<div dir="ltr"><div>I am trying to track down a connection issue and I tracked it down to an "inacceptable" traffic selector error on a transport connection with the route=auto. </div><div>What is very strange is I can bring the connection manually using the "ipsec up" command and the connection is established.</div>
<div><br></div><div>I am really stumped on this one... </div><div><br></div><div>I am using 5.1.0 in transport mode with the following config.</div><div><br></div><div><div># basic configuration</div><div>config setup</div>
<div> strictcrlpolicy=no</div><div> uniqueids = no</div><div><br></div></div><div>Here are my connection defaults:</div><div><div>
# Default connection attributes for ipsec.conf</div><div>#</div><div>conn %default</div><div> authby=secret</div><div> mobike=no</div><div> closeaction=none</div><div> dpdaction=clear</div><div> dpddelay=30s</div><div>
dpdtimeout=150s</div><div> inactivity=30m</div><div> ikelifetime=3h</div><div> keyexchange=ikev2</div><div> keyingtries=3</div><div> lifetime=1h</div><div> reauth=yes</div><div> rekey=yes</div><div> margintime=9m</div>
<div> esp=aes256!</div><div> ike=aes256-sha384-prfsha384-ecp384!</div><div> forceencaps=yes</div><div> type=transport</div><div> auto=route</div></div><div><br></div><div>Here is the connections in question:</div>
<div><div>conn 4.6.3000.10-98-108-194.0<br></div><div> left=%any</div><div> leftid=a27</div><div> leftprotoport=6/3000</div><div> rightid=a26</div><div> right=10.98.108.194</div><div> rightprotoport=6/%any</div></div>
<div><br></div><div>I should note there are other connections in transport mode to this server on port 80 and 3306 and they are connected without issue.</div><div><br></div><div>013-08-30T17:22:03-0700 01[MGR] checkout IKE_SA</div>
<div>2013-08-30T17:22:03-0700 01[MGR] IKE_SA 4.17.0.10-98-108-199.11211[6] successfully checked out</div><div>2013-08-30T17:22:03-0700 01[KNL] querying policy <a href="http://10.98.108.199/32%5Btcp/11211%5D" target="_blank">10.98.108.199/32[tcp/11211]</a> === <a href="http://10.98.108.195/32%5Btcp%5D" target="_blank">10.98.108.195/32[tcp]</a> in (mark 0/0x00000000)</div>
<div>2013-08-30T17:22:03-0700 01[MGR] checkin IKE_SA 4.17.0.10-98-108-199.11211[6]</div><div>2013-08-30T17:22:03-0700 01[MGR] check-in of IKE_SA successful.</div><div>2013-08-30T17:22:03-0700 09[NET] received packet: from 10.98.108.194[4500] to 10.98.108.195[4500]</div>
<div>2013-08-30T17:22:03-0700 09[NET] waiting for data on sockets</div><div>2013-08-30T17:22:03-0700 16[MGR] checkout IKE_SA by message</div><div>2013-08-30T17:22:03-0700 16[MGR] IKE_SA 4.6.80.10-98-108-194.0[5] successfully checked out</div>
<div>2013-08-30T17:22:03-0700 16[NET] received packet: from 10.98.108.194[4500] to 10.98.108.195[4500] (248 bytes)</div><div>2013-08-30T17:22:03-0700 16[ENC] parsed CREATE_CHILD_SA request 99 [ N(USE_TRANSP) SA No TSi TSr ]</div>
<div>2013-08-30T17:22:03-0700 16[CFG] looking for a child config for <a href="http://10.98.108.195/32%5Btcp/3000%5D" target="_blank">10.98.108.195/32[tcp/3000]</a> <a href="http://10.98.108.195/32%5Btcp/3000%5D" target="_blank">10.98.108.195/32[tcp/3000]</a> === <a href="http://10.98.108.194/32%5Btcp%5D" target="_blank">10.98.108.194/32[tcp]</a> <a href="http://10.98.108.194/32%5Btcp%5D" target="_blank">10.98.108.194/32[tcp]</a></div>
<div>2013-08-30T17:22:03-0700 16[CFG] looking for a child config for <a href="http://10.98.108.195/32%5Btcp/3000%5D" target="_blank">10.98.108.195/32[tcp/3000]</a> <a href="http://10.98.108.195/32%5Btcp/3000%5D" target="_blank">10.98.108.195/32[tcp/3000]</a> === <a href="http://10.98.108.194/32%5Btcp%5D" target="_blank">10.98.108.194/32[tcp]</a> <a href="http://10.98.108.194/32%5Btcp%5D" target="_blank">10.98.108.194/32[tcp]</a></div>
<div>2013-08-30T17:22:03-0700 16[IKE] traffic selectors <a href="http://10.98.108.195/32%5Btcp/3000%5D" target="_blank">10.98.108.195/32[tcp/3000]</a> <a href="http://10.98.108.195/32%5Btcp/3000%5D" target="_blank">10.98.108.195/32[tcp/3000]</a> === <a href="http://10.98.108.194/32%5Btcp%5D" target="_blank">10.98.108.194/32[tcp]</a> <a href="http://10.98.108.194/32%5Btcp%5D" target="_blank">10.98.108.194/32[tcp]</a> inacceptable</div>
<div>2013-08-30T17:22:03-0700 16[IKE] failed to establish CHILD_SA, keeping IKE_SA</div><div>2013-08-30T17:22:03-0700 16[ENC] generating CREATE_CHILD_SA response 99 [ N(TS_UNACCEPT) ]</div><div>2013-08-30T17:22:03-0700 16[NET] sending packet: from 10.98.108.195[4500] to 10.98.108.194[4500] (88 bytes)</div>
<div>2013-08-30T17:22:03-0700 06[NET] sending packet: from 10.98.108.195[4500] to 10.98.108.194[4500]</div><div>2013-08-30T17:22:03-0700 16[MGR] checkin IKE_SA 4.6.80.10-98-108-194.0[5]</div><div>2013-08-30T17:22:03-0700 16[MGR] check-in of IKE_SA successful. </div>
<div><br></div><div><div>Any suggestions as to why the connection will not come up by itself?</div></div><div><br></div><div>Regards, </div><div>Dan Cook</div></div>