<div dir="ltr">Hello Tobias,<div><br></div><div>As per your advice i did run a check....but i did not see any of the errors or not-found messages when the config was loaded</div><div><br></div><div>On further narrowing down the issue...i believe the issue with "rightca=<xxxxxxxx-xxxx>" is ONLY when the ipsec-gw acts as a responder...</div><div><br></div><div>As a responder to incoming connections, it simply ignores the "rightca=xxxx" option and sends cert-requests for all the 100+ CAs to the remote-iniitator</div><div><br></div><div><br></div><div>But as a iniitator of the ipsec tunnel it properly uses the rightca option and sends cert request for only that ca, and also the ipsec tunnel is established successfully</div><div><br></div><div>Please find the sample traces as captured on my test-setup (sorry for the long info...i thought you may want to have to details...)</div><div><br></div><div>Note: the "leftsendcert=always" in the config, i intend to use primarily when i create connection profiles for remote Mac-iOs-GreenBow IKEv2 VPN clients using EAP-auth...i checked by removing this option completely...but it seems to have nothing to do with the issue observed for now...</div><div><br></div><div>-----------------------------------------------------------------------------------------------------------</div><div><br></div><div><div><br></div><div><br></div><div><br></div><div><br></div><div>ipsec config on DUT "leftgw"</div><div>===============================</div><div><br></div><div>root@leftgwgwdut:/etc# cat ipsec.conf</div><div># auto-generated config file from /tmp/etc/config/strongswan</div><div>config setup</div><div> charondebug="chd 2,knl 2,ike 2,cfg 2"</div><div> strictcrlpolicy=no</div><div><br></div><div>conn %default</div><div> auto=route</div><div> leftfirewall=yes</div><div> lefthostaccess=yes</div><div> keyingtries=1</div><div> mobike=no</div><div> fragmentation=yes</div><div> leftsendcert=always</div><div><br></div><div>conn s2s_topeergw1</div><div> left=1.1.1.11</div><div> right=2.2.2.51</div><div> auto=add</div><div> keyexchange=ikev1</div><div> leftauth=pubkey</div><div> rightauth=pubkey</div><div> leftid="/C=IN/ST=MAH/L=MUMBAI/O=Acme Systems/OU=acmenet/CN=<a href="http://vpnsrvgw1.acmenet.com">vpnsrvgw1.acmenet.com</a>"</div><div> rightid="C=CN,ST=BJG,L=PKG,O=Acme Systems,OU=BJGRND,CN=<a href="http://vpnsrvgw2.acmenet.com">vpnsrvgw2.acmenet.com</a>"</div><div> leftcert=/etc/ssl/certs/vpnsrvgw1cert.pem</div><div> rightca="C=IN,ST=TELG,L=HYDERABAD,O=Acme Systems,OU=CORPHQ,CN=RDBCA"</div><div> dpddelay=30</div><div> dpdtimeout=120</div><div> dpdaction=clear</div><div> ike=aes128-sha1-modp1536!</div><div> ikelifetime=28800s</div><div> esp=aes128-sha1-modp1536!</div><div> lifetime=3600s</div><div> rekeymargin=180s</div><div><br></div><div>conn s2s_topeergw1-1</div><div> auto=route</div><div> also=s2s_topeergw1</div><div> leftsubnet=<a href="http://192.168.1.0/24">192.168.1.0/24</a></div><div> rightsubnet=<a href="http://192.168.33.0/24">192.168.33.0/24</a></div><div><br></div><div>root@leftgwgwdut:/etc#</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div>As Initiator:</div><div>=============</div><div><br></div><div><br></div><div>Sep 24 10:40:33 leftgwdut VPN-RPC:<notice> Executing RPC for connection topeergw1 to bring up </div><div>Sep 24 10:40:33 leftgwdut VPN-cfg:<notice> Bringing UP tunnel s2s_topeergw1 ... </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 13[CFG] received stroke: initiate 's2s_topeergw1-1' </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] queueing ISAKMP_VENDOR task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] queueing ISAKMP_CERT_PRE task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] queueing MAIN_MODE task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] queueing ISAKMP_CERT_POST task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] queueing ISAKMP_NATD task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] queueing QUICK_MODE task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] activating new tasks </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] activating ISAKMP_VENDOR task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] activating ISAKMP_CERT_PRE task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] activating MAIN_MODE task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] activating ISAKMP_CERT_POST task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] activating ISAKMP_NATD task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] sending XAuth vendor ID </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] sending DPD vendor ID </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] sending Acme Unity vendor ID </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] sending FRAGMENTATION vendor ID </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] sending NAT-T (RFC 3947) vendor ID </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] sending draft-ietf-ipsec-nat-t-ike-02\n vendor ID </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] initiating Main Mode IKE_SA s2s_topeergw1[2] to 2.2.2.51 </div><div>Sep 24 10:40:33 leftgwdut charon:<info> Last message '14[IKE] initiating M' repeated 1 times, supressed by syslog-ng on leftgwdut </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[IKE] IKE_SA s2s_topeergw1[2] state change: CREATED => CONNECTING </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[CFG] configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536 </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[ENC] generating ID_PROT request 0 [ SA V V V V V V ] </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 14[NET] sending packet: from 1.1.1.11[500] to 2.2.2.51[500] (200 bytes) </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[NET] received packet: from 2.2.2.51[500] to 1.1.1.11[500] (156 bytes) </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[ENC] parsed ID_PROT response 0 [ SA V V V V ] </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[IKE] received XAuth vendor ID </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[IKE] received DPD vendor ID </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[IKE] received Acme Unity vendor ID </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[IKE] received NAT-T (RFC 3947) vendor ID </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[CFG] selecting proposal: </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[CFG] proposal matches </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[CFG] received proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536 </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[CFG] configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536 </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536 </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[IKE] reinitiating already active tasks </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[IKE] ISAKMP_VENDOR task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[IKE] ISAKMP_CERT_PRE task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[IKE] MAIN_MODE task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[ENC] generating ID_PROT request 0 [ KE No NAT-D NAT-D ] </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 15[NET] sending packet: from 1.1.1.11[500] to 2.2.2.51[500] (308 bytes) </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 16[NET] received packet: from 2.2.2.51[500] to 1.1.1.11[500] (550 bytes) </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 16[ENC] parsed ID_PROT response 0 [ KE No CERTREQ CERTREQ CERTREQ NAT-D NAT-D ] </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 16[IKE] received cert request for 'C=IN, O=strongSwan, CN=strongSwan CA' </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 16[IKE] received cert request for 'C=IN, ST=TELG, L=HYDERABAD, O=Acme Systems, OU=CORPHQ, CN=RDBCA' </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 16[IKE] received cert request for 'C=IN, O=strongSwan, CN=strongSwan CA' </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 16[IKE] reinitiating already active tasks </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 16[IKE] ISAKMP_VENDOR task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 16[IKE] ISAKMP_CERT_PRE task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 16[IKE] MAIN_MODE task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 16[IKE] sending cert request for "C=IN, ST=TELG, L=HYDERABAD, O=Acme Systems, OU=CORPHQ, CN=RDBCA" </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 16[IKE] authentication of 'C=IN, ST=MAH, L=MUMBAI, O=Acme Systems, OU=acmenet, CN=<a href="http://vpnsrvgw1.acmenet.com">vpnsrvgw1.acmenet.com</a>' (myself) successful </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 16[IKE] sending end entity cert "C=IN, ST=MAH, L=MUMBAI, O=Acme Systems, OU=acmenet, CN=<a href="http://vpnsrvgw1.acmenet.com">vpnsrvgw1.acmenet.com</a>" </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 16[ENC] generating ID_PROT request 0 [ ID CERT SIG CERTREQ N(INITIAL_CONTACT) ] </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 16[NET] sending packet: from 1.1.1.11[500] to 2.2.2.51[500] (1596 bytes) </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[NET] received packet: from 2.2.2.51[500] to 1.1.1.11[500] (1452 bytes) </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[ENC] parsed ID_PROT response 0 [ ID CERT SIG ] </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[IKE] received end entity cert "C=CN, ST=BJG, L=PKG, O=Acme Systems, OU=BJGRND, CN=<a href="http://vpnsrvgw2.acmenet.com">vpnsrvgw2.acmenet.com</a>" </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[CFG] using certificate "C=CN, ST=BJG, L=PKG, O=Acme Systems, OU=BJGRND, CN=<a href="http://vpnsrvgw2.acmenet.com">vpnsrvgw2.acmenet.com</a>" </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[CFG] certificate "C=CN, ST=BJG, L=PKG, O=Acme Systems, OU=BJGRND, CN=<a href="http://vpnsrvgw2.acmenet.com">vpnsrvgw2.acmenet.com</a>" key: 2048 bit RSA </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[CFG] using trusted ca certificate "C=IN, ST=TELG, L=HYDERABAD, O=Acme Systems, OU=CORPHQ, CN=RDBCA" </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[CFG] checking certificate status of "C=CN, ST=BJG, L=PKG, O=Acme Systems, OU=BJGRND, CN=<a href="http://vpnsrvgw2.acmenet.com">vpnsrvgw2.acmenet.com</a>" </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[CFG] ocsp check skipped, no ocsp found </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[CFG] certificate status is not available </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[CFG] certificate "C=IN, ST=TELG, L=HYDERABAD, O=Acme Systems, OU=CORPHQ, CN=RDBCA" key: 2048 bit RSA </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[CFG] reached self-signed root ca with a path length of 0 </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[IKE] authentication of 'C=CN, ST=BJG, L=PKG, O=Acme Systems, OU=BJGRND, CN=<a href="http://vpnsrvgw2.acmenet.com">vpnsrvgw2.acmenet.com</a>' with RSA_EMSA_PKCS1_NULL successful </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[IKE] IKE_SA s2s_topeergw1[2] established between 1.1.1.11[C=IN, ST=MAH, L=MUMBAI, O=Acme