Help with VPN (CentOS client connecting to SonicWall)

[bvz]

Hi,

I'm not a networking guy.

I'm trying to connect to my Employer's VPN using my CentOS box running Gnome.

I used the GUI Network configuration panel.

I entered in the Gateway IP address (verified with a ping that it is reachable)
I entered my username
I left the user password blank
I entered the pre-shared key (and verified it numerous times)
Under advanced, for both Phase 1 and Phase 2, I entered:
aes256-sha1;modp1024

Nothing works. It tries for a while to connect and then seems to time out.

Now I am sort of out of ideas. Here is the output of a bunch of different commands that I have collected from the internet, but they are all a bit out of my level of understanding.

Here are the contents of my /etc/NetworkManager/system-connections/Employer file (Employer is what I named my VPN profile)

Code: Select all

[connection]
id=Employer
uuid=<some redacted text>
type=vpn
autoconnect=false
permissions=user:me:;

[vpn]
esp=aes256-sha1;modp1024
ike=aes256-sha1;modp1024
leftxauthusername=me
pskinputmodes=save
pskvalue-flags=0
right=NN.NN.NN.N
xauthpassword-flags=2
xauthpasswordinputmodes=ask
service-type=org.freedesktop.NetworkManager.libreswan

[vpn-secrets]
pskvalue=<Pre Shared Key Redacted>

[ipv4]
dns-search=
method=auto

[ipv6]
addr-gen-mode=stable-privacy
dns-search=
method=auto

Here are some lines from my /var/log/messages file: (I redacted some things that I don't understand and probably don't need redacting... but I'm trying to be careful)

Code: Select all

Sep 15 23:33:33 localhost NetworkManager[1026]: <info>  [1505543613.6702] audit: op="connection-activate" uuid="<redacted>" name="Employer" pid=2957 uid=1000 result="success"
Sep 15 23:33:33 localhost NetworkManager[1026]: <info>  [1505543613.6764] vpn-connection[0x5617adb9f2d0,<redacted>,"Employer",0]: Started the VPN service, PID 13658
Sep 15 23:33:33 localhost NetworkManager[1026]: <info>  [1505543613.6851] vpn-connection[0x5617adb9f2d0,c<redacted>,"Employer",0]: Saw the service appear; activating connection
Sep 15 23:33:33 localhost NetworkManager[1026]: <info>  [1505543613.8241] keyfile: update /etc/NetworkManager/system-connections/Employer (<redacted>,"Employer")
Sep 15 23:33:41 localhost NetworkManager[1026]: <info>  [1505543621.1352] keyfile: update /etc/NetworkManager/system-connections/Employer (<redacted>,"Employer")
Sep 15 23:33:41 localhost NetworkManager[1026]: <info>  [1505543621.1370] keyfile: update /etc/NetworkManager/system-connections/Employer (<redacted>,"Employer") after persisting connection
Sep 15 23:33:41 localhost NetworkManager[1026]: <info>  [1505543621.1624] vpn-connection[0x5617adb9f2d0,c<redacted>,"Employer",0]: VPN plugin: state changed: starting (3)
Sep 15 23:33:41 localhost NetworkManager[1026]: <info>  [1505543621.1625] vpn-connection[0x5617adb9f2d0,<redacted>,"Employer",0]: VPN connection: (ConnectInteractive) reply received
Sep 15 23:33:41 localhost NetworkManager: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Sep 15 23:33:41 localhost kernel: AVX instructions are not detected.
Sep 15 23:33:41 localhost kernel: AVX instructions are not detected.
Sep 15 23:33:41 localhost kernel: AVX instructions are not detected.
Sep 15 23:33:41 localhost kernel: AVX instructions are not detected.
Sep 15 23:33:41 localhost kernel: AVX instructions are not detected.
Sep 15 23:33:41 localhost kernel: AVX or AES-NI instructions are not detected.
Sep 15 23:33:41 localhost kernel: AVX or AES-NI instructions are not detected.
Sep 15 23:33:41 localhost NetworkManager: 002 listening for IKE messages
Sep 15 23:33:41 localhost NetworkManager: 002 adding interface virbr0/virbr0 192.168.122.1:500
Sep 15 23:33:41 localhost NetworkManager: 002 adding interface virbr0/virbr0 192.168.122.1:4500
Sep 15 23:33:41 localhost NetworkManager: 002 adding interface enp6s0/enp6s0 192.168.2.2:500
Sep 15 23:33:41 localhost NetworkManager: 002 adding interface enp6s0/enp6s0 192.168.2.2:4500
Sep 15 23:33:41 localhost NetworkManager: 002 adding interface lo/lo 127.0.0.1:500
Sep 15 23:33:41 localhost NetworkManager: 002 adding interface lo/lo 127.0.0.1:4500
Sep 15 23:33:41 localhost NetworkManager: 002 adding interface lo/lo ::1:500
Sep 15 23:33:41 localhost NetworkManager: 002 loading secrets from "/etc/ipsec.secrets"
Sep 15 23:33:41 localhost NetworkManager: 002 loading secrets from "/etc/ipsec.d/ipsec-<redacted>.secrets"
Sep 15 23:34:41 localhost NetworkManager[1026]: <warn>  [1505543681.3968] vpn-connection[0x5617adb9f2d0,<redacted>,"Employer",0]: VPN connection: connect timeout exceeded.
Sep 15 23:34:41 localhost journal: Connect timer expired, disconnecting.
Sep 15 23:34:41 localhost NetworkManager: 002 shutting down
Sep 15 23:34:41 localhost NetworkManager[1026]: <warn>  [1505543681.4052] vpn-connection[0x5617adb9f2d0,<redacted>,"Employer",0]: VPN plugin: failed: connect-failed (1)
Sep 15 23:34:41 localhost NetworkManager[1026]: <info>  [1505543681.4052] vpn-connection[0x5617adb9f2d0,<redacted>,"Employer",0]: VPN plugin: state changed: stopping (5)
Sep 15 23:34:41 localhost NetworkManager[1026]: <info>  [1505543681.4052] vpn-connection[0x5617adb9f2d0,<redacted>,"Employer",0]: VPN plugin: state changed: stopped (6)

