<div dir="ltr">I tried to use EAP with username/password in windows as you said, then I got almost the same log:<div><div>Nov 8 18:42:29 13[NET] <8> received packet: from 183.131.17.162[370] to 47.90.13.129[500] (880 bytes)</div><div>Nov 8 18:42:29 13[ENC] <8> parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) V V V V ]</div><div>Nov 8 18:42:29 13[IKE] <8> received MS NT5 ISAKMPOAKLEY v9 vendor ID</div><div>Nov 8 18:42:29 13[IKE] <8> received MS-Negotiation Discovery Capable vendor ID</div><div>Nov 8 18:42:29 13[IKE] <8> received Vid-Initial-Contact vendor ID</div><div>Nov 8 18:42:29 13[ENC] <8> received unknown vendor ID: 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:02</div><div>Nov 8 18:42:29 13[IKE] <8> 183.131.17.162 is initiating an IKE_SA</div><div>Nov 8 18:42:29 13[IKE] <8> remote host is behind NAT</div><div>Nov 8 18:42:29 13[ENC] <8> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]</div><div>Nov 8 18:42:29 13[NET] <8> sending packet: from 47.90.13.129[500] to 183.131.17.162[370] (312 bytes)</div><div>Nov 8 18:42:30 12[NET] <8> received packet: from 183.131.17.162[370] to 47.90.13.129[500] (880 bytes)</div><div>Nov 8 18:42:30 12[ENC] <8> parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) V V V V ]</div><div>Nov 8 18:42:30 12[IKE] <8> received retransmit of request with ID 0, retransmitting response</div><div>Nov 8 18:42:30 12[NET] <8> sending packet: from 47.90.13.129[500] to 183.131.17.162[370] (312 bytes)</div><div>Nov 8 18:42:31 09[NET] <8> received packet: from 183.131.17.162[370] to 47.90.13.129[500] (880 bytes)</div><div>Nov 8 18:42:31 09[ENC] <8> parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) V V V V ]</div><div>Nov 8 18:42:31 09[IKE] <8> received retransmit of request with ID 0, retransmitting response</div><div>Nov 8 18:42:31 09[NET] <8> sending packet: from 47.90.13.129[500] to 183.131.17.162[370] (312 bytes)</div><div><br></div><div>And I also tried using my iphone to connect to my vpn through with username/password in IPsec, then I got this log</div><div><div>Nov 8 19:14:40 05[NET] <38> received packet: from 112.64.189.137[25840] to 47.90.13.129[500] (848 bytes)</div><div>Nov 8 19:14:40 05[ENC] <38> parsed ID_PROT request 0 [ SA V V V V V V V V V V V V V V ]</div><div>Nov 8 19:14:40 05[IKE] <38> received NAT-T (RFC 3947) vendor ID</div><div>Nov 8 19:14:40 05[IKE] <38> received draft-ietf-ipsec-nat-t-ike vendor ID</div><div>Nov 8 19:14:40 05[IKE] <38> received draft-ietf-ipsec-nat-t-ike-08 vendor ID</div><div>Nov 8 19:14:40 05[IKE] <38> received draft-ietf-ipsec-nat-t-ike-07 vendor ID</div><div>Nov 8 19:14:40 05[IKE] <38> received draft-ietf-ipsec-nat-t-ike-06 vendor ID</div><div>Nov 8 19:14:40 05[IKE] <38> received draft-ietf-ipsec-nat-t-ike-05 vendor ID</div><div>Nov 8 19:14:40 05[IKE] <38> received draft-ietf-ipsec-nat-t-ike-04 vendor ID</div><div>Nov 8 19:14:40 05[IKE] <38> received draft-ietf-ipsec-nat-t-ike-03 vendor ID</div><div>Nov 8 19:14:40 05[IKE] <38> received draft-ietf-ipsec-nat-t-ike-02 vendor ID</div><div>Nov 8 19:14:40 05[IKE] <38> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID</div><div>Nov 8 19:14:40 05[IKE] <38> received XAuth vendor ID</div><div>Nov 8 19:14:40 05[IKE] <38> received Cisco Unity vendor ID</div><div>Nov 8 19:14:40 05[IKE] <38> received FRAGMENTATION vendor ID</div><div>Nov 8 19:14:40 05[IKE] <38> received DPD vendor ID</div><div>Nov 8 19:14:40 05[IKE] <38> 112.64.189.137 is initiating a Main Mode IKE_SA</div><div>Nov 8 19:14:40 05[ENC] <38> generating ID_PROT response 0 [ SA V V V V ]</div><div>Nov 8 19:14:40 05[NET] <38> sending packet: from 47.90.13.129[500] to 112.64.189.137[25840] (160 bytes)</div><div>Nov 8 19:14:43 06[NET] <38> received packet: from 112.64.189.137[25840] to 47.90.13.129[500] (848 bytes)</div><div>Nov 8 19:14:43 06[IKE] <38> received retransmit of request with ID 0, retransmitting response</div><div>Nov 8 19:14:43 06[NET] <38> sending packet: from 47.90.13.129[500] to 112.64.189.137[25840] (160 bytes)</div><div>Nov 8 19:14:47 12[NET] <38> received packet: from 112.64.189.137[25840] to 47.90.13.129[500] (848 bytes)</div><div>Nov 8 19:14:47 12[IKE] <38> received retransmit of request with ID 0, retransmitting response</div><div>Nov 8 19:14:47 12[NET] <38> sending packet: from 47.90.13.129[500] to 112.64.189.137[25840] (160 bytes)</div></div><div><br></div><div>At last I still do not know where the problem is. ：(</div><div><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2017-11-07 21:37 GMT+08:00 Tobias Brunner <span dir="ltr"><<a href="mailto:tobias@strongswan.org" target="_blank">tobias@strongswan.org</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Joshua,<br>
<span class=""><br>
> I got some problems about the configuration of strongswan, no matter<br>
> how I configured the IKEv2 connection just couldn't establish.<br>
<br>
</span>This doesn't look like a configuration issue but a network problem. The<br>
client does not seem to receive the IKE_SA_INIT response sent by the<br>
server (at least initially) and, therefore, retransmits the request a<br>
couple of times. It seems to stop after two retransmits so it might<br>
have received the response eventually. But since the server doesn't<br>
receive an IKE_AUTH request it could mean that there is an IP<br>
fragmentation issue (also check for errors on the client). If the<br>
IKE_AUTH request gets too big (e.g. because of lots of certificate<br>
requests or a large client certificate) it gets fragmented into multiple<br>
IP packets and if some firewall/router between client and server drops<br>
such fragments the server won't receive the full message.<br>
As this seems to be a Windows client you might not have a lot of options<br>
as Windows doesn't support IKEv2 fragmentation. If you use certificate<br>
authentication for the client you could try to switch to EAP with<br>
username/password (but it's possible that the server's IKE_AUTH response<br>
will get fragmented too). Also see [1].<br>
<br>
Regards,<br>
Tobias<br>
<br>
[1] <a href="https://wiki.strongswan.org/issues/965#note-1" rel="noreferrer" target="_blank">https://wiki.strongswan.org/<wbr>issues/965#note-1</a><br>
</blockquote></div><br></div>