<html dir="ltr"><head></head><body style="text-align:left; direction:ltr;" bgcolor="#303030" text="#eaeaea" link="#686868" vlink="#eaeaea"><div>Bumping this one last time before I give up and move on to something else ☺ Thanks for any insight.</div><div><br></div><div>James</div><div><br></div><div>On Sun, 2018-07-29 at 08:43 -0600, James Lay wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><pre>On Sun, 2018-07-29 at 08:00 -0600, James Lay wrote:</pre><pre><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"></blockquote></pre><pre>On Sun, 2018-07-29 at 07:53 -0600, James Lay wrote:</pre><pre><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"></blockquote></pre><pre>On Wed, 2018-07-25 at 18:33 -0600, James Lay wrote:</pre><pre><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"></blockquote></pre><pre>On Wed, 2018-07-25 at 06:53 -0600, James Lay wrote:</pre><pre><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"></blockquote></pre><pre>On 2018-07-24 06:51, Tobias Brunner wrote:Hi James,</pre><pre>So I moved to Strongswan 5.6.2 during a distribution upgrade.</pre><pre>What distribution? What was the previous version? Do you</pre><pre>still havethe same plugins installed and enabled?</pre><pre>My simplesetup no longer routes back to the client (I can see</pre><pre>the incoming pingson the server, but nothing goes back). I</pre><pre>establish a tunnel fine...mysetup looks like this:</pre><pre><br></pre><pre>external_IP_nic2 <-> 192.168.1.1_nic2 192.168.1.0/24 subnet</pre><pre>all I need is to have a connected device able to</pre><pre>access192.168.1.1...and it's only a single user.</pre><pre>Please read [1]. From the involved IPs I guess you used the</pre><pre>farp pluginbefore, so make sure you still have that installed</pre><pre>and loaded.</pre><pre>Regards,Tobias</pre><pre>[1]<a href="https://wiki.strongswan.org/projects/strongswan/wiki/Forward">https://wiki.strongswan.org/projects/strongswan/wiki/Forward</a></pre><pre>ingAndSplitTunneling</pre><pre>Thanks Tobias...I have access to the old server so I'll see</pre><pre>what's there...I don't recall installing any other plugins, but</pre><pre>we shall see. I'll report my findings soon..thanks again.</pre><pre>James</pre><pre></pre><pre><br></pre><pre>So now I'm super confused. I changed to the below:</pre><pre><br></pre><pre>conn rw </pre><pre>leftsubnet=192.168.1.0/24</pre><pre>leftcert=StrongSwanHostCert.pem</pre><pre>right=%any</pre><pre>rightsourceip=172.16.0.1</pre><pre>auto=add </pre><pre><br></pre><pre><br></pre><pre><br></pre><pre>and added the below top 2 postrouting nat rules:</pre><pre> pkts bytes target prot opt</pre><pre>in out source destination </pre><pre> 0 0 ACCEPT all </pre><pre>-- * * 0.0.0.0/0 0.0.0.0/0 poli</pre><pre>cy match dir out pol ipsec</pre><pre> 0 0 MASQUERADE all </pre><pre>-- * enp0s31f6 172.16.0.1 0.0.0.0/0 </pre><pre>24519 1646K MASQUERADE all </pre><pre>-- * ppp0 192.168.1.0/24 0.0.0.0/0 </pre><pre><br></pre><pre><br></pre><pre>However when I attempt to ping, I see the ping on the ppp0</pre><pre>interface, and the source isn't 172.16.0.1:</pre><pre>2018-07-25 18:26:37.085194521 8.0.0.1 → 192.168.1.1 ICMP 100</pre><pre>Echo (ping) request id=0x0004, seq=1/256, ttl=64</pre><pre><br></pre><pre><br></pre><pre>Not exactly sure where to go next. I did install the extra</pre><pre>plugins that include farp as well. Thank you.