Systems, OU=acmenet, CN=<a href="http://vpnsrvgw1.acmenet.com">vpnsrvgw1.acmenet.com</a>]...2.2.2.51[C=CN, ST=BJG, L=PKG, O=Acme Systems, OU=BJGRND, CN=<a href="http://vpnsrvgw2.acmenet.com">vpnsrvgw2.acmenet.com</a>] </div><div>Sep 24 10:40:33 leftgwdut charon:<info> Last message '05[IKE] IKE_SA s2s_t' repeated 1 times, supressed by syslog-ng on leftgwdut </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[IKE] IKE_SA s2s_topeergw1[2] state change: CONNECTING => ESTABLISHED </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[IKE] scheduling reauthentication in 28553s </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[IKE] maximum IKE_SA lifetime 28733s </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[IKE] activating new tasks </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[IKE] activating QUICK_MODE task </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[CFG] configured proposals: ESP:AES_CBC_128/HMAC_SHA1_96/MODP_1536/NO_EXT_SEQ </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[KNL] got SPI c2f8e22f </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[CFG] configured proposals: ESP:AES_CBC_128/HMAC_SHA1_96/MODP_1536/NO_EXT_SEQ </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[CFG] proposing traffic selectors for us: </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[CFG] <a href="http://192.168.1.0/24">192.168.1.0/24</a> </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[CFG] proposing traffic selectors for other: </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[CFG] <a href="http://192.168.33.0/24">192.168.33.0/24</a> </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[ENC] generating QUICK_MODE request 2957591986 [ HASH SA No KE ID ID ] </div><div>Sep 24 10:40:33 leftgwdut charon:<info> 05[NET] sending packet: from 1.1.1.11[500] to 2.2.2.51[500] (380 bytes) </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[NET] received packet: from 2.2.2.51[500] to 1.1.1.11[500] (380 bytes) </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[ENC] parsed QUICK_MODE response 2957591986 [ HASH SA No KE ID ID ] </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[CFG] selecting proposal: </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[CFG] proposal matches </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[CFG] received proposals: ESP:AES_CBC_128/HMAC_SHA1_96/MODP_1536/NO_EXT_SEQ </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[CFG] configured proposals: ESP:AES_CBC_128/HMAC_SHA1_96/MODP_1536/NO_EXT_SEQ </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[CFG] selected proposal: ESP:AES_CBC_128/HMAC_SHA1_96/MODP_1536/NO_EXT_SEQ </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[CFG] selecting traffic selectors for other: </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[CFG] config: <a href="http://192.168.33.0/24">192.168.33.0/24</a>, received: <a href="http://192.168.33.0/24">192.168.33.0/24</a> => match: <a href="http://192.168.33.0/24">192.168.33.0/24</a> </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[CHD] using AES_CBC for encryption </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[CHD] using HMAC_SHA1_96 for integrity </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[CHD] adding inbound ESP SA </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[CHD] SPI 0xc2f8e22f, src 2.2.2.51 dst 1.1.1.11 </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] adding SAD entry with SPI c2f8e22f and reqid {1} </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] using encryption algorithm AES_CBC with key size 128 </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] using integrity algorithm HMAC_SHA1_96 with key size 160 </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] using replay window of 32 packets </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[CHD] adding outbound ESP SA </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[CHD] SPI 0xc7dea690, src 1.1.1.11 dst 2.2.2.51 </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] adding SAD entry with SPI c7dea690 and reqid {1} </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] using encryption algorithm AES_CBC with key size 128 </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] using integrity algorithm HMAC_SHA1_96 with key size 160 </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] using replay window of 0 packets </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] policy <a href="http://192.168.1.0/24">192.168.1.0/24</a> === <a href="http://192.168.33.0/24">192.168.33.0/24</a> out already exists, increasing refcount </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] not updating policy <a href="http://192.168.1.0/24">192.168.1.0/24</a> === <a href="http://192.168.33.0/24">192.168.33.0/24</a> out [priority 287712,refcount 2] </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] policy <a href="http://192.168.33.0/24">192.168.33.0/24</a> === <a href="http://192.168.1.0/24">192.168.1.0/24</a> in already exists, increasing refcount </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] not updating policy <a href="http://192.168.33.0/24">192.168.33.0/24</a> === <a href="http://192.168.1.0/24">192.168.1.0/24</a> in [priority 287712,refcount 2] </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] policy <a href="http://192.168.33.0/24">192.168.33.0/24</a> === <a href="http://192.168.1.0/24">192.168.1.0/24</a> fwd already exists, increasing refcount </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] not updating policy <a href="http://192.168.33.0/24">192.168.33.0/24</a> === <a href="http://192.168.1.0/24">192.168.1.0/24</a> fwd [priority 287712,refcount 2] </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] policy <a href="http://192.168.1.0/24">192.168.1.0/24</a> === <a href="http://192.168.33.0/24">192.168.33.0/24</a> out already exists, increasing refcount </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] updating policy <a href="http://192.168.1.0/24">192.168.1.0/24</a> === <a href="http://192.168.33.0/24">192.168.33.0/24</a> out [priority 187712, refcount 3] </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] getting a local address in traffic selector <a href="http://192.168.1.0/24">192.168.1.0/24</a> </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] using host 192.168.1.1 </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] getting iface name for index 10 </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] using 1.1.1.1 as nexthop and eth0 as dev to reach <a href="http://2.2.2.51/32">2.2.2.51/32</a> </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] policy <a href="http://192.168.33.0/24">192.168.33.0/24</a> === <a href="http://192.168.1.0/24">192.168.1.0/24</a> in already exists, increasing refcount </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] updating policy <a href="http://192.168.33.0/24">192.168.33.0/24</a> === <a href="http://192.168.1.0/24">192.168.1.0/24</a> in [priority 187712, refcount 3] </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] policy <a href="http://192.168.33.0/24">192.168.33.0/24</a> === <a href="http://192.168.1.0/24">192.168.1.0/24</a> fwd already exists, increasing refcount </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[KNL] updating policy <a href="http://192.168.33.0/24">192.168.33.0/24</a> === <a href="http://192.168.1.0/24">192.168.1.0/24</a> fwd [priority 187712, refcount 3] </div><div>Sep 24 10:40:34 leftgwdut charon:<info> 06[IKE] CHILD_SA s2s_topeergw1-1{2} established with SPIs c2f8e22f_i c7dea690_o and TS <a href="http://192.168.1.0/24">192.168.1.0/24</a> === <a href="http://192.168.33.0/24">192.168.33.0/24</a> </div><div>Sep 24 10:40:34 leftgwdut charon:<info> Last message '06[IKE] CHILD_SA s2s' repeated 1 times, supressed by syslog-ng on leftgwdut </div><div>Sep 24 10:40:34 leftgwdut dnsmasq:<info> exiting on receipt of SIGTERM </div><div>Sep 24 10:40:35 leftgwdut dnsmasq:<info> started, version 2.72 cachesize 150 </div><div>Sep 24 10:40:35 leftgwdut dnsmasq:<info> compile time options: IPv6 GNU-getopt no-DBus no-i18n no-IDN DHCP DHCPv6 no-Lua TFTP no-conntrack ipset auth no-DNSSEC loop-detect </div><div>Sep 24 10:40:35 leftgwdut dnsmasq-dhcp:<info> DHCP, IP range 192.168.1.100 -- 192.168.1.149, lease time 1d </div><div>Sep 24 10:40:35 leftgwdut dnsmasq:<info> using nameserver 192.168.33.68#53 for domain <a href="http://tester.net">tester.net</a> </div><div>Sep 24 10:40:35 leftgwdut dnsmasq:<info> using nameserver 192.168.33.25#53 for domain <a href="http://tester.net">tester.net</a> </div><div><br></div><div>#######################################</div><div><br></div><div><br></div><div><br></div><div>As a Responder:</div><div>================</div><div><br></div><div><br></div><div>root@leftgwgwdut:/etc# </div><div>root@leftgwgwdut:/etc# </div><div>root@leftgwgwdut:/etc# root@leftgwgwdut:/etc# ipsec restartroot@leftgwgwdut:/etc# vi ipsec.conf root@leftgwgwdut:/etc# tail -f /var/log/messages</div><div>Sep 24 10:39:15 leftgwgwdut charon:<info> 09[KNL] installing route: <a href="http://192.168.33.0/24">192.168.33.0/24</a> via 1.1.1.1 src 192.168.1.1 dev eth0 </div><div>Sep 24 10:39:15 leftgwgwdut charon:<info> 09[KNL] getting iface index for eth0 </div><div>Sep 24 10:39:15 leftgwgwdut charon:<info> 09[KNL] adding policy <a href="http://192.168.33.0/24">192.168.33.0/24</a> === <a href="http://192.168.1.0/24">192.168.1.0/24</a> in [priority 287712, refcount 1] </div><div>Sep 24 10:39:15 leftgwgwdut charon:<info> 09[KNL] adding policy <a href="http://192.168.33.0/24">192.168.33.0/24</a> === <a href="http://192.168.1.0/24">192.168.1.0/24</a> fwd [priority 287712, refcount 1] </div><div>Sep 24 10:39:15 leftgwgwdut PnP:<info> [11640]: AGENT INFO Client work request: </div><div>Sep 24 10:39:15 leftgwgwdut PnP:<info> [11640]: AGENT INFO <?xml version="1.0" encoding="UTF-8"?><pnp xmlns="urn:acme:pnp" version="1.0" udi="PID:leftgw-K9,VID:V01,SN:DNI2106A050"><info xmlns="urn:acme:pnp:work-info" correlator="Acme-PnP-1.0-1-3f162a41-15ef-44d5-b0c3-78bd5d0e739f-1"><deviceId><authRequired>false</authRequired><udi>PID:leftgw-K9,VID:V01,SN:DNI2106A050</udi><hostname>None</hostname></deviceId></info></pnp> </div><div>Sep 24 10:39:15 leftgwgwdut PnP:<info> [11640]: AGENT INFO address_type is ipv4 </div><div>Sep 24 10:39:15 leftgwgwdut PnP:<info> [11640]: AGENT INFO PNP requests with url: <a href="http://127.0.0.1:80/pnp/WORK-REQUEST">http://127.0.0.1:80/pnp/WORK-REQUEST</a> </div><div>Sep 24 10:39:15 leftgwgwdut PnP:<error> [11640]: AGENT ERROR HTTP Error 403: Forbidden </div><div>Sep 24 10:39:16 leftgwgwdut lldpd:<info> lldp_send: LLDP packet sent on LAN interface eth2 , Ports = 0xf </div><div>Sep 24 10:39:28 leftgwgwdut ripd:<debug> update timer fire! </div><div>Sep 24 10:39:30 leftgwgwdut PnP:<error> [11640]: AGENT ERROR Exception in trying send_work_request(): HTTP Error 403: Forbidden </div><div>Sep 24 10:39:30 leftgwgwdut PnP:<error> [11640]: AGENT ERROR <class 'urllib2.HTTPError'> </div><div>Sep 24 10:39:33 leftgwgwdut PnP:<info> [11640]: AGENT INFO Client work request: </div><div>Sep 24 10:39:33 leftgwgwdut PnP:<info> [11640]: AGENT INFO <?xml version="1.0" encoding="UTF-8"?