<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<p style="" class="default-style"><span style="font-family: "courier new", courier;">Still not feeling the love, unfortunately.</span><br></p>
<p style="" class="default-style"><span face="courier new, courier" style="font-family: 'courier new', courier;">I never tried to connect from Central to East, I was always trying to go from East to Central.</span></p>
<p style="" class="default-style"><span face="courier new, courier" style="font-family: 'courier new', courier;">When I try to go from Central to East, I get a slightly different error message when attempting to start the connection.</span></p>
<p style="" class="default-style"><span face="courier new, courier" style="font-family: 'courier new', courier;"><br></span></p>
<p class="default-style"><span style="font-family: "courier new", courier;">swanctl.conf (East)</span></p>
<p class="default-style"><span style="font-family: "courier new", courier;">connections {</span><br><span style="font-family: "courier new", courier;"> EastCentral {</span><br><span style="font-family: "courier new", courier;"> version=2</span><br><span style="font-family: "courier new", courier;"> local_addrs=WW.XX.YY.ZZ</span><br><span style="font-family: "courier new", courier;"> proposals=aes256-sha1-modp1024, default</span><br><span style="font-family: "courier new", courier;"> local-0 {</span><br><span style="font-family: "courier new", courier;"> auth = psk</span><br><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;"> remote-0 {</span><br><span style="font-family: "courier new", courier;"> auth = psk</span><br><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;"> remote_addrs=AA.BB.CC.DD</span><br><span style="font-family: "courier new", courier;"> children {</span><br><span style="font-family: "courier new", courier;"> EastCentral {</span><br><span style="font-family: "courier new", courier;"> esp_proposals=aes256-sha1, default</span><br><span style="font-family: "courier new", courier;"> dpd_action=restart</span><br><span style="font-family: "courier new", courier;"> local_ts=10.0.0.0/16</span><br><span style="font-family: "courier new", courier;"> remote_ts=10.64.0.0/16,10.128.0.0/16</span><br><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;">}</span></p>
<p class="default-style"><span style="font-family: "courier new", courier;">swanctl.conf (Central)</span></p>
<p class="default-style"><span style="font-family: "courier new", courier;">connections {</span><br><span style="font-family: "courier new", courier;"> CentralEast {</span><br><span style="font-family: "courier new", courier;"> version=2</span><br><span style="font-family: "courier new", courier;"> local_addrs=AA.BB.CC.DD</span><br><span style="font-family: "courier new", courier;"> proposals=aes256-sha1-modp1024, default</span><br><span style="font-family: "courier new", courier;"> local-0 {</span><br><span style="font-family: "courier new", courier;"> auth = psk</span><br><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;"> remote-0 {</span><br><span style="font-family: "courier new", courier;"> auth = psk</span><br><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;"> remote_addrs=WW.XX.YY.ZZ</span><br><span style="font-family: "courier new", courier;"> children {</span><br><span style="font-family: "courier new", courier;"> CentralEast {</span><br><span style="font-family: "courier new", courier;"> esp_proposals=aes256-sha1, default</span><br><span style="font-family: "courier new", courier;"> dpd_action=restart</span><br><span style="font-family: "courier new", courier;"> local_ts=10.64.0.0/16,10.128.0.0/16</span><br><span style="font-family: "courier new", courier;"> remote_ts=10.0.0.0/16</span><br><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;"> }</span><br><span style="font-family: "courier new", courier;">}</span></p>
<p class="default-style"><br><span style="font-family: "courier new", courier;">--- If attempting to connect to Central from East:</span></p>
