[7.900][BUG][FIXED] Site-to-Site VPN dead

After reinstalling my Astaro and import the old configuration from 7.504, the VPN's created over ACC was gone. Which is OK because RSA key may changed and/or the Astaro appears as new device in ACC. However, no big problem at all.

Accessed ACC, deleted the old VPN and recreated it with the new Astaro. But the VPN does not come up anymore.

It only shows "Error: No connection"

Attached debug log.

astaro_vpn_debug.txt.zip

0 Astaro Beta Bot over 15 years ago

Astaro Beta Report

--------------------------------

Version: 7.900

Type: BUG

State: CLOSED/FIXED

Reporter: Whity++

Contributor: Lionking, wrzmhe

MantisID: 13245

Target version: 7.901

Fixed in version: 7.901

--------------------------------

0 UrsWeiss over 15 years ago

Now made a manual VPN (without ACC) and preshared key. This works fine.

When using the settings which ACC has generated im my manual VPN, it can not connect anymore. When changing the Remote Gateway to the one i made myself (with preshared key), the connection is established again.

Checked the RSA key and they are correct.

So, the differences from the one which works and the one which does not are:
- Preshared key instead of RSA keys
- VPN IP is IP address instead of Hostname
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 UrsWeiss over 15 years ago

Oh, i was wrong, it still not fully works, even if i do it manually.

The networks which should be connected:
ASG V8: 192.168.23.0/24
ASG 7.502: 172.30.100.0/24, 172.30.101.0/24, 172.30.102.0/24

On the tunnel status page of the V8 box, it only shows the connection 192.168.23.0/24 172.30.100.0/24

On the tunnel status page of the 7.5 box, it shows all three connections, but only the one which is shown on the V8 box is establshed (green), the other two are down (red)

I checked the local and remote networks, they are correct on both sides.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 15 years ago

Have to check this on tuesday when i'm back at the office.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Lionking over 15 years ago in reply to kbr

Same error here!
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 d12fk over 15 years ago

This probably broke during V8 development. What key size do you use?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 UrsWeiss over 15 years ago in reply to d12fk

The RSA key was the default size of 1024. Also tried to regenerate the key and using a 2048 bit key. No change.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 d12fk over 15 years ago

I tried around a bit yesterday, it's the public key that's wrong. It's way too long. Will fix that right away, so it should be included in the next update.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 d12fk over 15 years ago

Please run the snippet from below in a shell on the V8. It will convert the malformed RSA public key encoding into something usable. After you've done so, you'll find the new public key in WebAdmin. Copy it to the V7 again and please report if the tunnels come up.

perl -e 'use MIME::Base64;
my $cc = "/usr/local/bin/confd-client.plx";
my $ref = qx($cc get ipsec local_rsa);
$ref =~ s/.*(REF_.{10}).*/\1/;
my $obj = qx($cc get_object ${ref});
$obj =~ s/get_object returned//;
$obj =~ s/0x00/0x/g;
$obj =~ /Modulus: 0x([0-9a-f]*)/;
my $hex = "0103$1";
my $pubkey = "0s". encode_base64(pack("H". length($hex), $hex), "");
$obj =~ s/0s[0-9a-zA-z\\/+=]*/$pubkey/;
qx($cc set_object "$obj");'

Edit: using Perl now for the script as plain shell ate whitespace in the private key.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 UrsWeiss over 15 years ago in reply to d12fk

It still does not come up.

Executed the perl stuff (Key has changed) and recreated the VPN from ACC. The keys on V8 and V7 matches.

I'll try to create it manually with the RSA keys tomorrow if i have some time left ten.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel