<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;">Hi everyone,</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">I am trying to setup a simple ipsec tunnel ( net-to-net) using PSK following the example showing here in strongswan website: <a href="http://www.strongswan.org/uml/testresults/ikev1/net2net-psk/" style="font-size: 12pt;">http://www.strongswan.org/uml/testresults/ikev1/net2net-psk/</a></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style:
normal;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">I am running strongswan 5.0.1 on both sides and I am using the exact set up shown in this example.</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">My left gateway is lmu55=192.168.1.55 and right gateway is lmu56=192.168.1.56. When I start the strongswan on both side and issue the command >>ipsec -up lmu55</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">(lmu55 is connection name for the left side)from the left side I get the following messages and connection fails . I looked at the tcpdump data and it seems it
completes phase1 but fails on phase2. I can also see in the stablishment of SA :</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><span style="font-size: 16px;">....... </span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><span style="font-size: 16px;">KE_SA lmu55[1] established between 192.168.1.55[lmu55.strongswan.com]...192.168.1.56[lmu56.strongswan.com]</span><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">....</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style:
normal;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">Error is [ HASH N(INVAL_ID) ] which you can see below in the output of ipsec command</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">I am wonder what I am missing here in my setup. </div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">I appreciate your help in advance.</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px;
color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">Farid</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><br></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">root@LMU5k:~# ipsec up lmu55</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">initiating Main Mode IKE_SA lmu55[1] to 192.168.1.56</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">generating ID_PROT request 0 [ SA V V V V ]</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times,
serif">sending packet: from 192.168.1.55[500] to 192.168.1.56[500] (224 bytes)</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">received packet: from 192.168.1.56[500] to 192.168.1.55[500] (136 bytes)</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">parsed ID_PROT response 0 [ SA V V V ]</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">received XAuth vendor ID</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">received DPD vendor ID</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">received NAT-T (RFC 3947) vendor ID</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">generating ID_PROT request 0 [ KE No
NAT-D NAT-D ]</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">sending packet: from 192.168.1.55[500] to 192.168.1.56[500] (372 bytes)</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">received packet: from 192.168.1.56[500] to 192.168.1.55[500] (372 bytes)</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">generating ID_PROT request 0 [ ID HASH ]</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">sending packet: from 192.168.1.55[500] to 192.168.1.56[500] (92 bytes)</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times,
serif">received packet: from 192.168.1.56[500] to 192.168.1.55[500] (92 bytes)</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">parsed ID_PROT response 0 [ ID HASH ]</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">IKE_SA lmu55[1] established between 192.168.1.55[lmu55.strongswan.com]...192.168.1.56[lmu56.strongswan.com]</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">scheduling reauthentication in 10258s</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">maximum IKE_SA lifetime 10798s</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">generating QUICK_MODE request 1597565745 [ HASH SA No ID ID ]</font></div><div style="background-color: transparent;"><font
face="times new roman, new york, times, serif">sending packet: from 192.168.1.55[500] to 192.168.1.56[500] (236 bytes)</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">received packet: from 192.168.1.56[500] to 192.168.1.55[500] (76 bytes)</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">parsed INFORMATIONAL_V1 request 4090518834 [ HASH N(INVAL_ID) ]</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">received INVALID_ID_INFORMATION error notify</font></div><div style="background-color: transparent;"><font face="times new roman, new york, times, serif">establishing connection 'lmu55' failed</font></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"><br></div></div></body></html>