</pre><pre><br></pre><pre>James</pre><pre></pre><pre><br></pre><pre>Anything on this? in testing I made this change:</pre><pre><br></pre><pre>rightsourceip=10.10.10.0/24</pre><pre><br></pre><pre>Pinging from the client connected device gets me this:</pre><pre><br></pre><pre>1 2018-07-29 07:50:27.606525877 8.0.10.1 → 192.168.1.1 ICMP 100</pre><pre>Echo (ping) request id=0x000f, seq=1/256, ttl=64</pre><pre><br></pre><pre><br></pre><pre>Something seems very broken. Thank you.</pre><pre><br></pre><pre>James</pre><pre></pre><pre><br></pre><pre>And some startup and connect logs:</pre><pre><br></pre><pre>Jul 29 07:29:44 gateway charon: 00[DMN] Starting IKE charon daemon</pre><pre>(strongSwan 5.6.2, Linux 4.15.0-29-generic, x86_64)</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] PKCS11 module '<name>' lacks</pre><pre>library path</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] disabling load-tester plugin,</pre><pre>not configured</pre><pre>Jul 29 07:29:44 gateway charon: 00[LIB] plugin 'load-tester': failed</pre><pre>to load - load_tester_plugin_create returned NULL</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] dnscert plugin is disabled</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] ipseckey plugin is disabled</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] attr-sql plugin: database URI</pre><pre>not set</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] loading ca certificates from</pre><pre>'/etc/ipsec.d/cacerts'</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] loaded ca certificate</pre><pre>"C=CH, O=strongSwan, CN=strongSwan Root CA" from</pre><pre>'/etc/ipsec.d/cacerts/StrongSwanCACert.pem'</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] loading aa certificates from</pre><pre>'/etc/ipsec.d/aacerts'</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] loading ocsp signer</pre><pre>certificates from '/etc/ipsec.d/ocspcerts'</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] loading attribute</pre><pre>certificates from '/etc/ipsec.d/acerts'</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] loading crls from</pre><pre>'/etc/ipsec.d/crls'</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] loading secrets from</pre><pre>'/etc/ipsec.secrets'</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] loaded RSA private key from</pre><pre>'/etc/ipsec.d/private/StrongSwanHostKey.pem'</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] sql plugin: database URI not</pre><pre>set</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] opening triplet file</pre><pre>/etc/ipsec.d/triplets.dat failed: No such file or directory</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] eap-simaka-sql database URI</pre><pre>missing</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] loaded 0 RADIUS server</pre><pre>configurations</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] HA config misses local/remote</pre><pre>address</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] no threshold configured for</pre><pre>systime-fix, disabled</pre><pre>Jul 29 07:29:44 gateway charon: 00[CFG] coupling file path</pre><pre>unspecified</pre><pre>Jul 29 07:29:44 gateway charon: 00[LIB] loaded plugins: charon test-</pre><pre>vectors unbound ldap pkcs11 tpm aesni aes rc2 sha2 sha1 md4 md5 mgf1</pre><pre>rdrand random nonce x509 revocation constraints acert pubkey pkcs1</pre><pre>pkcs7 pkcs8 pkcs12 pgp dnskey sshkey dnscert ipseckey pem