<html><head><meta name="Generator" content="Z-Push"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body>Anyone have any ideas?<br><br>Sent from my iPhone<br><br>> On Dec 31, 2013, at 3:58 PM, "Chris Arnold" <carnold@electrichendrix.com> wrote:<br>> <br>> Stongswan 4.4.x on SLES11 SP2. A windows 7 client using ikev2 is trying to connect using rclients config from ipsec.conf. They get a invalid payload received from the windows 7 client. Here is the exchange from windows 7 to strongswan server:<br>> <br>> received packet: from 98.26.22x.xx[500] to 192.168.1.18[500]<br>> 07[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>> 07[IKE] 98.26.22x.xx is initiating an IKE_SA<br>> 07[IKE] local host is behind NAT, sending keep alives<br>> 07[IKE] remote host is behind NAT<br>> 07[IKE] sending cert request for "C=US, ST=NC, L=Durham, O=Edens Land Corp, OU=ELC, CN=name, E=email address"<br>> 07[IKE] sending cert request for "C=US, ST=North Carolina, L=Durham, O=Edens Land Corp, OU=ELC, CN=name, E=email address"<br>> 07[IKE] sending cert request for "C=CH, O=Edens Land Corp, CN=Edens Land Corp CA"<br>> 07[IKE] sending cert request for "C=FI, O=Test, CN=Test CA"<br>> 07[IKE] sending cert request for "C=CH, O=Edens Land Corp. CN=ELC RW VPN"<br>> 07[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]<br>> 07[NET] sending packet: from 192.168.1.18[500] to 98.26.22x.xx[500]<br>> 03[NET] received packet: from 98.26.22x.xx[4500] to 192.168.1.18[4500]<br>> 03[ENC] not enough input to parse rule 10 ENCRYPTED_DATA<br>> 03[ENC] payload type ENCRYPTED could not be parsed<br>> 03[IKE] message parsing failed<br>> 03[ENC] generating IKE_AUTH response 1 [ N(INVAL_SYN) ]<br>> 03[NET] sending packet: from 192.168.1.18[500] to 98.26.22x.xx[500]<br>> 03[IKE] IKE_AUTH request with message ID 1 processing failed<br>> <br>> Here is the ipsec config:<br>> conn rclientscerts<br>> rekey=no<br>> left=%any<br>> leftauth=pubkey<br>> leftcert=server_cert.crt<br>> leftid=@24.211.x.xx<br>> leftsubnet=0.0.0.0/0<br>> right=%any<br>> rightsourceip=192.168.2.0/24<br>> #rightauth=eap-mschapv2<br>> #rightsendcert=never<br>> #eap_identity=%any<br>> mobike=yes<br>> auto=add<br>> <br>> This use to work until we moved offices and got a new public ip. The above leftid reflects the new public ip. I just thought about something, the CN in the cert, does it need to reflect the new public ip? Not sure if that would matter....<br>> We have a site to site VPN with this same office and that works fine. Any ideas?<br>> <br>> _______________________________________________<br>> Users mailing list<br>> Users@lists.strongswan.org<br>> https://lists.strongswan.org/mailman/listinfo/users<br></body></html>