pfSense 26.07-RELEASE / CE 2.9.0, IPSEC IKE v1 Error: no XAuth secret found

bon-go

Hello,

We updated several pfSense Plus instances from 26.03.1 to 26.07 and CE instances from 2.8.1 to 2.9.0; since then, IPsec VPN Roadwarrior access has stopped working.

The error in the pfSense IPsec log is:
charon 42790 14[IKE] <con-mobile|1> no XAuth secret found for 'xxx.xxx.xxx.xxx' - 'vpnuser1'
charon 42790 14[IKE] <con-mobile|1> XAuth authentication of 'vpnuser1' failed

The setup involves RoadWarrior connections using IKEv1, Mutual PSK + Xauth, AES 256 + SHA256 + DH14 in Phase 1, and AES256 + SHA1+SHA256 without PFS in Phase 2. The clients use the NCP Secure Entry Client.

Everything worked fine with pfSense Plus 26.03.1 and CE 2.8.1.
The following checks were performed:

[2.9.0-RELEASE][root@xxxxxxx.de]/root: grep -A5 xauth-generic /var/etc/ipsec/strongswan.conf
xauth-generic {
script = /etc/inc/ipsec.auth-user.php
authcfg = Local Database
}
[2.9.0-RELEASE][root@xxxxxxx.de]/root: ls -sahl /etc/inc/ipsec.auth-user.php
5 -rwxr-xr-x  1 root wheel  3.7K Aug 17 20:35 /etc/inc/ipsec.auth-user.php

The pfSense user was completely recreated (including the password), and the privilege "User - VPN: IPsec xauth Dialin" was assigned. Under VPN / IPsec / Mobile Clients, IPsec Mobile Client Support was disabled and re-enabled, User Authentication is set to "Local Database" and the IPsec service was stopped and restarted. None of this is getting us anywhere.

What is a solution to the problem?

bon-go

ls -l /usr/local/etc/strongswan.conf
lrwxr-xr-x  1 root wheel 30 Sep 23 16:19 /usr/local/etc/strongswan.conf -> /var/etc/ipsec/strongswan.conf

readlink /usr/local/etc/strongswan.conf
/var/etc/ipsec/strongswan.conf

grep -n script /usr/local/etc/strongswan.conf /var/etc/ipsec/strongswan.conf
/usr/local/etc/strongswan.conf:53:                      script = /etc/inc/ipsec.auth-user.php
/var/etc/ipsec/strongswan.conf:53:                      script = /etc/inc/ipsec.auth-user.php

diff /usr/local/etc/strongswan.conf /var/etc/ipsec/strongswan.conf
<no difference>

ls -l /usr/local/bin/php-cgi
-rwxr-xr-x  1 root wheel 11303544 Aug  3 19:37 /usr/local/bin/php-cgi

strings /usr/local/lib/ipsec/plugins/libstrongswan-xauth-generic.so | grep -i script
<no output>

Maybe this is the problem: no pfSense Patch in StrongSwan.

wapsi87

I'm facing this exact issue. The XAuth in combination of mTLS/PKI auth with IKEv1 is not working anymore after I upgraded my PfSense from 2.8.1 to 2.9.0. The error is the same than @bon-go's:

<30>Oct  6 13:10:33 192.168.4.1 charon[42061]: 07[IKE] <con-mobile|447> no XAuth secret found for 'foo' - 'my-username'
<30>Oct  6 13:10:33 192.168.4.1 charon[42061]: 07[IKE] <con-mobile|447> XAuth authentication of 'my-username' failed
<30>Oct  6 13:10:33 192.168.4.1 charon[42061]: 07[IKE] <con-mobile|447> reinitiating already active tasks
<30>Oct  6 13:10:33 192.168.4.1 charon[42061]: 07[IKE] <con-mobile|447>   XAUTH task

It's a local database user and I tried to set a new password for that and update it to the client as well, but I still get the same error. I think it could be a bug introduced in the PfSense v2.9.0? I didn't change any IPsec related settings during the upgrade or at the client device. The test authentication (Diagnostics -> Authentication) works fine, though.

tinfoilmatt

https://en.wikipedia.org/wiki/IKEv2#Improvements_with_IKEv2

SteveITS

https://forum.netgate.com/topic/201351/heads-up-ikev1-is-deprecated-move-to-ikev2

bon-go

@SteveITS
Yes, I was already aware of jimp's announcement before the switch to v2.9.0. It doesn't say anywhere that it stops working after the version upgrade. Thanks for mentioning it again, but that’s neither an explanation nor a solution, and it doesn't help us here. That will come later, but not just yet.

again:
Is there a current solution to the problem - while sticking with IPsec and IKEv1?
Is this really a bug in the pfSense builds?

wapsi87

@bon-go said in pfSense 26.07-RELEASE / CE 2.9.0, IPSEC IKE v1 Error: no XAuth secret found:

@SteveITS
Yes, I was already aware of jimp's announcement before the switch to v2.9.0. It doesn't say anywhere that it stops working after the version upgrade. Thanks for mentioning it again, but that’s neither an explanation nor a solution, and it doesn't help us here. That will come later, but not just yet.

again:
Is there a current solution to the problem - while sticking with IPsec and IKEv1?
Is this really a bug in the pfSense builds?

Yes, I also thought that deprecation and breaking stuff are two differrent things, but I guess I was wrong.

SteveITS

Just to be clear I wasn’t saying it was removed. Just that one shouldn’t expect it to work long term.

Per the other post one can see the new Strongswsn version might not even be installed, depending on when one’s router was upgraded (and when the message was edited).

Some developers use the word “deprecated” to mean “we already removed it” which is mildly infuriating to me. AFAIK Netgate uses it correctly.

I think I’ve never used v1 so I don’t have an answer to the question.

tinfoilmatt

No, they are. You're at least clear on that much.