openssl</pre><pre>gcrypt af-alg fips-prf gmp curve25519 agent chapoly xcbc cmac hmac</pre><pre>ctr ccm gcm ntru bliss curl soup mysql sqlite attr kernel-netlink</pre><pre>resolve socket-default connmark farp stroke updown eap-identity eap-</pre><pre>sim eap-sim-pcsc eap-aka eap-aka-3gpp2 eap-simaka-pseudonym eap-</pre><pre>simaka-reauth eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius</pre><pre>eap-tls eap-ttls eap-peap eap-tnc xauth-generic xauth-eap xauth-pam</pre><pre>xauth-noauth tnc-tnccs tnccs-20 tnccs-11 tnccs-dynamic dhcp whitelist</pre><pre>lookip error-notify certexpire led radattr addrblock unity counters</pre><pre>Jul 29 07:29:44 gateway charon: 00[LIB] dropped capabilities, running</pre><pre>as uid 0, gid 0</pre><pre>Jul 29 07:29:44 gateway charon: 00[JOB] spawning 16 worker threads</pre><pre>Jul 29 07:29:44 gateway ipsec[12353]: charon (12392) started after</pre><pre>100 ms</pre><pre>Jul 29 07:29:44 gateway ipsec_starter[12353]: charon (12392) started</pre><pre>after 100 ms</pre><pre>Jul 29 07:29:44 gateway charon: 06[CFG] received stroke: add</pre><pre>connection 'rw'</pre><pre>Jul 29 07:29:44 gateway charon: 06[CFG] adding virtual IP address</pre><pre>pool 172.16.0.1</pre><pre>Jul 29 07:29:44 gateway charon: 06[CFG] loaded certificate "C=CH,</pre><pre>O=strongSwan, CN=ns1.domain" from 'StrongSwanHostCert.pem'</pre><pre>Jul 29 07:29:44 gateway charon: 06[CFG] id 'external_ip' not</pre><pre>confirmed by certificate, defaulting to 'C=CH, O=strongSwan,</pre><pre>CN=ns1.domain'</pre><pre>Jul 29 07:29:44 gateway charon: 06[CFG] added configuration 'rw'</pre><pre>Jul 29 07:30:13 gateway charon: 10[NET] received packet: from</pre><pre>x.x.15.77[7388] to external_ip[500] (716 bytes)</pre><pre>Jul 29 07:30:13 gateway charon: 10[ENC] parsed IKE_SA_INIT request 0</pre><pre>[ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG)</pre><pre>N(REDIR_SUP) ]</pre><pre>Jul 29 07:30:13 gateway charon: 10[IKE] x.x.15.77 is initiating an</pre><pre>IKE_SA</pre><pre>Jul 29 07:30:13 gateway charon: 10[IKE] x.x.15.77 is initiating an</pre><pre>IKE_SA</pre><pre>Jul 29 07:30:13 gateway charon: 10[IKE] remote host is behind NAT</pre><pre>Jul 29 07:30:13 gateway charon: 10[IKE] sending cert request for</pre><pre>"C=CH, O=strongSwan, CN=strongSwan Root CA"</pre><pre>Jul 29 07:30:13 gateway charon: 10[ENC] generating IKE_SA_INIT</pre><pre>response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP)</pre><pre>N(HASH_ALG) N(MULT_AUTH) ]</pre><pre>Jul 29 07:30:13 gateway charon: 10[NET] sending packet: from</pre><pre>external_ip[500] to x.x.15.77[7388] (297 bytes)</pre><pre>Jul 29 07:30:15 gateway charon: 11[NET] received packet: from</pre><pre>x.x.15.77[7380] to external_ip[4500] (1364 bytes)</pre><pre>Jul 29 07:30:15 gateway charon: 11[ENC] parsed IKE_AUTH request 1 [</pre><pre>EF(1/4) ]</pre><pre>Jul 29 07:30:15 gateway charon: 11[ENC] received fragment #1 of 4,</pre><pre>waiting for complete IKE message</pre><pre>Jul 29 07:30:15 gateway charon: 12[NET] received packet: from</pre><pre>x.x.15.77[7380] to external_ip[4500] (1364 bytes)</pre><pre>Jul 29 07:30:15 gateway charon: 12[ENC] parsed IKE_AUTH request 1 [</pre><pre>EF(2/4) ]</pre><pre>Jul 29 07:30:15 gateway charon: 12[ENC] received fragment #2 of 4,</pre><pre>waiting for complete IKE message</pre><pre>Jul 29 07:30:15 gateway charon: 13[NET] received packet: from</pre><pre>x.x.15.77[7380] to external_ip[4500] (1364 