<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>Hello</div>
<div> </div>
<div>I am facing a problem with setting up a tunnel between a roadwarrior behind a NAT to an internet based ubuntu server:</div>
<div> </div>
<div>[roadwarrior (behind nat), strongswan 5.0.4] [>---> tunnel >--->] [ubuntu, strongswan 5.0.0]</div>
<div>ikev2, psk</div>
<div> </div>
<div>Please take a look at my log files, I get these errors:</div>
<div> </div>
<div>serverside:</div>
<div>Jun 6 09:16:15 kvm21729 charon: 16[IKE] traffic selectors 0.0.0.0/0 === 192.168.67.176/32 inacceptable<br/>
Jun 6 09:16:15 kvm21729 charon: 16[IKE] failed to establish CHILD_SA, keeping IKE_SA</div>
<div> </div>
<div>clientside:</div>
<div>14[IKE] received TS_UNACCEPTABLE notify, no CHILD_SA built<br/>
14[IKE] failed to establish CHILD_SA, keeping IKE_SA</div>
<div> </div>
<div>Do you know what to fix?</div>
<div>Are my ipsec.conf files OK?</div>
<div>Where do I find more information about TS_UNACCEPTABLE?</div>
<div> </div>
<div>Roadwarrior Config:</div>
<div>-------------------------------------------</div>
<div>
<div>conn %default<br/>
ikelifetime=60m<br/>
keylife=20m<br/>
rekeymargin=3m<br/>
keyingtries=1<br/>
keyexchange=ikev2<br/>
authby=secret</div>
<div>
<div>conn myconn<br/>
left=%defaultroute<br/>
leftid=myuser<br/>
leftfirewall=no<br/>
right=vpn.xxx.net<br/>
rightsubnet=0.0.0.0/0<br/>
type=tunnel<br/>
auto=add</div>
<div>-------------------------------------------</div>
<div>Ubuntu Server Config:</div>
</div>
<div>
<div>conn mint<br/>
ikelifetime=60m<br/>
keylife=20m<br/>
rekeymargin=3m<br/>
keyingtries=1<br/>
keyexchange=ikev2<br/>
authby=secret<br/>
left=%defaultroute<br/>
leftfirewall=yes<br/>
right=%any<br/>
auto=add</div>
<div>-------------------------------------------</div>
</div>
</div>
<div> </div>
<div> </div>
<div> </div>
<div>Client Output</div>
<div>--------------------------</div>
<div>
<div>00[DMN] Starting IKE charon daemon (strongSwan 5.0.4, Linux 3.5.0-17-generic, i686)<br/>
00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'<br/>
00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'<br/>
00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'<br/>
00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'<br/>
00[CFG] loading crls from '/etc/ipsec.d/crls'<br/>
00[CFG] loading secrets from '/etc/ipsec.secrets'<br/>
00[CFG] loaded IKE secret for %any<br/>
00[CFG] loaded EAP secret for xxx<br/>
00[DMN] loaded plugins: charon aes des sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs8 pgp dnskey pem fips-prf gmp xcbc cmac hmac attr kernel-netlink resolve socket-default stroke updown xauth-generic<br/>
00[JOB] spawning 16 worker threads<br/>
charon (2753) started after 220 ms<br/>
09[CFG] received stroke: add connection 'myconn'<br/>
09[CFG] left nor right host is our side, assuming left=local<br/>
09[CFG] added configuration 'myconn'<br/>
11[CFG] received stroke: initiate 'myconn'<br/>
12[IKE] initiating IKE_SA myconn[1] to 1xx.2xx.51.27<br/>
12[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br/>
12[NET] sending packet: from 192.168.67.176[500] to 1xx.2xx.51.27[500] (708 bytes)<br/>
13[NET] received packet: from 1xx.2xx.51.27[500] to 192.168.67.176[500] (440 bytes)<br/>
13[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]<br/>
13[IKE] local host is behind NAT, sending keep alives<br/>
13[IKE] authentication of 'myuser' (myself) with pre-shared key<br/>
13[IKE] establishing CHILD_SA myconn<br/>
13[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]<br/>
13[NET] sending packet: from 192.168.67.176[4500] to 1xx.2xx.51.27[4500] (412 bytes)<br/>
14[NET] received packet: from 1xx.2xx.51.27[4500] to 192.168.67.176[4500] (156 bytes)<br/>
14[ENC] parsed IKE_AUTH response 1 [ IDr AUTH N(AUTH_LFT) N(MOBIKE_SUP) N(NO_ADD_ADDR) N(TS_UNACCEPT) ]<br/>
14[IKE] authentication of 'vpn.xxx.net' with pre-shared key successful<br/>
14[IKE] IKE_SA myconn[1] established between 192.168.67.176[id_xxx]...1xx.2xx.51.27[vpn.xxx.net]<br/>
14[IKE] scheduling reauthentication in 3241s<br/>
14[IKE] maximum IKE_SA lifetime 3421s<br/>
14[IKE] received TS_UNACCEPTABLE notify, no CHILD_SA built<br/>
14[IKE] failed to establish CHILD_SA, keeping IKE_SA<br/>
