TCPDUMP

moon# tcpdump -i eth0 not port ssh and not port domain and not arp > /tmp/tcpdump.log 2>&1 &

PRE-TEST

moon# /etc/init.d/iptables start 2> /dev/null
 * Caching service dependencies ...                                       [ ok ]
 * Starting firewall ...                                                  [ ok ]

carol# /etc/init.d/iptables start 2> /dev/null
 * Caching service dependencies ...                                       [ ok ]
 * Starting firewall ...                                                  [ ok ]

carol# rm /etc/ipsec.d/private/*

carol# rm /etc/ipsec.d/certs/*

carol# rm /etc/ipsec.d/cacerts/*

carol# ipsec scepclient --out pkcs1 --out cert-self
  loaded plugins: sha1 sha2 md5 aes des hmac pem pkcs1 x509 gmp random 
  fingerprint:    5c932bf7c884aeec79b8694823ba9b08
  written pkcs1 file '/etc/ipsec.d/private/myKey.der' (1188 bytes)
  transaction ID: d0bae4b8868c1c54a1a44a3cb105f4d3
  written self-signed cert file '/etc/ipsec.d/certs/selfCert.der' (801 bytes)
No leaks detected, 66 suppressed by whitelist

moon# rm /etc/ipsec.d/private/*

moon# rm /etc/ipsec.d/certs/*

moon# rm /etc/ipsec.d/cacerts/*

moon# cat /etc/scepclient.conf
--debug-control
--keylength 2032
--days 1460
--subjectAltName dns=moon.strongswan.org
--out pkcs1=moonKey.der
--out cert-self=moonCert.der 

moon# ipsec scepclient --dn "C=CH, O=Linux strongSwan, CN=moon.strongswan.org" --optionsfrom /etc/scepclient.conf
  loaded plugins: sha1 sha2 md5 aes des hmac pem pkcs1 x509 gmp random 
| dn: 'C=CH, O=Linux strongSwan, CN=moon.strongswan.org'
| building pkcs10 object:
  fingerprint:    beac0b9319505b4da14055b41949b706
| building pkcs1 object:
  written pkcs1 file '/etc/ipsec.d/private/moonKey.der' (1179 bytes)
  transaction ID: 63ce64e486a5fbddf5928334b3e8683e
  written self-signed cert file '/etc/ipsec.d/certs/moonCert.der' (855 bytes)
No leaks detected, 66 suppressed by whitelist

moon# scp carol:/etc/ipsec.d/certs/selfCert.der /etc/ipsec.d/certs/carolCert.der

moon# scp /etc/ipsec.d/certs/moonCert.der carol:/etc/ipsec.d/certs/peerCert.der

carol# ipsec start
Starting strongSwan 4.3.6 IPsec [starter]...

moon# ipsec start
Starting strongSwan 4.3.6 IPsec [starter]...

carol# sleep 2

carol# ipsec up home
002 "home" #1: initiating Main Mode
104 "home" #1: STATE_MAIN_I1: initiate
003 "home" #1: ignoring Vendor ID payload [strongSwan]
003 "home" #1: received Vendor ID payload [XAUTH]
003 "home" #1: received Vendor ID payload [Dead Peer Detection]
106 "home" #1: STATE_MAIN_I2: sent MI2, expecting MR2
002 "home" #1: we have a cert but are not sending it 
108 "home" #1: STATE_MAIN_I3: sent MI3, expecting MR3
002 "home" #1: Peer ID is ID_FQDN: 'moon.strongswan.org'
002 "home" #1: ISAKMP SA established
004 "home" #1: STATE_MAIN_I4: ISAKMP SA established
002 "home" #2: initiating Quick Mode PUBKEY+ENCRYPT+TUNNEL+PFS+UP {using isakmp#1}
112 "home" #2: STATE_QUICK_I1: initiate
002 "home" #2: sent QI2, IPsec SA established {ESP=>0x7f9c9ca0 <0xa6748395}
004 "home" #2: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x7f9c9ca0 <0xa6748395}


TEST

carol# cat /var/log/auth.log | grep 'we have a cert but are not sending it' [YES]
Feb 27 23:45:59 carol pluto[20236]: "home" #1: we have a cert but are not sending it 

moon# cat /var/log/auth.log | grep 'we have a cert but are not sending it' [YES]
Feb 27 23:46:00 moon pluto[27191]: "carol"[1] 192.168.0.100 #1: we have a cert but are not sending it 

carol# ipsec status | grep 'home.*STATE_QUICK_I2.*IPsec SA established' [YES]
000 #2: "home" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 949s; newest IPSEC; eroute owner

moon# ipsec status | grep 'carol.*STATE_QUICK_R2.*IPsec SA established' [YES]
000 #2: "carol"[1] 192.168.0.100 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 1110s; newest IPSEC; eroute owner

carol# ping -c 1 10.1.0.10 | grep '64 bytes from 10.1.0.10: icmp_seq=1' [YES]
64 bytes from 10.1.0.10: icmp_seq=1 ttl=63 time=13.4 ms

moon# killall tcpdump

moon# cat /tmp/tcpdump.log | grep 'IP carol.strongswan.org > moon.strongswan.org: ESP' [YES]
23:46:03.262899 IP carol.strongswan.org > moon.strongswan.org: ESP(spi=0x7f9c9ca0,seq=0x1), length 132

moon# cat /tmp/tcpdump.log | grep 'IP moon.strongswan.org > carol.strongswan.org: ESP' [YES]
23:46:03.276211 IP moon.strongswan.org > carol.strongswan.org: ESP(spi=0xa6748395,seq=0x1), length 132


POST-TEST

moon# ipsec stop
Stopping strongSwan IPsec...

carol# ipsec stop
Stopping strongSwan IPsec...

moon# /etc/init.d/iptables stop 2> /dev/null
 * Stopping firewall ...                                                  [ ok ]

carol# /etc/init.d/iptables stop 2> /dev/null
 * Stopping firewall ...                                                  [ ok ]

carol# rm /etc/ipsec.d/private/*

carol# rm /etc/ipsec.d/certs/*

moon# rm /etc/ipsec.d/private/*

moon# rm /etc/ipsec.d/certs/*