Here are the results of me running ike-scan:

Code: Select all

ike-scan NN.NN.NN.N
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
NN.NN.NN.N	Main Mode Handshake returned HDR=(CKY-R=<redacted>) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) VID=<redacted>

Ending ike-scan 1.9: 1 hosts scanned in 0.037 seconds (26.81 hosts/sec).  1 returned handshake; 0 returned notify

And here are the settings that I got from our IT guy (he basically just set up the SonicWall in its default state and doesn't fully understand it, so he isn't really able to help me out):

Code: Select all

Phase 1:

DH Group: Group 2
Encryption: aes-256
Authentication: SHA1

Phase 2 is:

Protocol: ESP
Encryption: aes-256
authentication: sha1

I am able to connect from my Mac (which never actually asks me for anything other than the IP address, PSK, and password - but it connect without an issue).



I know I just vomited a bunch of info into my post, but I am really stuck and I appreciate any help, even if it just a clue that moves me on to the next step in solving this. Thanks!

[TrevorH]

Judging by the output of your ike-scan, the other end is using 3DES not AES. Try adding ";3DES-SHA1;MODP1024" to your phase1 and ";3DES-HMAC_SHA1" to your phase2. You can have more than one specified, separated by ;'s. The order in which they appear is the order in which they are preferred so if you add the 3DES lines after the AES ones, it will try AES and use it if available.

[bvz]

Thank you for your reply on this and my other post. I apparently forgot to subscribe so I only saw this now.

My Phase 1 is now set to:

aes256-sha1;modp1024;3DES-SHA1;MODP1024

and my Phase 2 is set to:

aes256-sha1;modp1024;3DES-HMAC_SHA1


When set like this, the connection fails immediately (before it would time out). The output from my /var/log/messages is this:

