<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>Hi everyone,</p>
<p>I have a problem and can not find a solution for it.</p>
<p>Following configuration is set up:</p>
<p> </p>
<p>host a</p>
<p>ipsec.conf:<br /><em>config setup</em><br /><em> uniqueids=yes</em><br /><em> cachecrls=yes</em></p>
<p><em>conn proxy</em><br /><em> ikelifetime=7800</em><br /><em> keylife=7800</em><br /><em> rekeymargin=30m</em><br /><em> keyingtries=5</em><br /><em> keyexchange=ike</em><br /><em> authby=secret</em><br /><em> left=%defaultroute (<-dynamic changing address)</em><br /><em> leftsubnet=10.10.42.0/24 (<- local network site a)</em><br /><em> leftfirewall=yes</em><br /><em> leftid=jens</em><br /><em> right=x.x.x.x (<- public ip of host b)</em><br /><em> rightsubnet=10.20.21.0/24 (<- local network site b)</em><br /><em> auto=start</em></p>
<p> </p>
<p>ipsec.secrets:<br /><em>x.x.x.x %defaultroute : PSK "secret"</em></p>
<p> </p>
<p>host b</p>
<p>ipsec.conf:<br /><em>config setup</em><br /><em> cachecrls=yes</em><br /><em> uniqueids=yes</em></p>
<p><em>conn jkg</em><br /><em> ikelifetime=7800</em><br /><em> keylife=7800</em><br /><em> rekeymargin=30m</em><br /><em> keyingtries=5</em><br /><em> keyexchange=ike</em><br /><em> authby=secret</em><br /><em> left=x.x.x.x</em><br /><em> leftsubnet=10.20.21.0/24</em><br /><em> leftfirewall=yes</em><br /><em> right=%any</em><br /><em> rightid=jens</em><br /><em> rightsubnet=10.10.42.0/24</em><br /><em> auto=add</em></p>
<p> </p>
<p>ipsec.secrets:<br /><em>jens x.x.x.x : PSK "secret"</em></p>
<p> </p>
<p>My problem is the following:</p>
<p>When I start strongswan on host b and host a nothing happens. "ipsec statusall" on host a shows "connecting", on host b nothing incoming.</p>
<p>When I start same config of host a on a host on local network on site a, which is nat'ed through host a, the connection works perfectly. Why can I not start the connection directly on host a (which is not nat'ed).</p>
<p>Can anyone give me a solution which I have to change in config for getting it working from host a to host b?</p>
<p>Thanks,</p>
<p>Jens</p>
</body></html>