><pnp xmlns="urn:acme:pnp" version="1.0" udi="PID:leftgw-K9,VID:V01,SN:DNI2106A050"><info xmlns="urn:acme:pnp:work-info" correlator="Acme-PnP-1.0-1-3f162a41-15ef-44d5-b0c3-78bd5d0e739f-1"><deviceId><authRequired>false</authRequired><udi>PID:leftgw-K9,VID:V01,SN:DNI2106A050</udi><hostname>None</hostname></deviceId></info></pnp> </div><div>Sep 24 10:39:33 leftgwgwdut PnP:<info> [11640]: AGENT INFO address_type is ipv4 </div><div>Sep 24 10:39:33 leftgwgwdut PnP:<info> [11640]: AGENT INFO PNP requests with url: <a href="http://127.0.0.1:80/pnp/WORK-REQUEST">http://127.0.0.1:80/pnp/WORK-REQUEST</a> </div><div>Sep 24 10:39:33 leftgwgwdut PnP:<error> [11640]: AGENT ERROR HTTP Error 403: Forbidden </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[NET] received packet: from 2.2.2.51[500] to 1.1.1.11[500] (176 bytes) </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[ENC] parsed ID_PROT request 0 [ SA V V V V V ] </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[CFG] looking for an ike config for 1.1.1.11...2.2.2.51 </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[CFG] candidate: 1.1.1.11...2.2.2.51, prio 3100 </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[CFG] found matching ike config: 1.1.1.11...2.2.2.51 with prio 3100 </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[IKE] received XAuth vendor ID </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[IKE] received DPD vendor ID </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[IKE] received Acme Unity vendor ID </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[IKE] received NAT-T (RFC 3947) vendor ID </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[IKE] 2.2.2.51 is initiating a Main Mode IKE_SA </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> Last message '12[IKE] 2.2.2.51 is ' repeated 1 times, supressed by syslog-ng on leftgwgwdut </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[IKE] IKE_SA (unnamed)[1] state change: CREATED => CONNECTING </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[CFG] selecting proposal: </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[CFG] proposal matches </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[CFG] received proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536 </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[CFG] configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536 </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536 </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[IKE] sending XAuth vendor ID </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[IKE] sending DPD vendor ID </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[IKE] sending Acme Unity vendor ID </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[IKE] sending NAT-T (RFC 3947) vendor ID </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[ENC] generating ID_PROT response 0 [ SA V V V V ] </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 12[NET] sending packet: from 1.1.1.11[500] to 2.2.2.51[500] (156 bytes) </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[NET] received packet: from 2.2.2.51[500] to 1.1.1.11[500] (308 bytes) </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ] </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=TR, L=Gebze - Kocaeli, O=T??rkiye Bilimsel ve Teknolojik Ara??t??rma Kurumu - T??B??TAK, OU=Ulusal Elektronik ve Kriptoloji Ara??t??rma Enstit??s?? - UEKAE, OU=Kamu Sertifikasyon Merkezi, CN=T??B??TAK UEKAE K??k Sertifika Hizmet Sa??lay??c??s?? - S??r??m 3" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Global Root CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "CN=T??RKTRUST Elektronik Sertifika Hizmet Sa??lay??c??s??, C=TR, L=Ankara, O=T??RKTRUST Bilgi ??leti??im ve Bili??im G??venli??i Hizmetleri A.??. (c) Aral??k 2007" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "CN=T??RKTRUST Elektronik Sertifika Hizmet Sa??lay??c??s??, C=TR, L=Ankara, O=T??RKTRUST Bilgi ??leti??im ve Bili??im G??venli??i Hizmetleri A.??. (c) Kas??m 2005" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "CN=T??RKTRUST Elektronik Sertifika Hizmet Sa??lay??c??s??, C=TR, L=ANKARA, O=(c) 2005 T??RKTRUST Bilgi ??leti??im ve Bili??im G??venli??i Hizmetleri A.??." </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA I" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Class 3 CA, CN=TC TrustCenter Class 3 CA II" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Class 2 CA, CN=TC TrustCenter Class 2 CA II" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root EV CA 2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root CA 2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root CA 1" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=CH, O=SwissSign AG, CN=SwissSign Silver CA - G2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=CH, O=SwissSign AG, CN=SwissSign Platinum CA - G2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=CH, O=SwissSign AG, CN=SwissSign Gold CA - G2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=IL, O=StartCom Ltd., CN=StartCom Certification Authority G2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> Last message '13[IKE] sending cert' repeated 1 times, supressed by syslog-ng on leftgwgwdut </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Services Root Certificate Authority - G2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA - G3" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA - G2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden EV Root CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=FI, O=Sonera, CN=Sonera Class2 CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=FI, O=Sonera, CN=Sonera Class1 CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=JP, O=SECOM Trust Systems CO.,LTD., OU=Security Communication RootCA2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=JP, O=SECOM Trust Systems CO.,LTD., OU=Security Communication EV RootCA1" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=SecureTrust Corporation, CN=Secure Global CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=SecureTrust Corporation, CN=SecureTrust CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=JP, O=Japan Certification Services, Inc., CN=SecureSign RootCA11" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=DE, O=Deutscher Sparkassen Verlag GmbH, OU=S-TRUST Certification Services, CN=S-TRUST Universal Root CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=DE, ST=Baden-Wuerttemberg (BW), L=Stuttgart, O=Deutscher Sparkassen Verlag GmbH, CN=S-TRUST Authentication and Encryption Root CA 2005:PN" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "CN=SG TRUST SERVICES RACINE, OU=0002 43525289500022, O=SG TRUST SERVICES, C=FR" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "O=RSA Security Inc, OU=RSA Security 2048 V3" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3 G3" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 G3" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 1 G3" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "E=<a href="mailto:contacto@procert.net.ve">contacto@procert.net.ve</a>, L=Chacao, ST=Miranda, OU=Proveedor de Certificados PROCERT, O=Sistema Nacional de Certificacion Electronica, C=VE, CN=PSCProcert" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=CH, O=WISeKey, OU=Copyright (c) 2005, OU=OISTE Foundation Endorsed, CN=OISTE WISeKey Global Root GA CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado, E=<a href="mailto:info@netlock.hu">info@netlock.hu</a>" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=HU, ST=Hungary, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Kozjegyzoi (Class A) Tanusitvanykiado" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Expressz (Class C) Tanusitvanykiado" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Uzleti (Class B) Tanusitvanykiado" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=HU, L=Budapest, O=NetLock Kft., OU=Tan??s??tv??nykiad??k (Certification Services), CN=NetLock Arany (Class Gold) F??tan??s??tv??ny" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=HU, L=Budapest, O=Microsec Ltd., CN=Microsec e-Szigno Root CA 2009, E=<a href="mailto:info@e-szigno.hu">info@e-szigno.hu</a>" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=HU, L=Budapest, O=Microsec Ltd., OU=e-Szigno CA, CN=Microsec e-Szigno Root CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "E=<a href="mailto:pki@sk.ee">pki@sk.ee</a>, C=EE, O=AS Sertifitseerimiskeskus, CN=Juur-SK" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=ES, O=IZENPE S.A., CN=Izenpe.com" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=IdenTrust, CN=IdenTrust Public Sector Root CA 1" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=FR, ST=France, L=Paris, O=PM/SGDN, OU=DCSSI, CN=IGC/A, E=<a href="mailto:igca@sgdn.pm.gouv.fr">igca@sgdn.pm.gouv.fr</a>" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=HK, O=Hongkong Post, CN=Hongkong Post Root CA 1" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=GR, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions RootCA 2011" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=EU, L=Madrid (see current address at <a href="http://www.camerfirma.com/address">www.camerfirma.com/address</a>), SN=A82743287, O=AC Camerfirma S.A., CN=Global Chambersign Root - 2008" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Universal CA 2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Universal CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Global CA 2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Global CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=Equifax Secure Inc., CN=Equifax Secure eBusiness CA-1" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=Equifax Secure Inc., CN=Equifax Secure Global eBusiness CA-1" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=Equifax, OU=Equifax Secure Certificate Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=Entrust, Inc., OU=See <a href="http://www.entrust.net/legal-terms">www.entrust.net/legal-terms</a>, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=Entrust, Inc., OU=<a href="http://www.entrust.net/CPS">www.entrust.net/CPS</a> is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "O=Entrust.net, OU=<a href="http://www.entrust.net/CPS_2048">www.entrust.net/CPS_2048</a> incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=TR, L=Ankara, O=E-Tu??ra EBG Bili??im Teknolojileri ve Hizmetleri A.??., OU=E-Tugra Sertifikasyon Merkezi, CN=E-Tugra Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=EE, O=AS Sertifitseerimiskeskus, CN=EE Certification Centre Root CA, E=<a href="mailto:pki@sk.ee">pki@sk.ee</a>" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=ES, O=Agencia Catalana de Certificacio (NIF Q-0801176-I), OU=Serveis Publics de Certificacio, OU=Vegeu <a href="https://www.catcert.net/verarrel">https://www.catcert.net/verarrel</a> (c)03, OU=Jerarquia Entitats de Certificacio Catalanes, CN=EC-ACC" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "CN=EBG Elektronik Sertifika Hizmet Sa??lay??c??s??, O=EBG Bili??im Teknolojileri ve Hizmetleri A.??., C=TR" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=Digital Signature Trust Co., OU=DSTCA E2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=Digital Signature Trust Co., OU=DSTCA E1" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=<a