<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Michael Schwartzkopff wrote:<br>
</div>
<blockquote type="cite"
cite="mid:aee8a177-f902-afbb-0588-2a6c77531190@sys4.de">
<pre wrap="">On 28.06.21 15:34, David H Durgee wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Michael Schwartzkopff wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On 28.06.21 13:44, David H Durgee wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I added that package and got further this time:
</pre>
<blockquote type="cite">
<pre wrap="">(...)
Jun 28 07:33:58 Z560 charon-nm: 06[ENC] parsed IKE_AUTH response 5 [
AUTH N(MOBIKE_SUP) N(NO_ADD_ADDR) N(FAIL_CP_REQ) N(TS_UNACCEPT) ]
Jun 28 07:33:58 Z560 charon-nm: 06[IKE] authentication of
'durgeeenterprises.publicvm.com' with EAP successful
Jun 28 07:33:58 Z560 charon-nm: 06[IKE] IKE_SA Durgee Enterprises,
LLC[1] established between
192.168.1.114[dhdurgee]...108.31.28.59[durgeeenterprises.publicvm.com]
Jun 28 07:33:58 Z560 charon-nm: 06[IKE] scheduling rekeying in 35606s
Jun 28 07:33:58 Z560 charon-nm: 06[IKE] maximum IKE_SA lifetime 36206s
Jun 28 07:33:58 Z560 charon-nm: 06[IKE] received FAILED_CP_REQUIRED
notify, no CHILD_SA built
Jun 28 07:33:58 Z560 charon-nm: 06[IKE] failed to establish CHILD_SA,
keeping IKE_SA
</pre>
</blockquote>
</blockquote>
<pre wrap="">
hi,
Your responder (Server) seems to have some kind of configured poliy
where the server waits for a configuration request from the client. But
the clients does not ask for the config and the server terminates the
connection.
Please see the logs of you server, what exactly is missing. Perhaps the
server wants to hand out an IP address to the client or something else.
Mit freundlichen Grüßen,
</pre>
</blockquote>
<pre wrap="">
Looking at the log on the server I see:
</pre>
<blockquote type="cite">
<pre wrap="">Jun 28 07:33:58 DG41TY charon: 10[IKE] authentication of 'dhdurgee'
with EAP successful
Jun 28 07:33:58 DG41TY charon: 10[IKE] authentication of
'durgeeenterprises.publicvm.com' (myself) with EAP
Jun 28 07:33:58 DG41TY charon: 10[IKE] IKE_SA ikev2-vpn[61]
established between
192.168.80.11[durgeeenterprises.publicvm.com]...172.58.190.234[dhdurgee]
Jun 28 07:33:58 DG41TY charon: 10[IKE] IKE_SA ikev2-vpn[61]
established between
192.168.80.11[durgeeenterprises.publicvm.com]...172.58.190.234[dhdurgee]
Jun 28 07:33:58 DG41TY charon: 10[IKE] expected a virtual IP request,
sending FAILED_CP_REQUIRED
Jun 28 07:33:58 DG41TY charon: 10[IKE] traffic selectors 0.0.0.0/0
::/0 === 192.168.1.114/32 inacceptable
Jun 28 07:33:58 DG41TY charon: 10[IKE] failed to establish CHILD_SA,
keeping IKE_SA
Jun 28 07:33:58 DG41TY charon: 10[ENC] generating IKE_AUTH response 5
[ AUTH N(MOBIKE_SUP) N(NO_ADD_ADDR) N(FAIL_CP_REQ) N(TS_UNACCEPT) ]
Jun 28 07:33:58 DG41TY charon: 10[NET] sending packet: from
192.168.80.11[4500] to 172.58.190.234[59726] (124 bytes)
Jun 28 07:33:58 DG41TY charon: 14[NET] received packet: from
172.58.190.234[59726] to 192.168.80.11[4500] (76 bytes)
Jun 28 07:33:58 DG41TY charon: 14[ENC] parsed INFORMATIONAL request 6
[ D ]
Jun 28 07:33:58 DG41TY charon: 14[IKE] received DELETE for IKE_SA
ikev2-vpn[61]
Jun 28 07:33:58 DG41TY charon: 14[IKE] deleting IKE_SA ikev2-vpn[61]
between
192.168.80.11[durgeeenterprises.publicvm.com]...172.58.190.234[dhdurgee]
Jun 28 07:33:58 DG41TY charon: 14[IKE] deleting IKE_SA ikev2-vpn[61]
between
192.168.80.11[durgeeenterprises.publicvm.com]...172.58.190.234[dhdurgee]
Jun 28 07:33:58 DG41TY charon: 14[IKE] IKE_SA deleted
Jun 28 07:33:58 DG41TY charon: 14[IKE] IKE_SA deleted
Jun 28 07:33:58 DG41TY charon: 14[ENC] generating INFORMATIONAL
response 6 [ ]
Jun 28 07:33:58 DG41TY charon: 14[NET] sending packet: from
192.168.80.11[4500] to 172.58.190.234[59726] (76 bytes)
</pre>
</blockquote>
<pre wrap="">
Looking at my settings for the network connection shows IPv4 enabled
expecting an address to be assigned automatically via DHCP with DNS
and Routes set as automatic. The checkbox for "use this connection
only for resources on its network" is NOT checked. The page for IPv6
is also set as automatic with the checkbox NOT checked.
On the identity page none of the options are checked. Options are:
"Request an inner IP address"
"Enforce UDP encapsulation"
"Use IP compression"
All this should be defaults, as I only filled in the name, gateway,
certificate, authentication(EAP), username and password fields.
Dave
</pre>
</blockquote>
<pre wrap="">
I don't know about the manufacturer of your server side. but did you try
to add leftsourceip=%config to your client (initiator) config? Also
%config6 for IPv6 exists. See
<a class="moz-txt-link-freetext" href="https://wiki.strongswan.org/projects/strongswan/wiki/VirtualIp">https://wiki.strongswan.org/projects/strongswan/wiki/VirtualIp</a>
Mit freundlichen Grüßen,
</pre>
</blockquote>
<br>
I am configuring this client using the strongswan plugin for network
manager as noted in the subject line. I have attached the created
network connection to this post for your inspection. I guess
additional lines could be edited in manually if necessary, but now I
am wondering if I am posting in the proper place. Is it possible
this is a network-manager problem as opposed to strongswan?<br>
<br>
Dave<br>
</body>
</html>