<font color='black' size='2' face='Arial, Helvetica, sans-serif'><font face="Arial, Helvetica, sans-serif" size="2">Hello everyone, just joined the list.</font>
<div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><br>
</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; ">I'm trying to establish a secured connection between a cisco router and a linux box running strongswan.</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><br>
</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; ">This is the TEST scenario:</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><br>
</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; ">CISCO ----------------------------------------------------------------------------------------- LINUX</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; ">192.168.11.244 192.168.11.235</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><br>
</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><br>
</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; ">----------------------------------------------------------------------------------------</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; ">Cisco configuration:</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><br>
</div>
<div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; ">crypto isakmp policy 1</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "> encr 3des</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "> hash md5</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "> authentication pre-share</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "> group 2 </div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; ">crypto isakmp key teste123 address 192.168.11.235</span></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; "><br>
</span></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; ">crypto ipsec transform-set tset esp-3des esp-md5-hmac </span></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; "><br>
</span></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; ">crypto ipsec profile ipsec</span></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "> set transform-set tset </div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><br>
</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; ">interface Tunnel0</span></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "> no ip address</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "> shutdown</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "> tunnel source 192.168.11.244</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "> tunnel destination 192.168.11.235</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "> tunnel mode ipsec ipv4</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "> tunnel protection ipsec profile ipsec</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><br>
</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; ">----------------------------------------------------------------------------------------</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; ">Strongswan configuration:</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><br>
</div>
<div>
<div><font face="Arial, Helvetica, sans-serif">config setup</font></div>
<div><font face="Arial, Helvetica, sans-serif"> nat_traversal=yes</font></div>
<div><font face="Arial, Helvetica, sans-serif"> plutodebug=all</font></div>
<div><font face="Arial, Helvetica, sans-serif"><br>
</font></div>
<div><font face="Arial, Helvetica, sans-serif">conn host-host</font></div>
<div><font face="Arial, Helvetica, sans-serif"> type=tunnel</font></div>
<div><font face="Arial, Helvetica, sans-serif"> authby=secret</font></div>
<div><font face="Arial, Helvetica, sans-serif"> left=192.168.11.235</font></div>
<div><font face="Arial, Helvetica, sans-serif"> leftsubnet=%default</font></div>
<div><font face="Arial, Helvetica, sans-serif"> right=192.168.11.244</font></div>
<div><font face="Arial, Helvetica, sans-serif"> rightsubnet=%default</font></div>
<div><font face="Arial, Helvetica, sans-serif"> auto=start</font></div>
<div><font face="Arial, Helvetica, sans-serif"> esp=3des-md5-modp1024</font></div>
<div><font face="Arial, Helvetica, sans-serif"> ike=3des-md5-modp1024</font></div>
<div><font face="Arial, Helvetica, sans-serif"> keyexchange=ikev1</font></div>
</div>
</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; ">----------------------------------------------------------------------------------------</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><br>
</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; ">The result is that strongswan fails with this error and the connection is not established.</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><br>
</div>
<div>
<div><font face="Arial, Helvetica, sans-serif">| find_client_connection starting with host-host</font></div>
<div><font face="Arial, Helvetica, sans-serif">| looking for 0.0.0.0/0:0/0 -> 0.0.0.0/0:0/0</font></div>
<div><font face="Arial, Helvetica, sans-serif">| concrete checking against sr#0 192.168.11.235/32 -> 192.168.11.244/32</font></div>
<div><font face="Arial, Helvetica, sans-serif">| fc_try trying host-host:0.0.0.0/0:0/0 -> 0.0.0.0/0:0/0 vs host-host:192.168.11.235/32:0/0 -> 192.168.11.244/32:0/0</font></div>
<div><font face="Arial, Helvetica, sans-serif">| fc_try concluding with none [0]</font></div>
<div><font face="Arial, Helvetica, sans-serif">| fc_try host-host gives none</font></div>
<div><font face="Arial, Helvetica, sans-serif">| checking hostpair 192.168.11.235/32 -> 192.168.11.244/32 is not found</font></div>
<div><font face="Arial, Helvetica, sans-serif">| concluding with d = none</font></div>
<div><font face="Arial, Helvetica, sans-serif">"host-host" #3: cannot respond to IPsec SA request because no connection is known for 0.0.0.0/0===192.168.11.235[192.168.11.235]...192.168.11.244[192.168.11.244]===0.0.0.0/0</font></div>
<div><font face="Arial, Helvetica, sans-serif">"host-host" #3: sending encrypted notification INVALID_ID_INFORMATION to 192.168.11.244:500</font></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><br>
</div>
</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><br>
</div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; ">It seems to me that the CISCO doesn't fill those network fields on the SA request packet when it is in tunnel (VTI) mode. And it makes sense, since it's just configuring a tunnel, there are no subnets (left, right stuff).</span></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; "><br>
</span></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; ">I believe pluto is behaving improperly in this situation, but before I report a bug or try to fix it, it would be nice if someone could comment on this issue. I might have misconfigured cisco and/or strongswan.</span></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; "><br>
</span></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; ">By the way, racoon has no problem validating that 0.0.0.0/0 subnet.</span></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; "><br>
</span></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; ">Thanks,</span></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; ">Germano</span></div>
<div style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 10pt; "><br>
</div>
</div>
</font>