<style>blockquote {padding-left: 1ex; margin: 0px 0px 0px 0.8ex; border-left: #cccccc 1px solid;} p {margin: 0px;padding: 0px;} </style>
<p>Try to disable unity plugin :<br /><br /></p>
<p> </p>
<p>cat /etc/strongswan.d/charon/unity.conf <br />unity {<br /> load = no<br /><br />}<br />Regards,<br />Kamil Krajniak</p>
<p> </p>
<blockquote>
<div dir="ltr">
<div class="gmail_default" style="font-family: tahoma,sans-serif; font-size: small; color: #0b5394;">Hi Everyone, </div>
<div class="gmail_default" style="font-family: tahoma,sans-serif; font-size: small; color: #0b5394;"> </div>
<div class="gmail_default" style="font-family: tahoma,sans-serif; font-size: small; color: #0b5394;">I'm in midst of building IPsec tunnel towards a Mikrotik router. </div>
<div class="gmail_default" style="font-family: tahoma,sans-serif; font-size: small; color: #0b5394;">Phase 1 IKE establishes successfully but Phase 2 CHILD_SA fails. Kindly advise me on the failing point. </div>
<div class="gmail_default" style="font-family: tahoma,sans-serif; font-size: small; color: #0b5394;"> </div>
<div class="gmail_default" style="font-family: tahoma,sans-serif; font-size: small; color: #0b5394;">My strongswan config is as below : </div>
<div class="gmail_default" style="font-family: tahoma,sans-serif; font-size: small; color: #0b5394;"> </div>
<blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;">package strongswan</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> </span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;">config general 'general'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option strictcrlpolicy 'no'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option cachecrls 'no'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option crlcheckinterval '0'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option uniqueids 'yes'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option enabled '1'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option keepalive '30'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option debug 'all'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> </span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;">config connection</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option ikeversion '2'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option enabled 'yes'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option name 'VPNHUB01'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option waniface 'wan1 wan2'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option locallan '11.11.11.1'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option locallanmask '255.255.255.0'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option remoteaddress '103.54.93.45'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option remotelan '12.12.12.1'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option remotelanmask '255.255.255.0'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option type 'tunnel'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option dpdaction 'restart'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option dpddelay '30s'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option dpdtimeout '120s'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option ike 'aes128-sha1-modp1024'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option esp 'aes128-sha1'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option ikelifetime '24h'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option rekeymargin '9m'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option keylife '8h'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option keyingtries '%forever'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option auto 'start'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option authby 'psk'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> </span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;">config secret</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option enabled 'yes'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option remoteaddress '103.54.93.45'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option secret 'cisco'</span></div>
</div>
<div class="gmail_default">
<div class="gmail_default"><span style="color: #0b5394; font-family: tahoma,sans-serif;"> option secrettype 'psk'</span></div>
</div>
</blockquote>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;"> </div>
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;"> </div>
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">Logs lines : </div>
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;"> </div>
</div>
<blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:37 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 11[IKE] <VPNHUB01|1> initiating IKE_SA VPNHUB01[1] to 103.54.93.45</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:37 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 11[ENC] <VPNHUB01|1> generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:37 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 11[NET] <VPNHUB01|1> sending packet: from 10.8.162.93[500] to 103.54.93.45[500] (564 bytes)</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:38 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[NET] <VPNHUB01|1> received packet: from 103.54.93.45[500] to 10.8.162.93[500] (296 bytes)</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:38 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[ENC] <VPNHUB01|1> parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:38 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[IKE] <VPNHUB01|1> local host is behind NAT, sending keep alives</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:38 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[IKE] <VPNHUB01|1> authentication of '10.8.162.93' (myself) with pre-shared key</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:38 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[IKE] <VPNHUB01|1> establishing CHILD_SA VPNHUB01</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:38 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[ENC] <VPNHUB01|1> generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(EAP_ONLY) ]</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:39 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[NET] <VPNHUB01|1> sending packet: from 10.8.162.93[4500] to 103.54.93.45[4500] (348 bytes)</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:43 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 08[IKE] <VPNHUB01|1> retransmit 1 of request with message ID 1</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:43 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 08[NET] <VPNHUB01|1> sending packet: from 10.8.162.93[4500] to 103.54.93.45[4500] (348 bytes)</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:50 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 11[IKE] <VPNHUB01|1> retransmit 2 of request with message ID 1</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:50 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 11[NET] <VPNHUB01|1> sending packet: from 10.8.162.93[4500] to 103.54.93.45[4500] (348 bytes)</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:51 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[NET] <VPNHUB01|1> received packet: from 103.54.93.45[4500] to 10.8.162.93[4500] (348 bytes)</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:51 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[ENC] <VPNHUB01|1> parsed IKE_AUTH response 1 [ IDr AUTH N(TS_UNACCEPT) ]</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:51 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[IKE] <VPNHUB01|1> authentication of '103.54.93.45' with pre-shared key successful</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:51 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[IKE] <VPNHUB01|1> IKE_SA VPNHUB01[1] established between 10.8.162.93[10.8.162.93]...103.54.93.45[103.54.93.45]</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:51 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[IKE] <VPNHUB01|1> scheduling rekeying in 85411s</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:51 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[IKE] <VPNHUB01|1> maximum IKE_SA lifetime 85951s</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:51 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[IKE] <VPNHUB01|1> received TS_UNACCEPTABLE notify, no CHILD_SA built</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:48:51 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 12[IKE] <VPNHUB01|1> failed to establish CHILD_SA, keeping IKE_SA</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:49:21 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 11[IKE] <VPNHUB01|1> establishing CHILD_SA VPNHUB01</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:49:21 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 11[ENC] <VPNHUB01|1> generating CREATE_CHILD_SA request 2 [ SA No TSi TSr ]</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:49:21 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 11[NET] <VPNHUB01|1> sending packet: from 10.8.162.93[4500] to 103.54.93.45[4500] (300 bytes)</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:49:22 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 10[NET] <VPNHUB01|1> received packet: from 103.54.93.45[4500] to 10.8.162.93[4500] (220 bytes)</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:49:22 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 10[ENC] <VPNHUB01|1> parsed CREATE_CHILD_SA response 2 [ N(TS_UNACCEPT) ]</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:49:22 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 10[IKE] <VPNHUB01|1> received TS_UNACCEPTABLE notify, no CHILD_SA built</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:49:22 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 10[IKE] <VPNHUB01|1> failed to establish CHILD_SA, keeping IKE_SA</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:49:45 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 10[IKE] <VPNHUB01|1> sending keep alive to 103.54.93.45[4500]</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div>Jun 12 14:49:52 <a href="http://daemon.info" target="_blank">daemon.info</a> 00E0C813015C ipsec: 11[IKE] <VPNHUB01|1> sending DPD request</div>
</div>
</div>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;">
<div> </div>
</div>
</div>
</blockquote>
<div class="gmail_default">
<div style="color: #0b5394; font-family: tahoma,sans-serif; font-size: small;"> </div>
</div>
<div> </div>
</div>
</blockquote>
<p><br /><br /></p>
<p> </p><br />