href="http://www.digicert.com">www.digicert.com</a>, CN=DigiCert Trusted Root G4" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=<a href="http://www.digicert.com">www.digicert.com</a>, CN=DigiCert High Assurance EV Root CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=<a href="http://www.digicert.com">www.digicert.com</a>, CN=DigiCert Global Root G2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=<a href="http://www.digicert.com">www.digicert.com</a>, CN=DigiCert Global Root CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=<a href="http://www.digicert.com">www.digicert.com</a>, CN=DigiCert Assured ID Root G2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=<a href="http://www.digicert.com">www.digicert.com</a>, CN=DigiCert Assured ID Root CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=DE, O=Deutsche Telekom AG, OU=T-TeleSec Trust Center, CN=Deutsche Telekom Root CA 2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 EV 2009" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "O=Digital Signature Trust Co., CN=DST Root CA X3" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=Digital Signature Trust, OU=DST ACES, CN=DST ACES CA X6" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "O=Cybertrust, Inc, CN=Cybertrust Global Root" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Trusted Certificate Services" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Secure Certificate Services" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "CN=ComSign Secured CA, O=ComSign, C=IL" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "CN=ComSign CA, O=ComSign, C=IL" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=CN, O=China Internet Network Information Center, CN=China Internet Network Information Center EV Certificates Root" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=EU, L=Madrid (see current address at <a href="http://www.camerfirma.com/address">www.camerfirma.com/address</a>), SN=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=PL, O=Unizeto Sp. z o.o., CN=Certum CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=FR, O=Certplus, CN=Class 2 Primary CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=FR, O=Certinomis, OU=0002 433998903, CN=Certinomis - Autorit?? Racine" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=FR, O=Dhimyotis, CN=Certigna" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=EU, O=AC Camerfirma SA CIF A82743287, OU=<a href="http://www.chambersign.org">http://www.chambersign.org</a>, CN=Global Chambersign Root" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=EU, O=AC Camerfirma SA CIF A82743287, OU=<a href="http://www.chambersign.org">http://www.chambersign.org</a>, CN=Chambers of Commerce Root" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=CN, O=CNNIC, CN=CNNIC ROOT" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=CN, O=China Financial Certification Authority, CN=CFCA EV ROOT" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R2" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R1" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=NO, O=Buypass AS-983163327, CN=Buypass Class 3 Root CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=NO, O=Buypass AS-983163327, CN=Buypass Class 3 CA 1" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=NO, O=Buypass AS-983163327, CN=Buypass Class 2 Root CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=NO, O=Buypass AS-983163327, CN=Buypass Class 2 CA 1" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=ES, CN=Autoridad de Certificacion Firmaprofesional CIF A62634068" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "CN=Atos TrustedRoot 2011, O=Atos, C=DE" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=JP, O=Japanese Government, OU=ApplicationCA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=AffirmTrust, CN=AffirmTrust Premium" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=AffirmTrust, CN=AffirmTrust Networking" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=AffirmTrust, CN=AffirmTrust Commercial" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Qualified CA Root" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Public CA Root" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=IT, L=Milan, O=Actalis S.p.A./03358520967, CN=Actalis Authentication Root CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=AT, O=A-Trust Ges. f. Sicherheitssysteme im elektr. Datenverkehr GmbH, OU=A-Trust-nQual-03, CN=A-Trust-nQual-03" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=CO, O=Sociedad Cameral de Certificaci??n Digital - Certic??mara S.A., CN=AC Ra??z Certic??mara S.A." </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "CN=ACEDICOM Root, OU=PKI, O=EDICOM, C=ES" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "CN=ACCVRAIZ1, OU=PKIACCV, O=ACCV, C=ES" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2008 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA - G3" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, ST=Indiana, L=Indianapolis, O=Software in the Public Interest, OU=hostmaster, CN=Certificate Authority, E=<a href="mailto:hostmaster@spi-inc.org">hostmaster@spi-inc.org</a>" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=RO, O=certSIGN, OU=certSIGN ROOT CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=CN, O=WoSign CA Limited, CN=Certification Authority of WoSign" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=Wells Fargo WellsSecure, OU=Wells Fargo Bank NA, CN=WellsSecure Public Root Certificate Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=TW, O=Chunghwa Telecom Co., Ltd., OU=ePKI Root Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=<a href="http://www.usertrust.com">http://www.usertrust.com</a>, CN=UTN - DATACorp SGC" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, OU=<a href="http://www.xrampsecurity.com">www.xrampsecurity.com</a>, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=GB, O=Trustis Limited, OU=Trustis FPS Root CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=TW, O=Government Root Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=CN, O=WoSign CA Limited, CN=CA ???????????????" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "O=TeliaSonera, CN=TeliaSonera Root CA v1" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=<a href="http://www.usertrust.com">http://www.usertrust.com</a>, CN=UTN-USERFirst-Client Authentication and Email" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 3" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=<a href="http://www.usertrust.com">http://www.usertrust.com</a>, CN=UTN-USERFirst-Hardware" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=CN, ST=PKGN, L=BJGN, O=ACME-SYSTEMS, OU=CORPHQ, CN=leftgwDUTCA1" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=US, O=VISA, OU=Visa International Service Association, CN=Visa eCommerce Root" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=IN, ST=TELG, L=HYDERABAD, O=Acme Systems, OU=CORPHQ, CN=RDBCA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[IKE] sending cert request for "C=IN, O=strongSwan, CN=strongSwan CA" </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[ENC] generating ID_PROT response 0 [ KE No CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CERTREQ CER </div><div>Sep 24 10:39:34 leftgwgwdut charon:<info> 13[NET] sending packet: from 1.1.1.11[500] to 2.2.2.51[500] (18931 bytes) </div><div>Sep 24 10:39:38 leftgwgwdut charon:<info> 15[NET] received packet: from 2.2.2.51[500] to 1.1.1.11[500] (308 bytes) </div><div>Sep 24 10:39:38 leftgwgwdut charon:<info> 15[IKE] received retransmit of request with ID 0, retransmitting response </div><div>Sep 24 10:39:38 leftgwgwdut charon:<info> 15[NET] sending packet: from 1.1.1.11[500] to 2.2.2.51[500] (18931 bytes) </div><div>Sep 24 10:39:44 leftgwgwdut lldpd:<info> lldp_decode: LLDP packet received on LAN port [99] on interface eth2 </div><div>Sep 24 10:39:45 leftgwgwdut charon:<info> 16[NET] received packet: from 2.2.2.51[500] to 1.1.1.11[500] (308 bytes) </div><div>Sep 24 10:39:45 leftgwgwdut charon:<info> 16[IKE] received retransmit of request with ID 0, retransmitting response </div><div>Sep 24 10:39:45 leftgwgwdut charon:<info> 16[NET] sending packet: from 1.1.1.11[500] to 2.2.2.51[500] (18931 bytes) </div><div>Sep 24 10:39:46 leftgwgwdut lldpd:<info> lldp_send: LLDP packet sent on LAN interface eth2 , Ports = 0xf </div><div>Sep 24 10:39:49 leftgwgwdut PnP:<error> [11640]: AGENT ERROR Exception in trying send_work_request(): HTTP Error 403: Forbidden </div><div>Sep 24 10:39:49 leftgwgwdut PnP:<error> [11640]: AGENT ERROR <class 'urllib2.HTTPError'> </div><div>Sep 24 10:39:53 leftgwgwdut PnP:<info> [11640]: AGENT INFO Client work request: </div><div>Sep 24 10:39:53 leftgwgwdut PnP:<info> [11640]: AGENT INFO <?xml version="1.0" encoding="UTF-8"?><pnp xmlns="urn:acme:pnp" version="1.0" udi="PID:leftgw-K9,VID:V01,SN:DNI2106A050"><info xmlns="urn:acme:pnp:work-info" correlator="Acme-PnP-1.0-1-3f162a41-15ef-44d5-b0c3-78bd5d0e739f-1"><deviceId><authRequired>false</authRequired><udi>PID:leftgw-K9,VID:V01,SN:DNI2106A050</udi><hostname>None</hostname></deviceId></info></pnp> </div><div>Sep 24 10:39:53 leftgwgwdut PnP:<info> [11640]: AGENT INFO address_type is ipv4 </div><div>Sep 24 10:39:53 leftgwgwdut PnP:<info> [11640]: AGENT INFO PNP requests with url: <a href="http://127.0.0.1:80/pnp/WORK-REQUEST">http://127.0.0.1:80/pnp/WORK-REQUEST</a> </div><div>Sep 24 10:39:53 leftgwgwdut PnP:<error> [11640]: AGENT ERROR HTTP Error 403: Forbidden </div><div>Sep 24 10:39:53 leftgwgwdut ripd:<debug> update timer fire! </div><div>Sep 24 10:39:58 leftgwgwdut charon:<info> 06[NET] received packet: from 2.2.2.51[500] to 1.1.1.11[500] (308 bytes) </div><div>Sep 24 10:39:58 leftgwgwdut charon:<info> 06[IKE] received retransmit of request with ID 0, retransmitting response </div><div>Sep 24 10:39:58 leftgwgwdut charon:<info> 06[NET] sending packet: from 1.1.1.11[500] to 2.2.2.51[500] (18931 bytes) </div><div>Sep 24 10:40:00 leftgwgwdut crond:<info> USER root pid 8317 cmd /usr/bin/cron.d/command/every_5minutes </div><div>Sep 24 10:40:00 leftgwgwdut crond:<info> USER root pid 8318 cmd /usr/bin/cron.d/command/every_10minutes </div><div>Sep 24 10:40:04 leftgwgwdut charon:<info> 07[JOB] deleting half open IKE_SA after timeout </div><div>Sep 24 10:40:04 leftgwgwdut charon:<info> 07[IKE] IKE_SA (unnamed)[1] state change: CONNECTING => DESTROYING </div><div><br></div><div>-------------------------------------------------------------------------</div></div><div><br></div><div>hope the above info helps</div><div><br></div><div>thanks & regards</div><div>Rajiv</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div> </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Sep 22, 2017 at 12:36 PM, Tobias Brunner <span dir="ltr"><<a href="mailto:tobias@strongswan.org" target="_blank">tobias@strongswan.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Rajiv,<br>
<br>
> I have used the <rightca="ca-dn"> option in a IKEv1 gateway to gateway<br>
> tunnel on GW1 running strongswan 5.5.1.<br>
<br>
Please look for the log message "CA certificate ... not found,<br>
discarding CA constraint" when the config is loaded.<br>
<br>
Regards,<br>
Tobias<br>
</blockquote></div><br></div>