Hello,<div><br></div><div>I am testing out the Remote access (RA) +PSK configuration. It is working if the</div><div>two devices are routed. But the if RA is behind NAT, IKE Phase I succeeds, Phase II fails.</div><div><br>
</div><div>From auth.log below, I can see that IKE Phase I succeeds, but then I cannot create the Phase II</div><div>SA. Any suggestions?</div><div><br></div><div>moon (the VPN hub)</div><div><br></div><div>ipsec.secrets</div>
<div><br></div><div>192.168.123.12 %any : PSK "secret"</div><div><br></div><div>ipsec.conf</div><div><br></div><div><div>conn hub</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>left=192.168.123.12</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>leftsubnet=<a href="http://172.25.12.0/24">172.25.12.0/24</a></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>right=%any</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>authby=secret</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>auto=add</div><div><br></div></div><div>carol (the RA client, behind NAT)</div><div><br></div><div>ipsec.secrets</div><div><br></div><div>10.10.124.14 192.168.123.12 : PSK "secret"</div>
<div><br></div><div>ipsec.conf</div><div><br></div><div><div>conn rw</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>left=%defaultroute</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>right=192.168.123.12</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>rightsubnet=<a href="http://172.25.12.0/24">172.25.12.0/24</a></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>authby=secret</div><div>
<span class="Apple-tab-span" style="white-space:pre"> </span>auto=add</div><div><br></div></div><div><br></div><div>auth.log on moon:</div><div><br></div><div><div>Feb 13 15:18:33 vm01 pluto[6774]: | *received 268 bytes from <a href="http://192.168.123.1:1031">192.168.123.1:1031</a> on eth0</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031">192.168.123.1:1031</a>: received Vendor ID payload [strongSwan]</div><div>Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031">192.168.123.1:1031</a>: received Vendor ID payload [XAUTH]</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031">192.168.123.1:1031</a>: received Vendor ID payload [Dead Peer Detection]</div><div>Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031">192.168.123.1:1031</a>: received Vendor ID payload [RFC 3947]</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031">192.168.123.1:1031</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]</div><div>Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031">192.168.123.1:1031</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031">192.168.123.1:1031</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]</div><div>Feb 13 15:18:33 vm01 pluto[6774]: packet from <a href="http://192.168.123.1:1031">192.168.123.1:1031</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: | preparse_isakmp_policy: peer requests PSK authentication</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | instantiated "hub" for 192.168.123.1</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | creating state object #1 at 0x7fe4f2b2db20</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE: 41 51 f8 ff 2a 0a 4a 34</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE: 5f 41 53 47 1b fa 54 d7</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | peer: c0 a8 7b 01</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | inserting event EVENT_SO_DISCARD, timeout in 0 seconds for #1</div><div>Feb 13 15:18:33 vm01 pluto[6774]: "hub"[1] <a href="http://192.168.123.1:1031">192.168.123.1:1031</a> #1: responding to Main Mode from unknown peer <a href="http://192.168.123.1:1031">192.168.123.1:1031</a></div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: | inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #1</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | next event EVENT_RETRANSMIT in 10 seconds for #1</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | </div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: | *received 356 bytes from <a href="http://192.168.123.1:1031">192.168.123.1:1031</a> on eth0</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE: 41 51 f8 ff 2a 0a 4a 34</div><div>
Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE: 5f 41 53 47 1b fa 54 d7</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | peer: c0 a8 7b 01</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | state object #1 found, in STATE_MAIN_R1</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: "hub"[1] <a href="http://192.168.123.1:1031">192.168.123.1:1031</a> #1: NAT-Traversal: Result using RFC 3947: peer is NATed</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | inserting event EVENT_NAT_T_KEEPALIVE, timeout in 20 seconds</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: | inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #1</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | next event EVENT_RETRANSMIT in 10 seconds for #1</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | </div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: | *received 76 bytes from <a href="http://192.168.123.1:4500">192.168.123.1:4500</a> on eth0</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE: 41 51 f8 ff 2a 0a 4a 34</div><div>
Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE: 5f 41 53 47 1b fa 54 d7</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | peer: c0 a8 7b 01</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | state object #1 found, in STATE_MAIN_R2</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: "hub"[1] <a href="http://192.168.123.1:1031">192.168.123.1:1031</a> #1: Peer ID is ID_IPV4_ADDR: '10.10.124.14'</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | peer CA: %none</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: | offered CA: %none</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | switched from "hub" to "hub"</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | instantiated "hub" for 192.168.123.1</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: "hub"[2] <a href="http://192.168.123.1:1031">192.168.123.1:1031</a> #1: deleting connection "hub" instance with peer 192.168.123.1 {isakmp=#0/ipsec=#0}</div><div>
Feb 13 15:18:33 vm01 pluto[6774]: | NAT-T: new mapping <a href="http://192.168.123.1:1031/4500">192.168.123.1:1031/4500</a>)</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | inserting event EVENT_SA_REPLACE, timeout in 10530 seconds for #1</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: "hub"[2] <a href="http://192.168.123.1:4500">192.168.123.1:4500</a> #1: sent MR3, ISAKMP SA established</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | next event EVENT_NAT_T_KEEPALIVE in 20 seconds</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: | </div><div>Feb 13 15:18:33 vm01 pluto[6774]: | *received 444 bytes from <a href="http://192.168.123.1:4500">192.168.123.1:4500</a> on eth0</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE: 41 51 f8 ff 2a 0a 4a 34</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE: 5f 41 53 47 1b fa 54 d7</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | peer: c0 a8 7b 01</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | state object not found</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: | ICOOKIE: 41 51 f8 ff 2a 0a 4a 34</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | RCOOKIE: 5f 41 53 47 1b fa 54 d7</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | peer: c0 a8 7b 01</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: | state hash entry 25</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | state object #1 found, in STATE_MAIN_R3</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | peer client is 10.10.124.14</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: | peer client protocol/port is 0/0</div><div>Feb 13 15:18:33 vm01 pluto[6774]: | our client is subnet <a href="http://172.25.12.0/24">172.25.12.0/24</a></div><div>Feb 13 15:18:33 vm01 pluto[6774]: | our client protocol/port is 0/0</div>
<div>Feb 13 15:18:33 vm01 pluto[6774]: "hub"[2] <a href="http://192.168.123.1:4500">192.168.123.1:4500</a> #1: cannot respond to IPsec SA request because no connection is known for <a href="http://172.25.12.0/24===192.168.123.12:4500[192.168.123.12]...192.168.123.1:4500[10.10.124.14]===10.10.124.14/32">172.25.12.0/24===192.168.123.12:4500[192.168.123.12]...192.168.123.1:4500[10.10.124.14]===10.10.124.14/32</a></div>
</div><div><br></div>