<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.6.6">
</HEAD>
<BODY>
On Mon, 2015-03-02 at 10:53 +0100, Martin Willi wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
Hi James,
<FONT COLOR="#737373">> Here's the log with error...</FONT>
<FONT COLOR="#737373">> 08[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH CPRP(ADDR) SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) ]</FONT>
<FONT COLOR="#737373">> 08[NET] sending packet: from server.external.ip[4500] to client.external.ip[15546] (2204 bytes)</FONT>
<FONT COLOR="#737373">> 11[NET] received packet: from client.external.ip[15546] to server.external.ip[4500] (1916 bytes)</FONT>
<FONT COLOR="#737373">> 11[ENC] parsed IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) ] </FONT>
<FONT COLOR="#737373">> 11[IKE] received retransmit of request with ID 1, retransmitting response</FONT>
I don't see much of an error here. The client is successfully
authenticated and the SA is set up. The client retransmits the IKE_AUTH
request, most likely because the first IKE_AUTH response gets lost.
Please check where/why the message gets lost if this is reproducible,
and what the error is on the client.
Regards
Martin
</PRE>
</BLOCKQUOTE>
<BR>
Thanks for looking at this Martin. As I look more at this from the client side, this might be a same subnet type issue. I'm using a linux laptop via a tethered phone for testing and the interface gets assigned a 192.168.0 address, which is pretty close to mine. Look like I'll have to bite the bullet and change the ipsec info to something different like 172.16 or something like that. I can say that this same phone can connect using this exact same setup (client cert is a p12 though) and it works just fine. I'll make the change and report my findings...thanks so much.<BR>
<BR>
James
</BODY>
</HTML>