Code: Select all

Sep 17 15:50:26 localhost NetworkManager[1032]: <info>  [1505688626.3615] keyfile: update /etc/NetworkManager/system-connections/Employer (c71d60cd-ef44-4a77-bfb3-38b22d31fd45,"Employer")
Sep 17 15:50:26 localhost NetworkManager[1032]: <info>  [1505688626.3624] audit: op="connection-update" uuid="c71d60cd-ef44-4a77-bfb3-38b22d31fd45" name="Employer" pid=8675 uid=1000 result="success"
Sep 17 15:50:29 localhost NetworkManager[1032]: <info>  [1505688629.0010] audit: op="connection-activate" uuid="c71d60cd-ef44-4a77-bfb3-38b22d31fd45" name="Employer" pid=8675 uid=1000 result="success"
Sep 17 15:50:29 localhost NetworkManager[1032]: <info>  [1505688629.0072] vpn-connection[0x562a9e5442e0,c71d60cd-ef44-4a77-bfb3-38b22d31fd45,"Employer",0]: Started the VPN service, PID 9317
Sep 17 15:50:29 localhost NetworkManager[1032]: <info>  [1505688629.0163] vpn-connection[0x562a9e5442e0,c71d60cd-ef44-4a77-bfb3-38b22d31fd45,"Employer",0]: Saw the service appear; activating connection
Sep 17 15:50:29 localhost NetworkManager[1032]: <info>  [1505688629.1577] keyfile: update /etc/NetworkManager/system-connections/Employer (c71d60cd-ef44-4a77-bfb3-38b22d31fd45,"Employer")
Sep 17 15:50:35 localhost NetworkManager[1032]: <info>  [1505688635.7486] keyfile: update /etc/NetworkManager/system-connections/Employer (c71d60cd-ef44-4a77-bfb3-38b22d31fd45,"Employer")
Sep 17 15:50:35 localhost NetworkManager[1032]: <info>  [1505688635.7500] keyfile: update /etc/NetworkManager/system-connections/Employer (c71d60cd-ef44-4a77-bfb3-38b22d31fd45,"Employer") after persisting connection
Sep 17 15:50:35 localhost NetworkManager[1032]: <info>  [1505688635.7759] vpn-connection[0x562a9e5442e0,c71d60cd-ef44-4a77-bfb3-38b22d31fd45,"Employer",0]: VPN plugin: state changed: starting (3)
Sep 17 15:50:35 localhost NetworkManager[1032]: <info>  [1505688635.7760] vpn-connection[0x562a9e5442e0,c71d60cd-ef44-4a77-bfb3-38b22d31fd45,"Employer",0]: VPN connection: (ConnectInteractive) reply received
Sep 17 15:50:35 localhost NetworkManager: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Sep 17 15:50:35 localhost kernel: AVX instructions are not detected.
Sep 17 15:50:35 localhost kernel: AVX instructions are not detected.
Sep 17 15:50:35 localhost kernel: AVX instructions are not detected.
Sep 17 15:50:36 localhost kernel: AVX instructions are not detected.
Sep 17 15:50:36 localhost kernel: AVX instructions are not detected.
Sep 17 15:50:36 localhost kernel: AVX or AES-NI instructions are not detected.
Sep 17 15:50:36 localhost kernel: AVX or AES-NI instructions are not detected.
Sep 17 15:50:36 localhost NetworkManager: 002 listening for IKE messages
Sep 17 15:50:36 localhost NetworkManager: 002 adding interface virbr0/virbr0 192.168.122.1:500
Sep 17 15:50:36 localhost NetworkManager: 002 adding interface virbr0/virbr0 192.168.122.1:4500
Sep 17 15:50:36 localhost NetworkManager: 002 adding interface enp6s0/enp6s0 192.168.2.2:500
Sep 17 15:50:36 localhost NetworkManager: 002 adding interface enp6s0/enp6s0 192.168.2.2:4500
Sep 17 15:50:36 localhost NetworkManager: 002 adding interface lo/lo 127.0.0.1:500
Sep 17 15:50:36 localhost NetworkManager: 002 adding interface lo/lo 127.0.0.1:4500
Sep 17 15:50:36 localhost NetworkManager: 002 adding interface lo/lo ::1:500
Sep 17 15:50:36 localhost NetworkManager: 002 loading secrets from "/etc/ipsec.secrets"
Sep 17 15:50:36 localhost NetworkManager: 002 loading secrets from "/etc/ipsec.d/ipsec-c71d60cd-ef44-4a77-bfb3-38b22d31fd45.secrets"
Sep 17 15:50:36 localhost NetworkManager[1032]: <warn>  [1505688636.3797] vpn-connection[0x562a9e5442e0,c71d60cd-ef44-4a77-bfb3-38b22d31fd45,"Employer",0]: VPN plugin: failed: connect-failed (1)
Sep 17 15:50:36 localhost NetworkManager[1032]: <warn>  [1505688636.3799] vpn-connection[0x562a9e5442e0,c71d60cd-ef44-4a77-bfb3-38b22d31fd45,"Employer",0]: VPN plugin: failed: connect-failed (1)
Sep 17 15:50:36 localhost NetworkManager[1032]: <info>  [1505688636.3800] vpn-connection[0x562a9e5442e0,c71d60cd-ef44-4a77-bfb3-38b22d31fd45,"Employer",0]: VPN plugin: state changed: stopping (5)
Sep 17 15:50:36 localhost NetworkManager: 002 shutting down
Sep 17 15:50:36 localhost NetworkManager[1032]: <info>  [1505688636.3806] vpn-connection[0x562a9e5442e0,c71d60cd-ef44-4a77-bfb3-38b22d31fd45,"Employer",0]: VPN plugin: state changed: stopped (6)
Sep 17 15:50:37 localhost ipsec_starter[9648]: connect(pluto_ctl) failed: No such file or directory
Sep 17 15:50:37 localhost ipsec_starter[9648]: connect(pluto_ctl) failed: No such file or directory
Sep 17 15:50:37 localhost ipsec_starter[9648]: connect(pluto_ctl) failed: No such file or directory
Sep 17 15:50:37 localhost ipsec_starter[9648]: connect(pluto_ctl) failed: No such file or directory
Sep 17 15:50:37 localhost ipsec_starter[9648]: connect(pluto_ctl) failed: No such file or directory

I keep seeing it complain about pluto not running. I don't know what that is, but looking at what looks like the official page indicates that it has something to do with IKE. Do I need to enable it somehow?

Thanks for your help so far.

[hunter86_bg]

It's seems that it's quite complicated to set it up. I've always used the NetworkManager's applet (for OpenVPN/openconnect).
Check this guide and I hope it helps you fixing the issue.
My guess is that something is not running/configured properly.