<div>OK, to double check, I also tried the same settings in the 5.0.0 release. Here are the combinations and results:</div><div>5.0.0 carol <===> 5.0.0 moon: SUCCESS</div><div>5.0.0 carol <===> 5.0.1rc1 moon: SUCCESS</div>
<div>5.0.1rc1 carol <===> 5.0.0 moon: FAILED</div><div>5.0.1rc1 carol <===> 5.0.1rc1 moon: FAILED</div><div>Looks like the error is being introduced in the 5.0.1rc1 code on the client part. Or, is 5.0.1rc1 correcting 5.0.0?</div>
<div><br><div><div>moon's ipsec.conf:</div><div> leftsubnet=<a href="http://10.10.10.0/24">10.10.10.0/24</a><div> rightsourceip=10.10.10.1</div><div>carol's ipsec.conf:</div><div> rightsubnet=<a href="http://0.0.0.0/24">0.0.0.0/24</a></div>
<div><br></div><div>================ SUCCESS ===============</div><div><div>charon: 13[IKE] assigning virtual IP 10.10.10.1 to peer '<a href="mailto:carol@strongswan.org">carol@strongswan.org</a>' </div><div><div>
charon: 13[IKE] CHILD_SA client_1{1} established with SPIs c1429c27_i cf30a61d_o and TS <a href="http://10.10.10.0/24">10.10.10.0/24</a> === <a href="http://10.10.10.1/32">10.10.10.1/32</a> </div><div>charon: 13[ENC] generating IKE_AUTH response 3 [ AUTH CP(ADDR) SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_6_ADDR) ] </div>
<div><br></div><div>================ FAILED ===============
</div><div><div>charon: 13[IKE] assigning virtual IP 10.10.10.1 to peer '<a href="mailto:carol@strongswan.org">carol@strongswan.org</a>' </div><div>charon: 13[IKE] traffic selectors <a href="http://0.0.0.0/24">0.0.0.0/24</a> === <a href="http://0.0.0.0/0">0.0.0.0/0</a> inacceptable </div>
<div>charon: 13[IKE] failed to establish CHILD_SA, keeping IKE_SA </div><div>charon: 13[ENC] generating IKE_AUTH response 3 [ AUTH CP(ADDR) N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_6_ADDR) N(TS_UNACCEPT) ] </div></div>
<div><br></div><div>Thank you!</div><div>Robert</div><div><br></div><div class="gmail_quote">On Tue, Sep 25, 2012 at 8:36 PM, Richard Andrews <span dir="ltr"><<a href="mailto:richard.andrews@symstream.com" target="_blank">richard.andrews@symstream.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><a href="http://0.0.0.0/24" target="_blank">0.0.0.0/24</a> and <a href="http://10.0.0.0/24" target="_blank">10.0.0.0/24</a> have no address space in common.<br>
<div><div class="h5"><br>
On Tue, 2012-09-25 at 17:32 -0700, Robert Lee wrote:<br>
> Dear StrongSwan Developer,<br>
><br>
> It appears that the server is not doing the TS narrowing. On the<br>
> server side, I am using leftsubnet=<a href="http://10.10.10.0/24" target="_blank">10.10.10.0/24</a>. On the client side,<br>
> I am using rightsubnet=<a href="http://0.0.0.0/24" target="_blank">0.0.0.0/24</a>:<br>
><br>
> charon: 05[IKE] assigning virtual IP 10.10.10.1 to peer '<a href="mailto:carol@strongswan.org">carol@strongswan.org</a>'<br>
> charon: 05[IKE] traffic selectors <a href="http://0.0.0.0/24" target="_blank">0.0.0.0/24</a> === <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> inacceptable<br>
> charon: 05[IKE] failed to establish CHILD_SA, keeping IKE_SA<br>
> charon: 05[ENC] generating IKE_AUTH response 3 [ AUTH CP(ADDR) N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_6_ADDR) N(TS_UNACCEPT) ]<br>
><br>
> Thank you!<br>
> Robert<br>
</div></div>> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
> <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
<br>
</blockquote></div><br></div></div></div></div></div>