<p class="default-style"><br><span style="font-family: "courier new", courier;">[root@EastRouter swanctl]# swanctl --load-conns</span><br><span style="font-family: "courier new", courier;">loaded connection 'EastCentral'</span><br><span style="font-family: "courier new", courier;">successfully loaded 1 connections, 0 unloaded</span></p>
<p class="default-style"><span style="font-family: "courier new", courier;">[root@EastRouter swanctl]# strongswan up EastRouter</span><br><span style="font-family: "courier new", courier;">establishing CHILD_SA EastCentral{32}</span><br><span style="font-family: "courier new", courier;">generating CREATE_CHILD_SA request 2 [ SA No TSi TSr ]</span><br><span style="font-family: "courier new", courier;">sending packet: from WW.XX.YY.ZZ[4500] to AA.BB.CC.DD[4500] (620 bytes)</span><br><span style="font-family: "courier new", courier;">received packet: from AA.BB.CC.DD[4500] to WW.XX.YY.ZZ[4500] (76 bytes)</span><br><strong><span style="font-family: "courier new", courier;">parsed CREATE_CHILD_SA response 2 [ N(TS_UNACCEPT) ]</span></strong><br><strong><span style="font-family: "courier new", courier;">received TS_UNACCEPTABLE notify, no CHILD_SA built</span></strong><br><span style="font-family: "courier new", courier;">failed to establish CHILD_SA, keeping IKE_SA</span><br><span style="font-family: "courier new", courier;">establishing connection 'EastCentral' failed</span><br><span style="font-family: "courier new", courier;">[root@EastRouter swanctl]#</span></p>
<p class="default-style"><br><span style="font-family: "courier new", courier;">------ If attempting to connect to East from Central:</span></p>
<p class="default-style"><span style="font-family: "courier new", courier;">[root@CentralRouter conf.d]# swanctl --load-conns</span><br><span style="font-family: "courier new", courier;">loaded connection 'CentralEast'</span><br><span style="font-family: "courier new", courier;">successfully loaded 1 connections, 0 unloaded</span></p>
<p class="default-style"><span style="font-family: "courier new", courier;">[root@CentralRouter conf.d]# strongswan up CentralEast</span><br><span style="font-family: "courier new", courier;">establishing CHILD_SA CentralEast{88}</span><br><span style="font-family: "courier new", courier;">generating CREATE_CHILD_SA request 0 [ SA No TSi TSr ]</span><br><span style="font-family: "courier new", courier;">sending packet: from AA.BB.CC.DD[4500] to WW.XX.YY.ZZ[4500] (620 bytes)</span><br><span style="font-family: "courier new", courier;">received packet: from WW.XX.YY.ZZ[4500] to AA.BB.CC.DD[4500] (476 bytes)</span><br><span style="font-family: "courier new", courier;">parsed CREATE_CHILD_SA response 0 [ SA No TSi TSr ]</span><br><span style="font-family: "courier new", courier;">selected proposal: ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ</span><br><strong><span style="font-family: "courier new", courier;">error installing route with policy 10.128.0.0/16 === 10.0.0.0/16 out</span></strong><br><strong><span style="font-family: "courier new", courier;">unable to install IPsec policies (SPD) in kernel</span></strong><br><span style="font-family: "courier new", courier;">failed to establish CHILD_SA, keeping IKE_SA</span><br><span style="font-family: "courier new", courier;">sending DELETE for ESP CHILD_SA with SPI 255b9e78</span><br><span style="font-family: "courier new", courier;">generating INFORMATIONAL request 1 [ D ]</span><br><span style="font-family: "courier new", courier;">sending packet: from AA.BB.CC.DD[4500] to WW.XX.YY.ZZ[4500] (76 bytes)</span><br><span style="font-family: "courier new", courier;">received packet: from WW.XX.YY.ZZ[4500] to AA.BB.CC.DD[4500] (76 bytes)</span><br><span style="font-family: "courier new", courier;">parsed INFORMATIONAL response 1 [ D ]</span><br><span style="font-family: "courier new", courier;">establishing connection 'CentralEast' failed</span><br><span style="font-family: "courier new", courier;">[root@CentralRouter conf.d]#</span></p>
</body>
</html>