bytes)</pre><pre>Jul 29 07:30:15 gateway charon: 13[ENC] parsed IKE_AUTH request 1 [</pre><pre>EF(3/4) ]</pre><pre>Jul 29 07:30:15 gateway charon: 13[ENC] received fragment #3 of 4,</pre><pre>waiting for complete IKE message</pre><pre>Jul 29 07:30:15 gateway charon: 14[NET] received packet: from</pre><pre>x.x.15.77[7380] to external_ip[4500] (1156 bytes)</pre><pre>Jul 29 07:30:15 gateway charon: 14[ENC] parsed IKE_AUTH request 1 [</pre><pre>EF(4/4) ]</pre><pre></pre><pre><br></pre><pre>And startup and session logs from previous, working version:</pre><pre>Apr 18 04:23:33 gateway charon: 00[DMN] Starting IKE charon daemon</pre><pre>(strongSwan 5.1.2, Linux 4.4.0-119-generic, x86_64)Apr 18 04:23:34</pre><pre>gateway charon: 00[CFG] loading ca certificates from</pre><pre>'/etc/ipsec.d/cacerts'Apr 18 04:23:34 gateway charon: 00[CFG] loaded</pre><pre>ca certificate "C=CH, O=strongSwan, CN=strongSwan Root CA" from</pre><pre>'/etc/ipsec.d/cacerts/StrongSwanCACert.pem'Apr 18 04:23:34 gateway</pre><pre>charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'Apr</pre><pre>18 04:23:34 gateway charon: 00[CFG] loading ocsp signer certificates</pre><pre>from '/etc/ipsec.d/ocspcerts'Apr 18 04:23:34 gateway charon: 00[CFG]</pre><pre>loading attribute certificates from '/etc/ipsec.d/acerts'Apr 18</pre><pre>04:23:34 gateway charon: 00[CFG] loading crls from</pre><pre>'/etc/ipsec.d/crls'Apr 18 04:23:34 gateway charon: 00[CFG] loading</pre><pre>secrets from '/etc/ipsec.secrets'Apr 18 04:23:34 gateway charon:</pre><pre>00[CFG] loaded RSA private key from</pre><pre>'/etc/ipsec.d/private/StrongSwanHostKey.pem'Apr 18 04:23:34 gateway</pre><pre>charon: 00[LIB] loaded plugins: charon test-vectors aes rc2 sha1 sha2</pre><pre>md4 md5 random nonce x509 revocation constraints pkcs1 pkcs7 pkcs8</pre><pre>pkcs12 pem openssl xcbc cmac hmac ctr ccm gcm attr kernel-netlink</pre><pre>resolve socket-default stroke updown eap-identity addrblockApr 18</pre><pre>04:23:34 gateway charon: 00[LIB] unable to load 5 plugin features (5</pre><pre>due to unmet dependencies)Apr 18 04:23:34 gateway charon: 00[LIB]</pre><pre>dropped capabilities, running as uid 0, gid 0Apr 18 04:23:34 gateway</pre><pre>charon: 00[JOB] spawning 16 worker threadsApr 18 04:23:34 gateway</pre><pre>ipsec_starter[26813]: charon (26814) started after 180 msApr 18</pre><pre>04:23:34 gateway charon: 05[CFG] received stroke: add connection</pre><pre>'rw'Apr 18 04:23:34 gateway charon: 05[CFG] left nor right host is our</pre><pre>side, assuming left=localApr 18 04:23:34 gateway charon: 05[CFG] adding</pre><pre>virtual IP address pool 192.168.1.11Apr 18 04:23:34 gateway charon:</pre><pre>05[CFG] loaded certificate "C=CH, O=strongSwan, CN=ns1.domain" from</pre><pre>'StrongSwanHostCert.pem'Apr 18 04:23:34 gateway charon: 05[CFG] id</pre><pre>'%any' not confirmed by certificate, defaulting to 'C=CH, O=strongSwan,</pre><pre>CN=ns1.domain'Apr 18 04:23:34 gateway charon: 05[CFG] added</pre><pre>configuration 'rw'</pre><pre><br></pre><pre>Apr 22 12:22:52 gateway charon: 11[NET] received packet: from</pre><pre>x.x.9.223[8351] to external_ip[500] (704 bytes)Apr 22 12:22:52 gateway</pre><pre>charon: 11[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP)</pre><pre>N(NATD_D_IP) N((16430)) N((16431)) N(REDIR_SUP) ]Apr 22 12:22:52</pre><pre>gateway charon: 11[IKE] x.x.9.223 is initiating an IKE_SAApr 22</pre><pre>12:22:52 gateway charon: 11[IKE] x.x.9.223 