<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>
thank you for the reply. I set charonstart=no and it failed on both my Android over 3g and iPad over wifi.<br><br>I think I should now try the socket-raw option?<br><br>This is using my local wifi and iPad. Identical setup/problem as my public config below.<br><br>No entries in daemon.log<br><br>iPad via wifi<br>[user@machine ipsec]# tcpdump -i eth3 port 500<br>tcpdump: verbose output suppressed, use -v or -vv for full protocol decode<br>listening on eth3, link-type EN10MB (Ethernet), capture size 65535 bytes<br>13:57:09.052952 IP 10.5.5.2.isakmp > 10.5.5.1.isakmp: isakmp: phase 1 I ident<br>13:57:09.079719 IP 10.5.5.1.isakmp > 10.5.5.2.isakmp: isakmp: phase 1 R ident<br>13:57:09.132013 IP 10.5.5.2.isakmp > 10.5.5.1.isakmp: isakmp: phase 1 I ident<br>13:57:09.134725 IP 10.5.5.1.isakmp > 10.5.5.2.isakmp: isakmp: phase 1 R ident<br>13:57:09.188516 IP 10.5.5.2.isakmp > 10.5.5.1.isakmp: isakmp: phase 1 I ident[E]<br>13:57:09.189188 IP 10.5.5.1.isakmp > 10.5.5.2.isakmp: isakmp: phase 1 R ident[E]<br>13:57:10.197248 IP 10.5.5.2.isakmp > 10.5.5.1.isakmp: isakmp: phase 2/others I oakley-quick[E]<br>13:57:10.210796 IP 10.5.5.1.isakmp > 10.5.5.2.isakmp: isakmp: phase 2/others R oakley-quick[E]<br>13:57:10.220899 IP 10.5.5.2.isakmp > 10.5.5.1.isakmp: isakmp: phase 2/others I oakley-quick[E]<br><br>iPad fails to connect. <br><br>And via my Android over 3g.<br>Android via 3g<br>[user@machine ipsec]# tcpdump -i eth1 port 500<br>tcpdump: verbose output suppressed, use -v or -vv for full protocol decode<br>listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes<br>14:07:00.700072 IP 134.x.x.x.16534 > 137.x.x.x.isakmp: isakmp: phase 1 I ident<br>14:07:11.507131 IP 134.x.x.x..16534 > 137.x.x.x.isakmp: isakmp: phase 1 I ident<br>14:07:21.696309 IP 134.x.x.x..16534 > 137.x.x.x.isakmp: isakmp: phase 1 I ident<br>14:07:31.133663 IP 134..x.x.x..16534 > 137.x.x.x..isakmp: isakmp: phase 1 I ident<br><br><br>[user@machine ipsec]# ipsec statusall<br>000 Status of IKEv1 pluto daemon (strongSwan 4.5.0):<br>000 interface foo/foo aaaa::1:500<br>000 interface lo/lo ::1:500<br>000 interface lo/lo 127.0.0.1:500<br>000 interface eth0/eth0 192.168.2.1:500<br>000 interface eth0/eth0 192.168.2.0:500<br>000 interface eth1/eth1 137.x.x.x:500<br>000 interface eth3/eth3 10.5.5.1:500<br>000 interface eth2/eth2 192.168.4.1:500<br>000 %myid = '%any'<br>000 loaded plugins: aes des sha1 sha2 md5 random x509 pkcs1 pgp dnskey pem gmp hmac xauth attr kernel-netlink resolve <br>000 debug options: none<br>000 <br>000 "L2TP": 137.x.x.x.[137.x.x.x.]:17/1701---137.x.x.x....%any[%any]:17/%any==={0.0.0.0/0}; unrouted; eroute owner: #0<br>000 "L2TP": ike_life: 10800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3<br>000 "L2TP": policy: PSK+ENCRYPT+TUNNEL+DONTREKEY; prio: 32,0; interface: eth1; <br>000 "L2TP": newest ISAKMP SA: #0; newest IPsec SA: #0; <br>000 "L2TP_Wireless": 10.5.5.1[10.5.5.1]:17/1701---137.xx.x.x...%any[%any]:17/%any==={0.0.0.0/0}; unrouted; eroute owner: #0<br>000 "L2TP_Wireless": ike_life: 10800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3<br>000 "L2TP_Wireless": policy: PSK+ENCRYPT+TUNNEL+DONTREKEY; prio: 32,0; interface: eth3; <br>000 "L2TP_Wireless": newest ISAKMP SA: #0; newest IPsec SA: #0; <br>000 "L2TP_Wireless"[2]: 10.5.5.1[10.5.5.1]:17/1701---137.x.x.x.x...10.5.5.2[192.168.50.138]:17/59512===192.168.50.138/32; erouted; eroute owner: #2<br>000 "L2TP_Wireless"[2]: ike_life: 10800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3<br>000 "L2TP_Wireless"[2]: policy: PSK+ENCRYPT+TUNNEL+DONTREKEY; prio: 32,0; interface: eth3; <br>000 "L2TP_Wireless"[2]: newest ISAKMP SA: #1; newest IPsec SA: #2; <br>000 "L2TP_Wireless"[2]: IKE proposal: AES_CBC_256/HMAC_SHA1/MODP_1024<br>000 "L2TP_Wireless"[2]: ESP proposal: AES_CBC_256/HMAC_SHA1/<N/A><br>000 <br>000 #2: "L2TP_Wireless"[2] 10.5.5.2 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_EXPIRE in 3302s; newest IPSEC; eroute owner<br>000 #2: "L2TP_Wireless"[2] 10.5.5.2 esp.53ae617@10.5.5.2 (0 bytes) esp.c809ae1c@10.5.5.1 (0 bytes); transport<br>000 #1: "L2TP_Wireless"[2] 10.5.5.2 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_EXPIRE in 3301s; newest ISAKMP<br><br>I really appreciate the help!<br>Thank you!<br>Mark<br><br>> Subject: Re: [strongSwan] ikev1 on 4.5.0 vs 4.3.6 iPad/Android problem<br>> <br>> Hi Mark,<br>> <br>> does the problem still occur if you disable the IKEv2 charon daemon:<br>> <br>> charonstart=no<br>> <br>> It might be that charon loads the socket-default plugin and does<br>> binds to UDP port 500. If you want to run both pluto and charon<br>> make sure that charon loads the socket-raw plugin only.<br>> The plugin list can be listed using<br>> <br>> ipsec statusall<br>> <br>> Regards<br>> <br>> Andreas<br>> <br> </body>
</html>