<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"></div><div dir="ltr">Moses,</div><div dir="ltr"><br></div><div dir="ltr">While I cannot speak to your specific issue here, you should likely look into using PowerShell to modify the Windows VPN parameters to use more robust encryption, as it provides many more options:</div><div dir="ltr"><br></div><div dir="ltr"><a href="https://docs.microsoft.com/en-us/powershell/module/vpnclient/set-vpnconnectionipsecconfiguration?view=win10-ps">https://docs.microsoft.com/en-us/powershell/module/vpnclient/set-vpnconnectionipsecconfiguration?view=win10-ps</a></div><div dir="ltr"><br></div><div dir="ltr">Tom</div><div dir="ltr"><br>On Feb 18, 2019, at 6:43 PM, MOSES KARIUKI <<a href="mailto:kariukims@gmail.com">kariukims@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">Dear Team,</div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">I have been having long days trying to configure Strongswan on Ubuntu 18.04. I am not able to connect to the VPN from Windows 10 client, after following the instructions on this link : </div><div class="gmail_default"><font face="tahoma, sans-serif"><a href="https://www.digitalocean.com/community/tutorials/how-to-set-up-an-ikev2-vpn-server-with-strongswan-on-ubuntu-18-04-2">https://www.digitalocean.com/community/tutorials/how-to-set-up-an-ikev2-vpn-server-with-strongswan-on-ubuntu-18-04-2</a></font><br></div><div class="gmail_default"><font face="tahoma, sans-serif">and setting up windows for modp_2048 following these instructions here :</font></div><div class="gmail_default"><font face="tahoma, sans-serif"><a href="https://wiki.strongswan.org/projects/strongswan/wiki/WindowsClients#AES-256-CBC-and-MODP2048">https://wiki.strongswan.org/projects/strongswan/wiki/WindowsClients#AES-256-CBC-and-MODP2048</a><br></font></div><div class="gmail_default"><br></div><div class="gmail_default">See below my settings</div><div class="gmail_default"><br></div><div class="gmail_default"><div class="gmail_default"><b><i><font face="arial black, sans-serif">ipsec statusall</font></i></b></div><div class="gmail_default"><font face="tahoma, sans-serif">Status of IKE charon daemon (strongSwan 5.6.2, Linux 4.15.0-45-generic, x86_64):</font></div><div class="gmail_default"><font face="tahoma, sans-serif"> uptime: 45 minutes, since Feb 19 01:27:59 2019</font></div><div class="gmail_default"><font face="tahoma, sans-serif"> malloc: sbrk 2568192, mmap 0, used 664784, free 1903408</font></div><div class="gmail_default"><font face="tahoma, sans-serif"> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0</font></div><div class="gmail_default"><font face="tahoma, sans-serif"> loaded plugins: charon aesni aes rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic counters</font></div><div class="gmail_default"><font face="tahoma, sans-serif">Virtual IP pools (size/online/offline):</font></div><div class="gmail_default"><font face="tahoma, sans-serif"> <a href="http://10.10.10.0/24">10.10.10.0/24</a>: 254/0/0</font></div><div class="gmail_default"><font face="tahoma, sans-serif">Listening IP addresses:</font></div><div class="gmail_default"><font face="tahoma, sans-serif"> 102.1*9.2**.***</font></div><div class="gmail_default"><font face="tahoma, sans-serif">Connections:</font></div><div class="gmail_default"><font face="tahoma, sans-serif"> ikev2-vpn: %any...%any IKEv2, dpddelay=300s</font></div><div class="gmail_default"><font face="tahoma, sans-serif"> ikev2-vpn: local: [102.1*9.2**.***] uses public key authentication</font></div><div class="gmail_default"><font face="tahoma, sans-serif"> ikev2-vpn: cert: "CN=102.1*9.2**.***"</font></div><div class="gmail_default"><font face="tahoma, sans-serif"> ikev2-vpn: remote: uses EAP_MSCHAPV2 authentication with EAP identity '%any'</font></div><div class="gmail_default"><font face="tahoma, sans-serif"> ikev2-vpn: child: <a href="http://0.0.0.0/0">0.0.0.0/0</a> === dynamic TUNNEL, dpdaction=clear</font></div><div class="gmail_default"><font face="tahoma, sans-serif">Security Associations (0 up, 0 connecting):</font></div><div class="gmail_default"><font face="tahoma, sans-serif"> none</font></div><div class="gmail_default"><font face="tahoma, sans-serif"><br></font></div><div class="gmail_default"><div class="gmail_default"><b><i><font face="arial black, sans-serif">vi /etc/ipsec.conf</font></i></b></div><div class="gmail_default" style="font-family:tahoma,sans-serif">config setup</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> charondebug="ike 1, knl 1, cfg 2"</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> uniqueids=no</div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">conn ikev2-vpn</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> auto=add</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> compress=no</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> type=tunnel</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> keyexchange=ikev2</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> fragmentation=yes</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> forceencaps=yes</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> dpdaction=clear</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> dpddelay=300s</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> rekey=no</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> left=%any</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> leftid=102.1*9.2**.