<div dir="ltr">I am trying to setup a simple host-host test connection using shared-secret through a NAT.<div><br></div><div>The client is behind the NAT and the server is on a static IP (but might be a NAT in the future).</div>
<div style><br></div><div style>From the logs on the server it looks to be trying to make an association between the client public ip address and the client internal nat ip address and it can't find it. </div><div style>
<br></div><div style>I have looked at the sample configurations, but none seem to cover this case.</div><div style><br></div><div style>It looks like a simple config or secrets error, but I can't see it. I have included the client and the server config and the server logs. </div>
<div style><br></div><div style>Regards, </div><div style>Dan</div><div style><br></div><div style>I don't want to give out public IPS so XXX.XXX.XXX.XXX is the public Ip of the NAT router and YYY.YYY.YYY.YYY is public ip of the server in rackspace.<br>
</div><div><br></div><div>Client ipsec.conf</div><div><div>conn %default</div><div> ikelifetime=60m</div><div> keylife=20m</div><div> rekeymargin=3m</div><div> keyingtries=1</div><div> mobike=no</div><div>
keyexchange=ikev2</div><div><br></div><div>conn lab-rackspace</div><div> leftauthby=secret</div><div> rightauthby=secret</div><div> left=10.3.3.172</div><div> leftprotoport=tcp</div><div> right=YYY.YYY.YYY.YYY <public ip of server in rackspace></div>
<div> rightprotoport=tcp</div><div> type=transport</div><div> auto=add</div><div><br></div><div>Client ipsec.secrets: </div><div>YYY.YYY.YYY.YYY 10.3.3.172 : PSK "foobar"<br></div><div><br></div><div>Server ipsec.conf</div>
<div><br></div><div><div>conn %default</div><div> ikelifetime=60m</div><div> keylife=20m</div><div> rekeymargin=3m</div><div> keyingtries=1</div><div>
mobike=no</div><div> keyexchange=ikev2</div><div><br></div><div>conn lab-rackspace</div><div> leftauthby=secret</div><div> rightauthby=secret</div><div> left=XXX.XXX.XXX.XXX < public ip of NAT router ></div>
<div> leftprotoport=tcp</div><div> right=YYY.YYY.YYY.YYY</div>
<div> rightprotoport=tcp</div><div> type=transport</div><div> auto=add</div></div><div><br></div><div style>Server ipsec.secret:</div><div style>YYY.YYY.YYY.YYY XXX.XXX.XXX.XXX : PSK "foobar"</div><div style>
<br></div><div style>Client IPSec Up command:</div><div style><div>lab# ipsec up lab-rackspace<br></div><div>initiating IKE_SA lab-rackspace[18] to YYY.YYY.YYY.YYY</div><div>generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</div>
<div>sending packet: from 10.3.3.172[500] to YYY.YYY.YYY.YYY[500]</div><div>received packet: from YYY.YYY.YYY.YYY[500] to 10.3.3.172[500]</div><div>parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]</div>
<div>local host is behind NAT, sending keep alives</div><div>authentication of '10.3.3.172' (myself) with pre-shared key</div><div>establishing CHILD_SA lab-rackspace</div><div>not using transport mode, connection NATed</div>
<div>generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]</div><div>sending packet: from 10.3.3.172[4500] to YYY.YYY.YYY.YYY[4500]</div><div>received packet: from YYY.YYY.YYY.YYY[4500] to 10.3.3.172[4500]</div>
<div>parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]</div><div>received AUTHENTICATION_FAILED notify error</div><div><br></div><div style>Server Log:</div><div style><div>May 7 20:45:39 centos-6 charon: 12[NET] received packet: from XXX.XXX.XXX.XXX[500] to YYY.YYY.YYY.YYY[500]</div>
<div>May 7 20:45:39 centos-6 charon: 12[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</div><div>May 7 20:45:39 centos-6 charon: 12[IKE] XXX.XXX.XXX.XXX is initiating an IKE_SA</div><div>May 7 20:45:39 centos-6 charon: 12[IKE] remote host is behind NAT</div>
<div>May 7 20:45:39 centos-6 charon: 12[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]</div><div>May 7 20:45:39 centos-6 charon: 12[NET] sending packet: from YYY.YYY.YYY.YYY[500] to XXX.XXX.XXX.XXX[500]</div>
<div>May 7 20:45:39 centos-6 charon: 15[NET] received packet: from XXX.XXX.XXX.XXX[4500] to YYY.YYY.YYY.YYY[4500]</div><div>May 7 20:45:39 centos-6 charon: 15[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]</div>
<div>May 7 20:45:39 centos-6 charon: 15[CFG] looking for peer configs matching YYY.YYY.YYY.YYY[YYY.YYY.YYY.YYY]...XXX.XXX.XXX.XXX[10.3.3.172]</div><div>May 7 20:45:39 centos-6 charon: 15[CFG] no matching peer config found</div>
<div>May 7 20:45:39 centos-6 charon: 15[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]</div><div>May 7 20:45:39 centos-6 charon: 15[NET] sending packet: from YYY.YYY.YYY.YYY[4500] to XXX.XXX.XXX.XXX[4500]</div></div>
</div><div style><br></div><div><br></div></div></div>