[strongSwan] no virtual IP found for %any6
Jay Claybaugh
gambit990 at gmail.com
Fri Oct 3 06:29:10 CEST 2014
I've updated my Strongswan server to V5.1.3 and am having trouble
connecting with an Android client. It appears that the android client is
requesting both an IPV4 and IPV6 tunnel. The IPV4 tunnel appears to be
assigned whereas there is no IPV6 tunnel configured so none is assigned.
The result is that the Android client deletes the connection since both
requests aren't satisfied.
I'm not sure how to disable the Android client from requesting the IPV6
tunnel. If that isn't possible, I'm not sure how to setup the IPV6 tunnel
support on the server. Is there a recipe or sample on how that is done?
The server log shows:
04[IKE] peer requested virtual IP %any
04[CFG] reassigning offline lease to '<...>'
04[IKE] assigning virtual IP 192.168.6.1 to peer '<...>'
04[IKE] peer requested virtual IP %any6
04[IKE] no virtual IP found for %any6 requested by '<...>'
04[IKE] building INTERNAL_IP4_DNS attribute
04[KNL] received netlink error: No such file or directory (2)
04[KNL] unable to add SAD entry with SPI c8489b44
04[KNL] received netlink error: No such file or directory (2)
04[KNL] unable to add SAD entry with SPI 6c540958
04[IKE] unable to install inbound and outbound IPsec SA (SAD) in kernel
04[IKE] failed to establish CHILD_SA, keeping IKE_SA
04[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH CPRP(ADDR DNS) N
(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) N(NO_PROP) ]
04[NET] sending packet: from my.server[4500] to 192.168.2.131[43606] (1404
bytes)
03[NET] received packet: from 192.168.2.131[43606] to my.server[4500] (76
bytes)
03[ENC] parsed INFORMATIONAL request 2 [ D ]
03[IKE] received DELETE for IKE_SA android[4]
03[IKE] deleting IKE_SA android[4] between my.server[<...>]
03[IKE] deleting IKE_SA android[4] between my.server[<...>]...192.168.2.131
[<...>]
03[IKE] IKE_SA android[4] state change: ESTABLISHED => DELETING
03[IKE] IKE_SA deleted
03[IKE] IKE_SA deleted
03[ENC] generating INFORMATIONAL response 2 [ ]
03[NET] sending packet: from my.server[4500] to 192.168.2.131[43606] (76
bytes)
03[IKE] IKE_SA android[4] state change: DELETING => DESTROYING
The Android client log shows:
05[IKE] IKE_SA android[6] established between 192.168.1.11
[<...>]...my.server[<...>]
05[IKE] scheduling rekeying in 35475s
05[IKE] maximum IKE_SA lifetime 36075s
05[IKE] installing new virtual IP 192.168.6.1
05[IKE] received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built
05[IKE] closing IKE_SA due CHILD_SA setup failure
05[IKE] received AUTH_LIFETIME of 10064s, scheduling reauthentication in
9464s
05[IKE] peer supports MOBIKE
04[IKE] deleting IKE_SA android[6] between 192.168.1.11[<...>]...my.server
[<...>]
04[IKE] sending DELETE for IKE_SA android[6]
04[ENC] generating INFORMATIONAL request 2 [ D ]
04[NET] sending packet: from 192.168.1.11[44092] to my.server[4500] (76
bytes)
03[NET] received packet: from my.server[4500] to 192.168.1.11[44092] (76
bytes)
03[ENC] parsed INFORMATIONAL response 2 [ ]
03[IKE] IKE_SA deleted
The server IPsec.conf file contains:
conn android
keyingtries=1
keyexchange=ikev2
left=%any
leftsubnet=0.0.0.0/0
leftauth=pubkey
leftcert=home.pem
right=%any
rightauth=pubkey
rightsourceip=192.168.6.0/24
auto=add
Thanks,
Jay
More information about the Users
mailing list