***</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> leftcert=server-cert.pem</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> leftsendcert=always</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> leftsubnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a></div><div class="gmail_default" style="font-family:tahoma,sans-serif"> right=%any</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> rightid=%any</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> rightauth=eap-mschapv2</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> rightsourceip=<a href="http://10.10.10.0/24">10.10.10.0/24</a></div><div class="gmail_default" style="font-family:tahoma,sans-serif"> rightdns=8.8.8.8,8.8.4.4</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> rightsendcert=never</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> eap_identity=%identity</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> ike=aes256-sha1-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024,aes256-sha256-modp2048,aes128-sha256-modp2048,aes256-sha1-modp2048,aes128-sha1-modp2048</div><div class="gmail_default" style="font-family:tahoma,sans-serif"> esp=aes256-sha256,aes256-sha1,3des-sha1,aes256-sha256-modp2048,aes128-sha256-modp2048,aes256-sha1-modp2048,aes128-sha1-modp2048</div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">Below is the log :</div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif"><div class="gmail_default"><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[NET] received packet: from 154.77.***.**[500] to 102.1*9.2**.***[500] (632 bytes)</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(FRAG_SUP) N(NATD_S_IP) N(NATD_D_IP) V V V V ]</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 11[CFG] configured proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048,</div><div class="gmail_default">....</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 11[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 11[IKE] remote host is behind NAT</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 11[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(MULT_AUTH) ]</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 11[NET] sending packet: from 102.1*9.2**.***[500] to 154.77.***.**[500] (448 bytes)</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[NET] received packet: from 154.77.***.**[4500] to 102.1*9.2**.***[4500] (580 bytes)</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[ENC] parsed IKE_AUTH request 1 [ EF(1/3) ]</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[ENC] received fragment #1 of 3, waiting for complete IKE message</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[NET] received packet: from 154.77.***.**[4500] to 102.1*9.2**.***[4500] (532 bytes)</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[ENC] parsed IKE_AUTH request 1 [ EF(3/3) ]</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[ENC] received fragment #3 of 3, waiting for complete IKE message</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[CFG] looking for an ike config for 102.1*9.2**.***...154.77.***.**</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[NET] received packet: from 154.77.***.**[4500] to 102.1*9.2**.***[4500] (580 bytes)</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[ENC] parsed IKE_AUTH request 1 [ EF(2/3) ]</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[ENC] received fragment #2 of 3, reassembling fragmented IKE message</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[ENC] parsed IKE_AUTH request 1 [ IDi CERTREQ N(MOBIKE_SUP) CPRQ(ADDR DNS NBNS SRV ADDR6 DNS6 SRV6) SA TSi TSr ]</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[IKE] received 53 cert requests for an unknown ca</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[CFG] looking for peer configs matching 102.1*9.2**.***[%any]...154.77.***.**[192.168.43.156]</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[CFG] candidate "ikev2-vpn", match: 1/1/28 (me/other/ike)</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[CFG] selected peer config 'ikev2-vpn'</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[IKE] EAP-Identity request configured, but not supported</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[IKE] initiating EAP_MSCHAPV2 method (id 0x81)</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[IKE] peer supports MOBIKE</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[IKE] authentication of '102.1*9.2**.***' (myself) with RSA signature successful</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[IKE] sending end entity cert "CN=102.1*9.2**.***"</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/MSCHAPV2 ]</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[ENC] splitting IKE message with length of 1936 bytes into 2 fragments</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[ENC] generating IKE_AUTH response 1 [ EF(1/2) ]</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[ENC] generating IKE_AUTH response 1 [ EF(2/2) ]</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[NET] sending packet: from 102.1*9.2**.***[4500] to 154.77.***.**[4500] (1236 bytes)</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 12[NET] sending packet: from 102.1*9.2**.***[4500] to 154.77.***.**[4500] (772 bytes)</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 15[JOB] deleting half open IKE_SA with 154.77.***.