but is there any reason you're not going with OpenVPN? I'm also a Linux Mint user at home, and I use OpenVPN to connect to pfSense at the office. It was simple to get it working. I've always found IPSec to be more troublesome.

Reply to IPSEC VPN Linux Mint 19 does not work on Fri, 21 Sep 2018 10:17:33 GMT

mmangiante — Fri, 21 Sep 2018 10:17:33 GMT

I suppose I have resolved: on the linux Mint 19 I have the GUI installed so when I try to connect with Network Manager, in the dialog there is a new part where you can enable a custom proposal, so I checked it and inserted in ike field the right proposal, that in my case is the "configure proposals" that is shown in the log.

To understand how to "convert" the IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024 in "usable" ike in the dialog, I used this page IKEv2 Cipher Suites and also, to understand how build the proposal this Man page ipsec where I found that

The notation is encryption-integrity[-prf]-dhgroup.

in the ike reference.

So, in my case, I filled the ike field with:

aes256-sha2_256-prfsha256-modp104

However, at this time, I don't know why Mint 19 doesn't pass DH in the proposal and why there is this change from Mint 18, where I have no issue in encryption configuration like this.