<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<p><span style="font-family: "courier new", courier;">If I try to add 10.128.0.0/16 to the configuration for East <=> Central, I get:</span></p>
<p><span style="font-family: "courier new", courier;">received TS_UNACCEPTABLE notify, no CHILD_SA built</span><br><span style="font-family: "courier new", courier;">failed to establish CHILD_SA, keeping IKE_SA</span><br></p>
<p><span style="font-family: "courier new", courier;">when I attempt to bring up the connection.</span></p>
<p><span style="font-family: "courier new", courier;">This seems to be related to the fact there is no interface or route on Central which is on the 10.128.0.0 subnet, 10.128.0.0/16 traffic is passed to West via the West<=>Central ipsec link.</span></p>
<p><span style="font-family: "courier new", courier;">swanctl.conf:</span></p>
<p><span style="font-family: "courier new", courier;">connections {</span><br><span style="font-family: "courier new", courier;"> EastCentral {</span><br><span style="font-family: "courier new", courier;"> version=2</span><br><span style="font-family: "courier new", courier;"> local_addrs=a.b.c.d</span><br><span style="font-family: "courier new", courier;"> proposals=aes256-sha1-modp1024, default</span><br><span style="font-family: "courier new", courier;"> local-0 {</span><br><span style="font-family: "courier new", courier;"> auth = psk</span><br><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;"> remote-0 {</span><br><span style="font-family: "courier new", courier;"> auth = psk</span><br><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;"> remote_addrs=w.x.y.z</span><br><span style="font-family: "courier new", courier;"> children {</span><br><span style="font-family: "courier new", courier;"> EastCentral {</span><br><span style="font-family: "courier new", courier;"> esp_proposals=aes256-sha1, default</span><br><span style="font-family: "courier new", courier;"> dpd_action=restart</span><br><span style="font-family: "courier new", courier;"> local_ts=10.0.0.0/16</span><br><span style="font-family: "courier new", courier;"> remote_ts=10.64.0.0/16,10.128.0.0/16</span></p>
<p><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;">}</span><br><span style="font-family: "courier new", courier;">secrets {</span><br><span style="font-family: "courier new", courier;"> ike-w.x.y.za.b.c.d {</span><br><span style="font-family: "courier new", courier;"> secret = "SantizedForYourProtection"</span><br><span style="font-family: "courier new", courier;"> id-1=w.x.y.z</span><br><span style="font-family: "courier new", courier;"> id-0=a.b.c.d</span><br><span style="font-family: "courier new", courier;"> }</span><br><font face="courier new, courier">}</font></p>
<p class="default-style"></p>
</body>
</html>