** after timeout</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 06[CFG] proposing traffic selectors for us:</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 06[CFG] <a href="http://0.0.0.0/0">0.0.0.0/0</a></div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 06[CFG] proposing traffic selectors for other:</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 06[CFG] dynamic</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 05[CFG] proposing traffic selectors for us:</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 05[CFG] <a href="http://0.0.0.0/0">0.0.0.0/0</a></div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 05[CFG] proposing traffic selectors for other:</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 05[CFG] dynamic</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 07[NET] received packet: from 154.77.***.**[500] to 102.1*9.2**.***[500] (632 bytes)</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 07[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(FRAG_SUP) N(NATD_S_IP) N(NATD_D_IP) V V V V ]</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 07[CFG] looking for an ike config for 102.1*9.2**.***...154.77.***.**</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 07[CFG] candidate: %any...%any, prio 28</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 07[CFG] found matching ike config: %any...%any with prio 28</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 07[IKE] received MS NT5 ISAKMPOAKLEY v9 vendor ID</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 07[IKE] received MS-Negotiation Discovery Capable vendor ID</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[CFG] candidate: %any...%any, prio 28</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 07[IKE] received Vid-Initial-Contact vendor ID</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 07[ENC] received unknown vendor ID: 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:02</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 07[IKE] 154.77.***.** is initiating an IKE_SA</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 ipsec[1011]: 07[CFG] selecting proposal:</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[CFG] found matching ike config: %any...%any with prio 28</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[IKE] received MS NT5 ISAKMPOAKLEY v9 vendor ID</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[IKE] received MS-Negotiation Discovery Capable vendor ID</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[IKE] received Vid-Initial-Contact vendor ID</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[ENC] received unknown vendor ID: 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:02</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[IKE] 154.77.***.** is initiating an IKE_SA</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[CFG] selecting proposal:</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[CFG] selecting proposal:</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[CFG] proposal matches</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[CFG] received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_2048</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[CFG] configured proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/</div><div class="gmail_default"><span style="white-space:pre"> </span>HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048</div><div class="gmail_default"><span style="white-space:pre"> </span>Feb 19 02:10:00 VM-e2b7 charon: 07[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[IKE] remote host is behind NAT</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(MULT_AUTH) ]</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 07[NET] sending packet: from 102.1*9.2**.***[500] to 154.77.***.**[500] (448 bytes)</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 09[NET] received packet: from 154.77.***.**[4500] to 102.1*9.2**.***[4500] (580 bytes)</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 09[ENC] parsed IKE_AUTH request 1 [ EF(1/3) ]</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 09[ENC] received fragment #1 of 3, waiting for complete IKE message</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 10[NET] received packet: from 154.77.***.**[4500] to 102.1*9.2**.***[4500] (580 bytes)</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 10[ENC] parsed IKE_AUTH request 1 [ EF(2/3) ]</div><div class="gmail_default">Feb 19 02:10:00 VM-e2b7 charon: 10[ENC] received fragment #2 of 3, waiting for complete IKE message</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[NET] received packet: from 154.77.***.**[4500] to 102.1*9.2**.***[4500] (532 bytes)</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[ENC] parsed IKE_AUTH request 1 [ EF(3/3) ]</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[ENC] received fragment #3 of 3, reassembling fragmented IKE message</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[ENC] parsed IKE_AUTH request 1 [ IDi CERTREQ N(MOBIKE_SUP) CPRQ(ADDR DNS NBNS SRV ADDR6 DNS6 SRV6) SA TSi TSr ]</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[IKE] received 53 cert requests for an unknown ca</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[CFG] looking for peer configs matching 102.1*9.2**.***[%any]...154.77.***.**[192.168.43.156]</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[CFG] candidate "ikev2-vpn", match: 1/1/28 (me/other/ike)</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[CFG] selected peer config 'ikev2-vpn'</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[IKE] EAP-Identity request configured, but not supported</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[IKE] initiating EAP_MSCHAPV2 method (id 0x64)</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[IKE] peer supports MOBIKE</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[IKE] authentication of '102.1*9.2**.