<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">Any kind souls out there in this?</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Mar 31, 2019 at 3:32 PM MOSES KARIUKI <<a href="mailto:kariukims@gmail.com">kariukims@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">Dear Team,<br></div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">I have not yet succeeded in establishing a connection to the remote Fortigate client. The remote client has internal IPs in the range </div><div class="gmail_default" style="font-family:tahoma,sans-serif">I have the following configuration :</div><div class="gmail_default"><div class="gmail_default" style="font-family:tahoma,sans-serif"><b><i>sudo route -n</i></b></div><div class="gmail_default" style="font-family:tahoma,sans-serif">Kernel IP routing table</div><div class="gmail_default" style="font-family:tahoma,sans-serif">Destination Gateway Genmask Flags Metric Ref Use Iface</div><div class="gmail_default" style="font-family:tahoma,sans-serif">0.0.0.0 10.138.0.1 0.0.0.0 UG 100 0 0 ens4</div><div class="gmail_default" style="font-family:tahoma,sans-serif">10.138.0.1 0.0.0.0 255.255.255.255 UH 100 0 0 ens4</div><div style="font-family:tahoma,sans-serif"><br></div><div style="font-family:tahoma,sans-serif"><i>I have these rules :</i></div><div><div><font face="tahoma, sans-serif">*nat</font></div><div><font face="tahoma, sans-serif">-A POSTROUTING -s <a href="http://10.10.10.0/24" target="_blank">10.10.10.0/24</a> -o ens4 -m policy --pol ipsec --dir out -j ACCEPT</font></div><div><font face="tahoma, sans-serif">-A POSTROUTING -s <a href="http://10.10.10.0/24" target="_blank">10.10.10.0/24</a> -o ens4 -j MASQUERADE</font></div><div><font face="tahoma, sans-serif">COMMIT</font></div><div><font face="tahoma, sans-serif"><br></font></div><div><font face="tahoma, sans-serif">*mangle</font></div><div><font face="tahoma, sans-serif">-A FORWARD --match policy --pol ipsec --dir in -s <a href="http://10.10.10.0/24" target="_blank">10.10.10.0/24</a> -o ens4 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360</font></div><div><font face="tahoma, sans-serif">COMMIT</font></div><div><font face="tahoma, sans-serif"><br></font></div><div><font face="tahoma, sans-serif">-A ufw-before-forward --match policy --pol ipsec --dir in --proto esp -s <a href="http://10.10.10.0/24" target="_blank">10.10.10.0/24</a> -j ACCEPT</font></div><div><font face="tahoma, sans-serif">-A ufw-before-forward --match policy --pol ipsec --dir out --proto esp -d <a href="http://10.10.10.0/24" target="_blank">10.10.10.0/24</a> -j ACCEPT</font></div></div><div><font face="tahoma, sans-serif"><br></font></div><div><font face="tahoma, sans-serif"><b><i>This is my Strongswan configuration :</i></b></font></div><div><font face="tahoma, sans-serif"><div>config setup</div><div> charondebug="ike 1, knl 1, cfg 2"</div><div> uniqueids=yes</div><div><br></div><div>conn televida</div><div> auto=route</div><div> compress=no</div><div> type=tunnel</div><div> reauth=no</div><div> mobike=no</div><div> keyexchange=ikev2</div><div> fragmentation=yes</div><div> forceencaps=yes</div><div> dpdaction=clear</div><div> dpddelay=300s</div><div> rekey=no</div><div> rightfirewall=yes</div><div> leftfirewall=yes</div><div> left=%any</div><div> leftid=35.185.2**.** </div><div> leftcert=server-cert.pem</div><div> leftsendcert=never</div><div> <b> leftsubnet=<a href="http://10.138.0.0/20,0.0.0.0/0" target="_blank">10.138.0.0/20,0.0.0.0/0</a></b></div><div> right=200.1*.1*3.* </div><div> rightid=%any</div><div> rightauth=psk</div><div><b> rightsourceip=<a href="http://10.10.10.0/24" target="_blank">10.10.10.0/24</a></b></div><div> #rightsourceip=</div><div> rightdns=8.8.8.8,8.8.4.4</div><div> rightsendcert=never</div><div> ike=aes256-sha256-ecp521</div><div> esp=aes256-sha256-ecp521</div><div><br></div><div>This is the error that I am getting :</div><div><div><b><i>sudo ipsec up televida</i></b></div><div>initiating IKE_SA televida[1] to 200.1*.1*3.*</div><div>generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]</div><div>sending packet: from 10.138.0.4[500] to 200.1*.1*3.*[500] (1006 bytes)</div><div>received packet: from 200.1*.1*3.*[500] to 10.138.0.4[500] (292 bytes)</div><div>parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</div><div>local host is behind NAT, sending keep alives</div><div>authentication of '35.185.2**.**' (myself) with RSA signature successful</div><div>establishing CHILD_SA televida{2}</div><div>generating IKE_AUTH request 1 [ IDi AUTH SA TSi TSr N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]</div><div>sending packet: from 10.138.0.4[4500] to 200.1*.1*3.*[4500] (816 bytes)</div><div>retransmit 1 of request with message ID 1</div><div>sending packet: from 10.138.0.4[4500] to 200.1*.1*3.*[4500] (816 bytes)</div><div>retransmit 2 of request with message ID 1</div><div>sending packet: from 10.138.0.4[4500] to 200.1*.1*3.*[4500] (816 bytes)</div><div>retransmit 3 of request with message ID 1</div><div>sending packet: from 10.138.0.4[4500] to 200.1*.1*3.*[4500] (816 bytes)</div><div>sending keep alive to 200.1*.1*3.*[4500]</div><div>retransmit 4 of request with message ID 1</div><div>sending packet: from 10.138.0.4[4500] to 200.1*.1*3.*[4500] (816 bytes)</div><div>sending keep alive to 200.1*.1*3.*[4500]</div><div>sending keep alive to 200.1*.1*3.*[4500]</div><div>retransmit 5 of request with message ID 1</div><div>sending packet: from 10.138.0.4[4500] to 200.1*.1*3.*[4500] (816 bytes)</div><div>sending keep alive to 200.1*.1*3.*[4500]</div><div>sending keep alive to 200.1*.1*3.*[4500]</div><div>sending keep alive to 200.1*.1*3.*[4500]</div><div>giving up after 5 retransmits</div><div>peer not responding, trying again (2/3)</div><div>initiating IKE_SA televida[1] to 200.1*.1*3.*</div><div>establishing connection 'televida' failed</div></div><div><br></div><div>My biggest question is :</div><div>Do the two private Subnets need to be under the same Subnet Mask?</div><div>My private IP is <b>10.138.0.4</b>. He tells me that <a href="http://10.28.2.8/32" target="_blank">10.28.2.8/32</a> is his private.</div><div>Please advise. I have re-installed again and again with no success.</div><div><br></div><div>Regards,</div><div>Moses Kariuki</div></font></div><div><font face="tahoma, sans-serif"><br></font></div></div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div></div></div></div></div></div></div>
</blockquote></div>