<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>For the Fortigate connection if I add in both locla and remote
ID, instead of only remote ID, i get the following:</p>
<p>authentication of '85.230.x.x' with pre-shared key successful<br>
constraint check failed: identity 'remote.example' required<br>
selected peer config 'site2site' inacceptable: constraint checking
failed<br>
no alternative config found</p>
<p>Only remote ID as you suggested</p>
<p>parsed IKE_AUTH response 1 [ IDr AUTH SA TSi TSr ]<br>
no shared key found for 'local.example' - '85.230.x.x'<br>
generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ]<br>
</p>
<br>
<div class="moz-cite-prefix">Den 2017-04-29 kl. 13:26, skrev Dusan
Ilic:<br>
</div>
<blockquote
cite="mid:4ff22c2a-7c80-cf3e-6d3c-07b5e7703aaa@comhem.se"
type="cite">
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<p>no shared key found for 'local.example' - '137.135.x.x'<br>
generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ]</p>
<p>The remote side is a Fortigate firewall, so I can't configure
it the same. I can just choose local interface (ie wan) and
remote gateway IP or Dynamic DNS, I have chosen Dynamic DNS.<br>
It logs "<span style="color: rgb(0, 0, 0); font-family: Verdana,
Arial, Helvetica; font-size: 10px; font-style: normal;
font-variant: normal; font-weight: normal; letter-spacing:
normal; line-height: 14.64px; orphans: auto; text-align: left;
text-indent: 0px; text-transform: none; white-space: nowrap;
widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px;
display: inline !important; float: none; background-color:
rgb(255, 255, 255);">peer SA proposal not match local policy</span>".<br>
</p>
<p>If I change to IP adresses it works, but that won't work for
very long unfortunately.<br>
</p>
<br>
<div class="moz-cite-prefix">Den 2017-04-29 kl. 02:49, skrev Noel
Kuntze:<br>
</div>
<blockquote
cite="mid:3fd025ee-e094-645c-58c2-213590fd6a77@thermi.consulting"
type="cite">
<pre wrap="">Hello Dusan,
On 29.04.2017 02:25, Dusan Ilic wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi Noel,
Okey, if I don't set "left" and initiate the connection it takes the wrong route (multiple WAN-interfaces) and the remote peer don't expect that source IP. Probably works better if the remote peer is initiating connection instead.
If I set "left=%local.example" and "right" / "rightid" as you suggest I get the following output n logfile:
Apr 29 00:10:51 R6250 daemon.info charon: 10[IKE] tried 1 shared key for 'local.example' - '137.135.x.x', but MAC mismatched
Apr 29 00:10:51 R6250 daemon.info charon: 10[ENC] generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ]
If i fiddle in ipsec.secrets a bit, i get this instead:
authentication of '137.135.x.x' with pre-shared key successful
constraint check failed: identity 'remote.example' required
selected peer config 'site2site' inacceptable: constraint checking failed
no alternative config found
</pre>
</blockquote>
<pre wrap="">Alright. Try the following
left=%local.example
leftid=local.example
right=%remote.example
rightid=remote.example
remote.example : PSK "PSKGOESHERE"
Do it vice versa on the remote peer.
Kind regards,
Noel
</pre>
</blockquote>
<br>
</blockquote>
<br>
</body>
</html>