***' (myself) with RSA signature successful</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[IKE] sending end entity cert "CN=102.1*9.2**.***"</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 07[CFG] received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_2048</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/MSCHAPV2 ]</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 07[CFG] configured proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024...</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 07[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 07[IKE] remote host is behind NAT</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 07[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(MULT_AUTH) ]</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 07[NET] sending packet: from 102.1*9.2**.***[500] to 154.77.***.**[500] (448 bytes)</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 09[NET] received packet: from 154.77.***.**[4500] to 102.1*9.2**.***[4500] (580 bytes)</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 09[ENC] parsed IKE_AUTH request 1 [ EF(1/3) ]</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 09[ENC] received fragment #1 of 3, waiting for complete IKE message</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 10[NET] received packet: from 154.77.***.**[4500] to 102.1*9.2**.***[4500] (580 bytes)</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 10[ENC] parsed IKE_AUTH request 1 [ EF(2/3) ]</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 10[ENC] received fragment #2 of 3, waiting for complete IKE message</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[ENC] splitting IKE message with length of 1936 bytes into 2 fragments</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[NET] received packet: from 154.77.***.**[4500] to 102.1*9.2**.***[4500] (532 bytes)</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[ENC] parsed IKE_AUTH request 1 [ EF(3/3) ]</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[ENC] received fragment #3 of 3, reassembling fragmented IKE message</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[ENC] parsed IKE_AUTH request 1 [ IDi CERTREQ N(MOBIKE_SUP) CPRQ(ADDR DNS NBNS SRV ADDR6 DNS6 SRV6) SA TSi TSr ]</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[IKE] received 53 cert requests for an unknown ca</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[CFG] looking for peer configs matching 102.1*9.2**.***[%any]...154.77.***.**[192.168.43.156]</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[CFG] candidate "ikev2-vpn", match: 1/1/28 (me/other/ike)</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[CFG] selected peer config 'ikev2-vpn'</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[IKE] EAP-Identity request configured, but not supported</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[IKE] initiating EAP_MSCHAPV2 method (id 0x64)</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[IKE] peer supports MOBIKE</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[IKE] authentication of '102.1*9.2**.***' (myself) with RSA signature successful</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[IKE] sending end entity cert "CN=102.1*9.2**.***"</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/MSCHAPV2 ]</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 ipsec[1011]: 11[ENC] splitting IKE message with length of 1936 bytes into 2 fragments</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[ENC] generating IKE_AUTH response 1 [ EF(1/2) ]</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[ENC] generating IKE_AUTH response 1 [ EF(2/2) ]</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[NET] sending packet: from 102.1*9.2**.***[4500] to 154.77.***.**[4500] (1236 bytes)</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 charon: 11[NET] sending packet: from 102.1*9.2**.***[4500] to 154.77.***.**[4500] (772 bytes)</div><div class="gmail_default">Feb 19 02:10:01 VM-e2b7 kernel: [ 2543.189073] [UFW BLOCK] IN=ens3 OUT= MAC=06:97:9c:00:00:8f:00:1d:b5:c0:a7:c0:08:00 SRC=154.77.***.** DST=102.1*9.2**.*** LEN=52 TOS=0x10 PREC=0x20 TTL=116 ID=27223 DF PROTO=TCP SPT=54229 DPT=443 WINDOW=17520 RES=0x00 SYN URGP=0</div><div class="gmail_default">Feb 19 02:10:30 VM-e2b7 charon: 14[JOB] deleting half open IKE_SA with 154.77.***.** after timeout</div><div class="gmail_default">Feb 19 02:13:28 VM-e2b7 charon: 13[CFG] proposing traffic selectors for us:</div><div class="gmail_default">Feb 19 02:13:28 VM-e2b7 charon: 13[CFG] <a href="http://0.0.0.0/0">0.0.0.0/0</a></div><div class="gmail_default">Feb 19 02:13:28 VM-e2b7 charon: 13[CFG] proposing traffic selectors for other:</div><div class="gmail_default">Feb 19 02:13:28 VM-e2b7 charon: 13[CFG] dynamic</div></div></div><div style="font-family:tahoma,sans-serif"><br></div><div style="font-family:tahoma,sans-serif">Please assist with this. I am almost there. </div><div style="font-family:tahoma,sans-serif"><br></div><div style="font-family:tahoma,sans-serif">Thanks in advance.</div><div style="font-family:tahoma,sans-serif"><br></div><div style="font-family:tahoma,sans-serif">regards,</div><div style="font-family:tahoma,sans-serif">Moses K</div></div></div></div></div></div></div></div></div></div>
</div></blockquote></body></html>