<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi John,</p>
<p>try use "keyid:CORS89" in both configuration and secrets instead
of shortcuts.<br>
</p>
<div class="moz-cite-prefix">On 08.12.2020 16:09, John Serink wrote:<br>
</div>
<blockquote type="cite"
cite="mid:bbaa45b819f1e98131d248434af28f6af63a1b74.camel@trimble.com">
<pre class="moz-quote-pre" wrap="">Hello:
Cisco debug is showing me this:
Dec 8 13:57:16.184: IKEv2:(SESSION ID = 93872,SA ID = 40):Stopping timer to wait for auth
message
Dec 8 13:57:16.184: IKEv2:(SESSION ID = 93872,SA ID = 40):Checking NAT discovery
Dec 8 13:57:16.184: IKEv2:(SESSION ID = 93872,SA ID = 40):NAT OUTSIDE found
Dec 8 13:57:16.184: IKEv2:(SESSION ID = 93872,SA ID = 40):NAT detected float to init port
48448, resp port 4500
Dec 8 13:57:16.184: IKEv2:(SESSION ID = 93872,SA ID = 40):Searching policy based on peer's
identity 'CORS89' of type 'FQDN'
Dec 8 13:57:16.185: IKEv2-ERROR:(SESSION ID = 93872,SA ID = 40):% key not found.
Dec 8 13:57:16.186: IKEv2-ERROR:(SESSION ID = 93872,SA ID = 40):: Failed to locate an item in
the database
Dec 8 13:57:16.186: IKEv2:(SESSION ID = 93872,SA ID = 40):Verification of peer's
authentication data FAILED
It identified my strongswan client CORS89 but it thinks its an FQDN rather than and ID.
In the ipsec.conf for leftid I used '@CORS89' and in the ipsec.secrets I also used @CORS89 so
why would the Cisco think its a FQDN rather than just a key-id?
Cheers,
John
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Volodymyr Litovka
"Vision without Execution is Hallucination." -- Thomas Edison</pre>
</body>
</html>