<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>I’m using the Mac OS X strongSwan widget and after upgrading to Yosemite, I am receiving the error "No common traffic selectors found” very frequently, but not 100% of the time. Something like 95% of the time. Prior to the upgrade this would happen only
occasionally (twice a month or so) and quitting and restarting the strongSwan widget would always allow me to connect. Now it can take upwards of 20 to 30 attempts with no reassurance that it will ever connect. :-(</div>
<div><br>
</div>
<div>The root of the trouble seems to be these lines in the log (full log included below):</div>
<div><br>
</div>
<div>
<div>
<div>Installing new virtual IP 10.100.255.1</div>
<div>created TUN device: utun1</div>
<div>virtual IP 10.100.255.1 did not appear on utun1</div>
<div>installing virtual IP 10.100.255.1 failed</div>
<div>no acceptable traffic selectors found</div>
</div>
</div>
<div><br>
</div>
<div>I found some discussion from 2013 about this error (https://lists.strongswan.org/pipermail/users/2013-September/005213.html) and later in that thread Martin linked a 5.1.0 (4) version of the widget, which I tried, but it didn’t resolve the issue.</div>
<div><br>
</div>
<div>Any advice? Any other Mac OS X folks having this problem? This is causing me some significant trouble as a remote employee who depends on resources on this VPN.</div>
<div><br>
</div>
<div>Thanks in advance, </div>
<div><br>
</div>
<div>-Dan</div>
<div><br>
</div>
<div>Dan Diman</div>
<div>dan.diman@certifi.net</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>===================Full log file================================</div>
<div><br>
</div>
<div>
<div>initiating IKE_SA Certifi VPC[8] to x.x.x.x</div>
<div>generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</div>
<div>sending packet: from 192.168.0.8[55139] to x.x.x.x[4500] (1108 bytes)</div>
<div>received packet: from x.x.x.x[4500] to 192.168.0.8[55139] (38 bytes)</div>
<div>parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]</div>
<div>peer didn't accept DH group MODP_2048, it requested MODP_1024</div>
<div>initiating IKE_SA Certifi VPC[8] to x.x.x.x</div>
<div>generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</div>
<div>sending packet: from 192.168.0.8[55139] to x.x.x.x[4500] (980 bytes)</div>
<div>received packet: from x.x.x.x[4500] to 192.168.0.8[55139] (312 bytes)</div>
<div>parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]</div>
<div>local host is behind NAT, sending keep alives</div>
<div>remote host is behind NAT</div>
<div>establishing CHILD_SA Certifi VPC</div>
<div>generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]</div>
<div>sending packet: from 192.168.0.8[58559] to x.x.x.x[4500] (380 bytes)</div>
<div>received packet: from x.x.x.x[4500] to 192.168.0.8[58559] (1212 bytes)</div>
<div>parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]</div>
<div>received end entity cert "C=CH, O=Certifi, CN=vpn.enrfin.com"</div>
<div> using certificate "C=CH, O=Certifi, CN=vpn.enrfin.com"</div>
<div> using trusted ca certificate "C=CH, O=Certifi, CN=Certifi MN"</div>
<div> reached self-signed root ca with a path length of 0</div>
<div>authentication of 'vpn.enrfin.com' with RSA signature successful</div>
<div>server requested EAP_IDENTITY (id 0x00), sending 'ddiman'</div>
<div>generating IKE_AUTH request 2 [ EAP/RES/ID ]</div>
<div>sending packet: from 192.168.0.8[58559] to x.x.x.x[4500] (76 bytes)</div>
<div>received packet: from x.x.x.x[4500] to 192.168.0.8[58559] (108 bytes)</div>
<div>parsed IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]</div>
<div>server requested EAP_MSCHAPV2 authentication (id 0xE4)</div>
<div>generating IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]</div>
<div>sending packet: from 192.168.0.8[58559] to x.x.x.x[4500] (140 bytes)</div>
<div>received packet: from x.x.x.x[4500] to 192.168.0.8[58559] (140 bytes)</div>
<div>parsed IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]</div>
<div>EAP-MS-CHAPv2 succeeded: 'Welcome2strongSwan'</div>
<div>generating IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]</div>
<div>sending packet: from 192.168.0.8[58559] to x.x.x.x[4500] (76 bytes)</div>
<div>received packet: from x.x.x.x[4500] to 192.168.0.8[58559] (76 bytes)</div>
<div>parsed IKE_AUTH response 4 [ EAP/SUCC ]</div>
<div>EAP method EAP_MSCHAPV2 succeeded, MSK established</div>
<div>authentication of 'ddiman' (myself) with EAP</div>
<div>generating IKE_AUTH request 5 [ AUTH ]</div>
<div>sending packet: from 192.168.0.8[58559] to x.x.x.x[4500] (92 bytes)</div>
<div>received packet: from x.x.x.x[4500] to 192.168.0.8[58559] (252 bytes)</div>
<div>parsed IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) ]</div>
<div>authentication of 'vpn.enrfin.com' with EAP successful</div>
<div>IKE_SA Certifi VPC[8] established between 192.168.0.8[ddiman]…x.x.x.x[vpn.enrfin.com]</div>
<div>scheduling rekeying in 35788s</div>
<div>maximum IKE_SA lifetime 36388s</div>
<div>installing 192.168.101.170 as DNS server</div>
<div><span style="background-color: rgb(255, 255, 0);">installing new virtual IP 10.100.255.1</span></div>
<div><span style="background-color: rgb(255, 255, 0);">created TUN device: utun1</span></div>
<div><span style="background-color: rgb(255, 255, 0);">virtual IP 10.100.255.1 did not appear on utun1</span></div>
<div><span style="background-color: rgb(255, 255, 0);">installing virtual IP 10.100.255.1 failed</span></div>
<div><span style="background-color: rgb(255, 255, 0);">no acceptable traffic selectors found</span></div>
<div>closing IKE_SA due CHILD_SA setup failure</div>
<div>peer supports MOBIKE</div>
<div>sending DELETE for ESP CHILD_SA with SPI 1ab6354c</div>
<div>generating INFORMATIONAL request 6 [ D ]</div>
<div>sending packet: from 192.168.0.8[58559] to x.x.x.x[4500] (76 bytes)</div>
<div>sending address list update using MOBIKE</div>
<div>received packet: from x.x.x.x[4500] to 192.168.0.8[58559] (76 bytes)</div>
<div>parsed INFORMATIONAL response 6 [ D ]</div>
<div>generating INFORMATIONAL request 7 [ N(ADD_4_ADDR) ]</div>
<div>sending packet: from 192.168.0.8[58559] to x.x.x.x[4500] (76 bytes)</div>
<div>received packet: from x.x.x.x[4500] to 192.168.0.8[58559] (76 bytes)</div>
<div>parsed INFORMATIONAL response 7 [ ]</div>
<div>deleting IKE_SA Certifi VPC[8] between 192.168.0.8[ddiman]…x.x.x.x[vpn.enrfin.com]</div>
<div>sending DELETE for IKE_SA Certifi VPC[8]</div>
<div>generating INFORMATIONAL request 8 [ D ]</div>
<div>sending packet: from 192.168.0.8[58559] to x.x.x.x[4500] (76 bytes)</div>
<div>received packet: from x.x.x.x[4500] to 192.168.0.8[58559] (76 bytes)</div>
<div>parsed INFORMATIONAL response 8 [ ]</div>
<div>IKE_SA deleted</div>
</div>
<br>
</body>
</html>