<html><head></head><body lang="en-GB" style="background-color: rgb(255, 255, 255); line-height: initial;"> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">What happened when you initiate host-host connection from any side? Can you share your ipsec.conf file contents so I could see if any mistakes over there? One more question how are your firewall rules configured? Do they allow udp 500,4500, ah, esp protocols from both side?</div> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br style="display:initial"></div> <div style="font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Anvar Kuchkartaev <br>anvar@anvartay.com </div> <table width="100%" style="background-color:white;border-spacing:0px;"> <tbody><tr><td colspan="2" style="font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"> <div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in; font-family: Tahoma, 'BB Alpha Sans', 'Slate Pro'; font-size: 10pt;"> <div><b>From: </b>Chengcheng Fu</div><div><b>Sent: </b>miércoles, 13 de septiembre de 2017 06:27 p.m.</div><div><b>To: </b>users@lists.strongswan.org</div><div><b>Subject: </b>[strongSwan] strongswan not picking up traffic</div></div></td></tr></tbody></table><div style="border-style: solid none none; border-top-color: rgb(186, 188, 209); border-top-width: 1pt; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"></div><br><div id="_originalContent" style=""><div>Hi,</div><div><br data-mce-bogus="1"></div><div>I'm trying to setup a GRE over IPSec.</div><div><br data-mce-bogus="1"></div><div>I have the GRE working, but Strongswan wouldn't pickup the gre traffic and encrypt it.</div><div><br data-mce-bogus="1"></div><div>Following is my topology</div><div><br data-mce-bogus="1"></div><div>hub 192.168.23.193 - 192.168.23.203 spoke</div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>And here are my output.</div><div>Hub side:</div><div>Status of IKE charon daemon (strongSwan 5.6.0, Linux 4.9.47, x86_64):<br> uptime: 108 seconds, since Sep 14 00:23:00 2017<br> malloc: sbrk 2027520, mmap 0, used 273392, free 1754128<br> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0<br> loaded plugins: charon aes des rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem fips-prf gmp curve25519 xcbc cmac hmac attr kernel-netlink resolve socket-default stroke vici updown xauth-generic<br>Listening IP addresses:<br> 192.168.23.193<br> 192.168.34.1<br>Connections:<br> host-host: 192.168.23.193...%any IKEv2<br> host-host: local: [192.168.23.193] uses pre-shared key authentication<br> host-host: remote: uses pre-shared key authentication<br> host-host: child: dynamic[gre] === dynamic[gre] TRANSPORT<br>Security Associations (0 up, 0 connecting):<br> none</div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Spoke side:</div><div>Status of IKE charon daemon (strongSwan 5.6.0, Linux 4.9.47, x86_64):<br> uptime: 4 seconds, since Sep 14 00:17:44 2017<br> malloc: sbrk 2289664, mmap 0, used 287184, free 2002480<br> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0<br> loaded plugins: charon aes des rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem fips-prf gmp curve25519 xcbc cmac hmac attr kernel-netlink resolve socket-default stroke vici updown xauth-generic<br>Listening IP addresses:<br> 192.168.23.203<br> 192.168.34.3<br>Connections:<br> host-host: 192.168.23.203...192.168.23.193 IKEv2<br> host-host: local: [192.168.23.203] uses pre-shared key authentication<br> host-host: remote: [192.168.23.193] uses pre-shared key authentication<br> host-host: child: dynamic[gre] === dynamic[gre] TRANSPORT<br>Security Associations (0 up, 0 connecting):<br> none</div><div><br></div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Any thoughts?</div><div><br data-mce-bogus="1"></div><div>Regards,</div><div><br data-mce-bogus="1"></div><div>Terry</div><br><!--end of _originalContent --></div></body></html>