14[IKE] received AUTH_LIFETIME of 3312s, scheduling reauthentication in 3132s<br/>
14[IKE] peer supports MOBIKE<br/>
09[IKE] sending keep alive to 1xx.2xx.51.27[4500]</div>
<div>--------------------------</div>
<div>--------------------------</div>
<div>client --nofork output</div>
<div>--------------------------</div>
<div>
<div>initiating IKE_SA myconn[1] to 1xx.2xx.51.27<br/>
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br/>
sending packet: from 192.168.67.176[500] to 1xx.2xx.51.27[500] (708 bytes)<br/>
received packet: from 1xx.2xx.51.27[500] to 192.168.67.176[500] (440 bytes)<br/>
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]<br/>
local host is behind NAT, sending keep alives<br/>
authentication of 'myuser' (myself) with pre-shared key<br/>
establishing CHILD_SA myconn<br/>
generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]<br/>
sending packet: from 192.168.67.176[4500] to 1xx.2xx.51.27[4500] (412 bytes)<br/>
received packet: from 1xx.2xx.51.27[4500] to 192.168.67.176[4500] (156 bytes)<br/>
parsed IKE_AUTH response 1 [ IDr AUTH N(AUTH_LFT) N(MOBIKE_SUP) N(NO_ADD_ADDR) N(TS_UNACCEPT) ]<br/>
authentication of 'vpn.xxx.net' with pre-shared key successful<br/>
IKE_SA myconn[1] established between 192.168.67.176[myuser]...1xx.2xx.51.27[vpn.xxx.net]<br/>
scheduling reauthentication in 3241s<br/>
maximum IKE_SA lifetime 3421s<br/>
received TS_UNACCEPTABLE notify, no CHILD_SA built<br/>
failed to establish CHILD_SA, keeping IKE_SA<br/>
establishing connection 'myconn' failed</div>
<div> </div>
<div>-------------------------------------------------------</div>
<div>-------------------------------------------------------</div>
<div>server - syslog</div>
<div>-------------------------------------------------------</div>
<div>
<div>Jun 6 09:16:15 kvm21729 charon: 16[CFG] looking for peer configs matching 1xx.2xx.51.27[vpn.xxx.net]...195.65.221.149[myuser]<br/>
Jun 6 09:16:15 kvm21729 kernel: [1850459.360251] [UFW AUDIT] IN=eth0 OUT= MAC=52:54:00:27:59:87:74:8e:f8:ce:9f:1e:08:00 SRC=195.65.221.149 DST=1xx.2xx.51.27 LEN=444 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=UDP SPT=43292 DPT=4500 LEN=424<br/>
Jun 6 09:16:15 kvm21729 kernel: [1850459.362679] [UFW AUDIT] IN= OUT=eth0 SRC=1xx.2xx.51.27 DST=91.227.204.227 LEN=67 TOS=0x00 PREC=0x00 TTL=64 ID=52288 DF PROTO=UDP SPT=56795 DPT=53 LEN=47<br/>
Jun 6 09:16:15 kvm21729 kernel: [1850459.362689] [UFW ALLOW] IN= OUT=eth0 SRC=1xx.2xx.51.27 DST=91.227.204.227 LEN=67 TOS=0x00 PREC=0x00 TTL=64 ID=52288 DF PROTO=UDP SPT=56795 DPT=53 LEN=47<br/>
Jun 6 09:16:15 kvm21729 charon: 16[CFG] selected peer config 'mint'<br/>
Jun 6 09:16:15 kvm21729 charon: 16[IKE] authentication of 'myuser' with pre-shared key successful<br/>
Jun 6 09:16:15 kvm21729 charon: 16[IKE] peer supports MOBIKE<br/>
Jun 6 09:16:15 kvm21729 charon: 16[IKE] authentication of 'vpn.xxx.net' (myself) with pre-shared key<br/>
Jun 6 09:16:15 kvm21729 charon: 16[IKE] IKE_SA mint[5] established between 1xx.2xx.51.27[vpn.xxx.net]...195.65.221.149[myuser]<br/>
Jun 6 09:16:15 kvm21729 charon: 16[IKE] scheduling reauthentication in 3312s<br/>
Jun 6 09:16:15 kvm21729 charon: 16[IKE] maximum IKE_SA lifetime 3492s<br/>
Jun 6 09:16:15 kvm21729 charon: 16[IKE] traffic selectors 0.0.0.0/0 === 192.168.67.176/32 inacceptable<br/>
Jun 6 09:16:15 kvm21729 charon: 16[IKE] failed to establish CHILD_SA, keeping IKE_SA<br/>
Jun 6 09:16:15 kvm21729 charon: 16[ENC] generating IKE_AUTH response 1 [ IDr AUTH N(AUTH_LFT) N(MOBIKE_SUP) N(NO_ADD_ADDR) N(TS_UNACCEPT) ]<br/>
Jun 6 09:16:15 kvm21729 charon: 16[NET] sending packet: from 1xx.2xx.51.27[4500] to 195.65.221.149[43292]<br/>
Jun 6 09:16:28 kvm21729 kernel: [1850472.218518] [UFW AUDIT] IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:52:54:00:46:40:69:08:00 SRC=1xx.2xx.50.187 DST=255.255.255.255 LEN=117 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=5678 DPT=5678 LEN=97<br/>
Jun 6 09:16:28 kvm21729 kernel: [1850472.650618] [UFW AUDIT] IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:52:54:00:27:36:a1:08:00 SRC=1xx.2xx.50.137 DST=255.255.255.255 LEN=117 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=5678 DPT=5678 LEN=97</div>
<div> </div>
</div>
<div> </div>
</div>
<div> </div>
</div></div></body></html>