<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi,<br>
<br>
Have configured IKEv2 device as initiator to verify initial
exchanges from End-point to Security Gateway.<br>
<br>
ipsec.conf has below parameters set:<br>
<pre>> type=tunnel
> left=2001:0db8:0001:0001::1
> # Remote address
> right=2001:0db8:000f:0001::1
> # Authentication method
> leftauth=psk
> rightauth=psk
> leftid=2001:0db8:0001:0001::1
> rightid=2001:0db8:000f:0001::1
> # Remote subnet
> rightsubnet=2001:0db8:000f:0002::/64</pre>
<pre>-bash-4.2# /usr/sbin/strongswan start
Starting strongSwan 5.2.0 IPsec [starter]...
-bash-4.2# ip xfrm policy list
src 2001:db8:f:2::/64 dst 2001:db8:1:1::1/128
dir fwd priority 5379 ptype main
tmpl src 2001:db8:f:1::1 dst 2001:db8:1:1::1
proto esp reqid 1 mode tunnel
src 2001:db8:f:2::/64 dst 2001:db8:1:1::1/128
dir in priority 5379 ptype main
tmpl src 2001:db8:f:1::1 dst 2001:db8:1:1::1
proto esp reqid 1 mode tunnel
src 2001:db8:1:1::1/128 dst 2001:db8:f:2::/64
dir out priority 5379 ptype main
tmpl src 2001:db8:1:1::1 dst 2001:db8:f:1::1
proto esp reqid 1 mode tunnel
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
src ::/0 dst ::/0
socket in priority 0 ptype main
src ::/0 dst ::/0
socket out priority 0 ptype main
src ::/0 dst ::/0
socket in priority 0 ptype main
src ::/0 dst ::/0
socket out priority 0 ptype main</pre>
<br>
IKE_SA_INIT exchange is successful and IKE_AUTH request is sent by
the end-point. <br>
Two traffic selectors are generated and the 2nd traffic selector has
the complete IPv6 addresses as its range.<br>
<br>
<tt>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1> generating
payload of type TRAFFIC_SELECTOR_SUBSTRUCTURE</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1>
generating rule 0 TS_TYPE</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1> =>
8</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1>
generating rule 1 U_INT_8</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1> =>
0</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1>
generating rule 2 PAYLOAD_LENGTH</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1> =>
2 bytes @ 0x7f40dc1e9744</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1> 0: 00
28 .(</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1>
generating rule 3 U_INT_16</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1> =>
2 bytes @ 0x7f40dc1e9744</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1> 0: 00
00 ..</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1>
generating rule 4 U_INT_16</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1> =>
2 bytes @ 0x7f40dc1e9744</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1> 0: FF
FF ..</tt><tt><br>
</tt><tt><i>Sep 26 03:26:12 03[ENC] <tahi_ikev2_test|1>
generating rule 5 ADDRESS</i></tt><tt><i><br>
</i></tt><tt><i>Sep 26 03:26:12 03[ENC]
<tahi_ikev2_test|1> => 16 bytes @ 0x7f40bc005080</i></tt><tt><i><br>
</i></tt><tt><i>Sep 26 03:26:12 03[ENC]
<tahi_ikev2_test|1> 0: 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 ................</i></tt><tt><i><br>
</i></tt><tt><i>Sep 26 03:26:12 03[ENC]
<tahi_ikev2_test|1> generating rule 6 ADDRESS</i></tt><tt><i><br>
</i></tt><tt><i>Sep 26 03:26:12 03[ENC]
<tahi_ikev2_test|1> => 16 bytes @ 0x7f40bc0050a0</i></tt><tt><i><br>
</i></tt><tt><i>Sep 26 03:26:12 03[ENC]
<tahi_ikev2_test|1> 0: FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF ................</i></tt><br>
<br>
Before IKE_SA is created, charon.log shows the available traffic
selectors:<br>
<tt>Sep 26 03:25:53 11[CFG] received stroke: route 'tahi_ikev2_test'</tt><tt><br>
</tt><tt>Sep 26 03:25:53 11[CFG] proposing traffic selectors for us:</tt><tt><br>
</tt><tt>Sep 26 03:25:53 11[CFG] 2001:db8:1:1::1/128</tt><tt><br>
</tt><tt>Sep 26 03:25:53 11[CFG] proposing traffic selectors for
other:</tt><tt><br>
</tt><tt>Sep 26 03:25:53 11[CFG] 2001:db8:f:2::/64</tt><tt><br>
</tt><tt>Sep 26 03:25:53 11[CFG] configured proposals:
ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ</tt><br>
<br>
just after reinitiating IKE_AUTH task, proposed traffic shows ::/0<br>
<tt>Sep 26 03:26:12 03[CFG] <tahi_ikev2_test|1> proposing
traffic selectors for us:</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[CFG] <tahi_ikev2_test|1> ::/0</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[CFG] <tahi_ikev2_test|1> proposing
traffic selectors for other:</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[CFG] <tahi_ikev2_test|1>
2001:db8:f:2::/64</tt><tt><br>
</tt><tt>Sep 26 03:26:12 03[CFG] <tahi_ikev2_test|1>
configured proposals: ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ</tt><br>
<br>
Why is it proposing ::/0 instead of 2001:db8:1:1::1/128? <br>
<br>
Regards,<br>
Kumuda G<br>
</body>
</html>