<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Hello,<br>
<br>
here my very simple strongswan configuration:<br>
<br>
version 2<br>
config setup<br>
conn mytunnel<br>
keyexchange=ikev1<br>
left=a.b.c.d<br>
right=e.f.g.h<br>
leftsubnet=10.150.2.0/24<br>
authby=psk<br>
rightsubnet=192.168.10.0/24<br>
auto=route<br>
esp=aes128-md5-modp1024<br>
ike=aes128-sha1-modp1024,aes-md5-modp1536<br>
type=tunnel<br>
<br>
On the other side a Juniper SSG is running. If I establish the tunnel with "ipsec start" & "ipsec up mytunnel"<br>
everything works fine. The Juniper receives */24 ProxyIDs. On the other hand the tunnel won't get up if I only<br>
do an "ipsec start" and try to ping a machine on the remote network. The Juniper device complains about
<br>
wrong */32 ProxyIDs. Here some lines of the strongswan log that may give a hint:<br>
<br>
Jan 28 21:31:26 hermes daemon.info syslog: 03[ENC] parsed ID_PROT request 0 [ KE No ]<br>
Jan 28 21:31:26 hermes daemon.info syslog: 08[KNL] creating acquire job for policy 10.150.2.97/32[icmp/8] === 192.168.10.1/32[icmp] with reqid {1}<br>
Jan 28 21:31:26 hermes kern.debug kernel: [ 5042.102487] ip_finish_output2: No header cache and no neighbour!<br>
Jan 28 21:31:26 hermes daemon.info syslog: 03[ENC] generating ID_PROT response 0 [ KE No ]<br>
<br>
Maybe someone can help.<br>
<br>
Markus<br>
<br>
</div>
</body>
</html>