is initiating an IKE_SAApr</pre><pre>22 12:22:52 gateway charon: 11[IKE] remote host is behind NATApr 22</pre><pre>12:22:52 gateway charon: 11[IKE] DH group ECP_256 inacceptable,</pre><pre>requesting MODP_2048Apr 22 12:22:52 gateway charon: 11[ENC] generating</pre><pre>IKE_SA_INIT response 0 [ N(INVAL_KE) ]Apr 22 12:22:52 gateway charon:</pre><pre>11[NET] sending packet: from external_ip[500] to x.x.9.223[8351] (38</pre><pre>bytes)Apr 22 12:22:52 gateway charon: 12[NET] received packet: from</pre><pre>x.x.9.223[8351] to external_ip[500] (896 bytes)Apr 22 12:22:52 gateway</pre><pre>charon: 12[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP)</pre><pre>N(NATD_D_IP) N((16430)) N((16431)) N(REDIR_SUP) ]Apr 22 12:22:52</pre><pre>gateway charon: 12[IKE] x.x.9.223 is initiating an IKE_SAApr 22</pre><pre>12:22:52 gateway charon: 12[IKE] x.x.9.223 is initiating an IKE_SAApr</pre><pre>22 12:22:52 gateway charon: 12[IKE] remote host is behind NATApr 22</pre><pre>12:22:52 gateway charon: 12[IKE] sending cert request for "C=CH,</pre><pre>O=strongSwan, CN=strongSwan Root CA"Apr 22 12:22:52 gateway charon:</pre><pre>12[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP)</pre><pre>N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]Apr 22 12:22:52 gateway charon:</pre><pre>12[NET] sending packet: from external_ip[500] to x.x.9.223[8351] (465</pre><pre>bytes)Apr 22 12:22:53 gateway charon: 14[NET] received packet: from</pre><pre>x.x.9.223[8331] to external_ip[4500] (5100 bytes)Apr 22 12:22:53</pre><pre>gateway charon: 14[ENC] parsed IKE_AUTH request 1 [ IDi CERT</pre><pre>N(INIT_CONTACT) CERTREQ AUTH CPRQ(ADDR ADDR6 DNS DNS6) N(ESP_TFC_PAD_N)</pre><pre>SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY)</pre><pre>N(MSG_ID_SYN_SUP) ]Apr 22 12:22:53 gateway charon: 14[IKE] received</pre><pre>cert request for "C=CH, O=strongSwan, CN=strongSwan Root CA"Apr 22</pre><pre>12:22:53 gateway charon: 14[IKE] received 156 cert requests for an</pre><pre>unknown caApr 22 12:22:53 gateway charon: 14[IKE] received end entity</pre><pre>cert "C=CH, O=strongSwan, CN=user@domain"Apr 22 12:22:53 gateway</pre><pre>charon: 14[CFG] looking for peer configs matching</pre><pre>external_ip[%any]...x.x.9.223[C=CH, O=strongSwan, CN=user@domain]Apr 22</pre><pre>12:22:53 gateway charon: 14[CFG] selected peer config 'rw'Apr 22</pre><pre>12:22:53 gateway charon: 14[CFG] using certificate "C=CH,</pre><pre>O=strongSwan, CN=user@domain"Apr 22 12:22:53 gateway charon:</pre><pre>14[CFG] using trusted ca certificate "C=CH, O=strongSwan,</pre><pre>CN=strongSwan Root CA"Apr 22 12:22:53 gateway charon: 14[CFG] checking</pre><pre>certificate status of "C=CH, O=strongSwan, CN=user@domain"Apr 22</pre><pre>12:22:53 gateway charon: 14[CFG] certificate status is not availableApr</pre><pre>22 12:22:53 gateway charon: 14[CFG] reached self-signed root ca with</pre><pre>a path length of 0Apr 22 12:22:53 gateway charon: 14[IKE]</pre><pre>authentication of 'C=CH, O=strongSwan, CN=user@domain' with RSA</pre><pre>signature successfulApr 22 12:22:53 gateway charon: 14[IKE] received</pre><pre>ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC paddingApr 22</pre><pre>12:22:53 gateway charon: 14[IKE] peer supports MOBIKEApr 22 12:22:53</pre><pre>gateway charon: 14[IKE] authentication of 'C=CH, O=strongSwan,</pre><pre>CN=ns1.domain' (myself) with RSA signature successfulApr 22 12:22:53</pre><pre>gateway charon: 14[IKE] IKE_SA