<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hello,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I am trying to run strongSwan on a Ubuntu 12.04 instance in Amazon VPC, using a compiled version strongswan-5.0.0.tar.gz and connect from Windows Server 2008 R2 client. I am using certificates for both sides. The 206.248.156.92 is my WS 2008 client What’s My IP. The vpngw has two interfaces, one 10.20.1.232 which is NATed to an Elastic IP and a private interface 10.20.2.117 on the subnet where I want the tunnel to have access. I implemented your VPC suggestions. I have been fighting with this for over a week, and previously with an older strongSwan version. Please help.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Here is my /usr/local/etc/ipsec.conf config:<o:p></o:p></p><p class=MsoNormal>config setup<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>ca cloudCA<o:p></o:p></p><p class=MsoNormal> cacert=caCert.pem<o:p></o:p></p><p class=MsoNormal> auto=add<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>conn %default<o:p></o:p></p><p class=MsoNormal> # keyexchange=ikev2<o:p></o:p></p><p class=MsoNormal> ikelifetime=60m<o:p></o:p></p><p class=MsoNormal> keylife=20m<o:p></o:p></p><p class=MsoNormal> rekeymargin=3m<o:p></o:p></p><p class=MsoNormal> keyingtries=1<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>conn nat-cert<o:p></o:p></p><p class=MsoNormal> left=10.20.1.232<o:p></o:p></p><p class=MsoNormal> leftsubnet=10.20.2.0/24<o:p></o:p></p><p class=MsoNormal> leftcert=vpngwCert.pem<o:p></o:p></p><p class=MsoNormal> leftfirewall=yes<o:p></o:p></p><p class=MsoNormal> right=%any<o:p></o:p></p><p class=MsoNormal> rightsubnet=10.1.20.0/24<o:p></o:p></p><p class=MsoNormal> rightsourceip=10.20.2.192/26<o:p></o:p></p><p class=MsoNormal> rightid="C=US, O=Cloud1215 CN=student.lt1215.com"<o:p></o:p></p><p class=MsoNormal> auto=add<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The /var/log/syslog file:<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.0.0, Linux 3.2.0-26-virtual, x86_64)<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[KNL] listening on interfaces:<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[KNL] eth0<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[KNL] 10.20.1.232<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[KNL] fe80::81f:b5ff:fe7e:9f68<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[KNL] eth1<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[KNL] 10.20.2.117<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[KNL] fe80::81f:b5ff:fe49:c917<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[CFG] loading ca certificates from '/usr/local/etc/ipsec.d/cacerts'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[CFG] loaded ca certificate "C=US, O=Cloud1215, CN=cloudCA" from '/usr/local/etc/ipsec.d/cacerts/caCert.pem'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[CFG] loaded ca certificate "C=US, O=Cloud1215, CN=cloudCA" from '/usr/local/etc/ipsec.d/cacerts/caCert.der'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[CFG] loading aa certificates from '/usr/local/etc/ipsec.d/aacerts'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[CFG] loading ocsp signer certificates from '/usr/local/etc/ipsec.d/ocspcerts'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[CFG] loading attribute certificates from '/usr/local/etc/ipsec.d/acerts'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[CFG] loading crls from '/usr/local/etc/ipsec.d/crls'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[CFG] loading secrets from '/usr/local/etc/ipsec.secrets'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[CFG] loaded RSA private key from '/usr/local/etc/ipsec.d/private/vpngwKey.pem'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[DMN] loaded plugins: charon aes des sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs8 pgp dnskey pem fips-prf gmp xcbc cmac hmac attr kernel-netlink resolve socket-default stroke updown xauth-generic<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 00[JOB] spawning 16 worker threads<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 12[CFG] received stroke: add ca 'cloudCA'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 12[CFG] added ca 'cloudCA'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 14[CFG] received stroke: add connection 'nat-cert'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 14[CFG] loaded certificate "C=US, O=Cloud1215, CN=vpngw.lt1215.com" from 'vpngwCert.pem'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 14[CFG] id '10.20.1.232' not confirmed by certificate, defaulting to 'C=US, O=Cloud1215, CN=vpngw.lt1215.com'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 14[CFG] added configuration 'nat-cert'<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:13 vpngw charon: 14[CFG] adding virtual IP address pool 'nat-cert': 10.20.2.192/26<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:23 vpngw charon: 05[ENC] header verification failed<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:23 vpngw charon: 05[NET] received invalid IKE header from 206.248.156.92 - ignored<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:24 vpngw charon: 05[ENC] header verification failed<o:p></o:p></p><p class=MsoNormal>Jul 2 14:51:24 vpngw charon: 05[NET] received invalid IKE header from 206.248.156.92 - ignored<o:p></o:p></p></div></body></html>