<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Hi,</div>
<div> </div>
<div>We are seeing a problem with traffic selector narrowing scenario.</div>
<div> </div>
<div>“rightsubnet” on Sec-GW-1 has larger subnet compared to the “leftsubnet” on Sec-GW-2, But</div>
<div>“*protoport” fields on Sec-GW-2 has wider range(any) compared to Sec-GW-1.</div>
<div> </div>
<div>With this configuration ESP tunnel establishment fails with “traffic selector unacceptable” .</div>
<div>It works if the “*protoport” on both sides is same.</div>
<div>Also we observed that if both the “ip addres and protocol/port” ranges are wider on sec-GW-1 then it works.</div>
<div> </div>
<div>Could you please explain the rationale behind this behavior ?</div>
<div> </div>
<table width="798" style="width:478.8pt;">
<col width="399" style="width:239.4pt;">
<col width="399" style="width:239.4pt;">
<tr>
<td><font size="4"><span style="font-size:14pt;"><b>Configuration on Sec-GW-1</b></span></font></td>
<td><font size="4"><span style="font-size:14pt;"><b>Configuration on Sec-GW-2</b></span></font></td>
</tr>
<tr>
<td>conn conn6
<div> type=tunnel</div>
<div><b> leftsubnet=30.30.30.30/32</b></div>
<div><b> </b><font color="red"><b>rightsubnet=11.0.0.0/16</b></font></div>
<div> left=30.30.30.30</div>
<div> right=30.30.30.31</div>
<div> keyexchange=ikev2</div>
<div> authby=psk</div>
<div> reauth=no</div>
<div> ike=aes128-sha1-modp1024,3des-sha1-modp1024!</div>
<div> ikelifetime=864000</div>
<div> pfs=no</div>
<div> esp=3des-sha1!</div>
<div> keylife=86400</div>
<div> dpdaction=clear</div>
<div> dpddelay=10</div>
<div><font color="red"><b> leftprotoport=1</b></font></div>
<div><font color="red"><b> rightprotoport=1</b></font></div>
<div> rekeyfuzz=100%</div>
<div> rekeymargin=540s</div>
<div> </div>
</td>
<td>conn conn6
<div> type=tunnel</div>
<div><b> rightsubnet=30.30.30.30/32</b></div>
<div><b> </b><font color="red"><b>leftsubnet=11.0.1.0/24</b></font></div>
<div> right=30.30.30.30</div>
<div> left=30.30.30.31</div>
<div> keyexchange=ikev2</div>
<div> authby=psk</div>
<div> reauth=no</div>
<div> ike=aes128-sha1-modp1024,3des-sha1-modp1024!</div>
<div> ikelifetime=86400</div>
<div> pfs=no</div>
<div> esp=3des-sha1!</div>
<div> keylife=28800</div>
<div> dpdaction=clear</div>
<div> dpddelay=10</div>
<div><font color="red"><b> rightprotoport=any</b></font></div>
<div><font color="red"><b> leftprotoport=any</b></font></div>
<div> rekeyfuzz=100%</div>
<div> rekeymargin=540s</div>
<div> </div>
</td>
</tr>
<tr>
<td></td>
<td></td>
</tr>
</table>
<div> </div>
<div>BR,</div>
<div>Shashidhar</div>
<div> </div>
</span></font>
</body>
</html>