rw[6] established between</pre><pre>external_ip[C=CH, O=strongSwan, CN=ns1.domain]...x.x.9.223[C=CH,</pre><pre>O=strongSwan, CN=user@domain]Apr 22 12:22:53 gateway charon: 14[IKE]</pre><pre>IKE_SA rw[6] established between external_ip[C=CH, O=strongSwan,</pre><pre>CN=ns1.domain]...x.x.9.223[C=CH, O=strongSwan, CN=user@domain]Apr 22</pre><pre>12:22:53 gateway charon: 14[IKE] scheduling reauthentication in</pre><pre>9726sApr 22 12:22:53 gateway charon: 14[IKE] maximum IKE_SA lifetime</pre><pre>10266sApr 22 12:22:53 gateway charon: 14[IKE] sending end entity cert</pre><pre>"C=CH, O=strongSwan, CN=ns1.domain"Apr 22 12:22:53 gateway charon:</pre><pre>14[IKE] peer requested virtual IP %anyApr 22 12:22:53 gateway charon:</pre><pre>14[CFG] reassigning offline lease to 'C=CH, O=strongSwan, CN=user@domai</pre><pre>n'Apr 22 12:22:53 gateway charon: 14[IKE] assigning virtual IP</pre><pre>192.168.1.11 to peer 'C=CH, O=strongSwan, CN=user@domain'Apr 22</pre><pre>12:22:53 gateway charon: 14[IKE] peer requested virtual IP %any6Apr 22</pre><pre>12:22:53 gateway charon: 14[IKE] no virtual IP found for %any6</pre><pre>requested by 'C=CH, O=strongSwan, CN=user@domain'Apr 22 12:22:53</pre><pre>gateway charon: 14[IKE] CHILD_SA rw{4} established with SPIs cab12a0f_i</pre><pre>17e464af_o and TS 192.168.1.0/24 === 192.168.1.11/32 Apr 22 12:22:53</pre><pre>gateway charon: 14[IKE] CHILD_SA rw{4} established with SPIs cab12a0f_i</pre><pre>17e464af_o and TS 192.168.1.0/24 === 192.168.1.11/32 Apr 22 12:22:53</pre><pre>gateway charon: 14[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH</pre><pre>CPRP(ADDR) SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) ]Apr 22</pre><pre>12:22:53 gateway charon: 14[NET] sending packet: from external_ip[4500]</pre><pre>to x.x.9.223[8331] (2204 bytes)Apr 22 12:22:53 gateway charon: 15[NET]</pre><pre>received packet: from x.x.9.223[8331] to external_ip[4500] (76</pre><pre>bytes)Apr 22 12:22:53 gateway charon: 15[ENC] parsed INFORMATIONAL</pre><pre>request 2 [ N(NO_ADD_ADDR) ]Apr 22 12:22:53 gateway charon: 15[ENC]</pre><pre>generating INFORMATIONAL response 2 [ ]Apr 22 12:22:53 gateway charon:</pre><pre>15[NET] sending packet: from external_ip[4500] to x.x.9.223[8331] (76</pre><pre>bytes)Apr 22 12:23:24 gateway charon: 06[NET] received packet: from</pre><pre>x.x.9.223[8331] to external_ip[4500] (76 bytes)Apr 22 12:23:24 gateway</pre><pre>charon: 06[ENC] parsed INFORMATIONAL request 3 [ D ]Apr 22 12:23:24</pre><pre>gateway charon: 06[IKE] received DELETE for IKE_SA rw[6]Apr 22 12:23:24</pre><pre>gateway charon: 06[IKE] deleting IKE_SA rw[6] between external_ip[C=CH,</pre><pre>O=strongSwan, CN=ns1.domain]...x.x.9.223[C=CH, O=strongSwan, CN=user@do</pre><pre>main]Apr 22 12:23:24 gateway charon: 06[IKE] deleting IKE_SA rw[6]</pre><pre>between external_ip[C=CH, O=strongSwan,</pre><pre>CN=ns1.domain]...x.x.9.223[C=CH, O=strongSwan, CN=user@domain]Apr 22</pre><pre>12:23:24 gateway charon: 06[IKE] IKE_SA deletedApr 22 12:23:24 gateway</pre><pre>charon: 06[IKE] IKE_SA deletedApr 22 12:23:24 gateway charon: 06[ENC]</pre><pre>generating INFORMATIONAL response 3 [ ]Apr 22 12:23:24 gateway charon:</pre><pre>06[NET] sending packet: from external_ip[4500] to x.x.9.223[8331] (76</pre><pre>bytes)Apr 22 12:23:24 gateway charon: 06[CFG] lease 192.168.1.11 by</pre><pre>'C=CH, O=strongSwan, CN=user@domain' went offline</pre></blockquote><div><br></div></body></html>