[strongSwan] Same config for strongSwan, different outcome between Android and iOS

Wed Jun 29 03:48:41 CEST 2016

Hello list,

I've set up a strongSwan server for IKEv2. Connections with the Android 
strongSwan app fail, while using the iOS built-in IKEv2 client works 
without issues. Any ideas on what might be going on?

I have the following in my ipsec.conf:

config setup
         uniqueids = no

conn %default
         keyingtries=2
         left=us.npu.io
         leftcert=fullchain.pem
         leftfirewall=no
         right=%any

conn iOS-radius
         leftid=some.host.domain
         keyexchange=ikev2
         leftsendcert=always
         leftsubnet=0.0.0.0/0
         rightauth=eap-radius
         eap_identity=%identity
         auto=add
         rightsourceip=%radius
         rightdns=8.8.8.8
         dpdaction=clear

In the below logs, 1.1.1.1 is the client while 2.2.2.2 is the server.

Android strongSwan client server logs:

Jun 29 01:33:15 irkalla charon: 04[NET] received packet: from 
1.1.1.1[40108] to 2.2.2.2[500] (732 bytes)
Jun 29 01:33:15 irkalla charon: 04[ENC] parsed IKE_SA_INIT request 0 [ 
SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N((16431)) N(REDIR_SUP) ]
Jun 29 01:33:15 irkalla charon: 04[IKE] 1.1.1.1 is initiating an IKE_SA
Jun 29 01:33:15 irkalla charon: 04[IKE] remote host is behind NAT
Jun 29 01:33:15 irkalla charon: 04[IKE] DH group ECP_256 inacceptable, 
requesting MODP_2048
Jun 29 01:33:15 irkalla charon: 04[ENC] generating IKE_SA_INIT response 
0 [ N(INVAL_KE) ]
Jun 29 01:33:15 irkalla charon: 04[NET] sending packet: from 
2.2.2.2[500] to 1.1.1.1[40108] (38 bytes)
Jun 29 01:33:17 irkalla charon: 08[NET] received packet: from 
1.1.1.1[40108] to 2.2.2.2[500] (732 bytes)
Jun 29 01:33:17 irkalla charon: 08[ENC] parsed IKE_SA_INIT request 0 [ 
SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N((16431)) N(REDIR_SUP) ]
Jun 29 01:33:17 irkalla charon: 06[NET] received packet: from 
1.1.1.1[40108] to 2.2.2.2[500] (924 bytes)
Jun 29 01:33:17 irkalla charon: 06[ENC] parsed IKE_SA_INIT request 0 [ 
SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N((16431)) N(REDIR_SUP) ]
Jun 29 01:33:17 irkalla charon: 08[IKE] 1.1.1.1 is initiating an IKE_SA
Jun 29 01:33:17 irkalla charon: 08[IKE] remote host is behind NAT
Jun 29 01:33:17 irkalla charon: 08[IKE] DH group ECP_256 inacceptable, 
requesting MODP_2048
Jun 29 01:33:17 irkalla charon: 08[ENC] generating IKE_SA_INIT response 
0 [ N(INVAL_KE) ]
Jun 29 01:33:17 irkalla charon: 08[NET] sending packet: from 
2.2.2.2[500] to 1.1.1.1[40108] (38 bytes)
Jun 29 01:33:18 irkalla charon: 14[MGR] ignoring request with ID 0, 
already processing
Jun 29 01:33:18 irkalla charon: 06[IKE] 1.1.1.1 is initiating an IKE_SA
Jun 29 01:33:18 irkalla charon: 06[IKE] remote host is behind NAT
Jun 29 01:33:18 irkalla charon: 06[ENC] generating IKE_SA_INIT response 
0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
Jun 29 01:33:18 irkalla charon: 06[NET] sending packet: from 
2.2.2.2[500] to 1.1.1.1[40108] (440 bytes)
Jun 29 01:33:19 irkalla charon: 12[JOB] deleting half open IKE_SA after 
timeout
Jun 29 01:33:33 irkalla charon: 11[NET] received packet: from 
1.1.1.1[40108] to 2.2.2.2[500] (732 bytes)
Jun 29 01:33:33 irkalla charon: 11[ENC] parsed IKE_SA_INIT request 0 [ 
SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N((16431)) N(REDIR_SUP) ]
Jun 29 01:33:33 irkalla charon: 11[IKE] 1.1.1.1 is initiating an IKE_SA
Jun 29 01:33:33 irkalla charon: 11[IKE] remote host is behind NAT
Jun 29 01:33:33 irkalla charon: 11[IKE] DH group ECP_256 inacceptable, 
requesting MODP_2048
Jun 29 01:33:33 irkalla charon: 11[ENC] generating IKE_SA_INIT response 
0 [ N(INVAL_KE) ]
Jun 29 01:33:33 irkalla charon: 11[NET] sending packet: from 
2.2.2.2[500] to 1.1.1.1[40108] (38 bytes)
Jun 29 01:33:48 irkalla charon: 08[JOB] deleting half open IKE_SA after 
timeout

iPhone built-in VPN client server logs:

Jun 29 01:35:29 irkalla charon: 10[NET] received packet: from 
1.1.1.1[500] to 2.2.2.2[500] (604 bytes)
Jun 29 01:35:29 irkalla charon: 10[ENC] parsed IKE_SA_INIT request 0 [ 
SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]
Jun 29 01:35:29 irkalla charon: 10[IKE] 1.1.1.1 is initiating an IKE_SA
Jun 29 01:35:29 irkalla charon: 10[IKE] remote host is behind NAT
Jun 29 01:35:29 irkalla charon: 10[ENC] generating IKE_SA_INIT response 
0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
Jun 29 01:35:29 irkalla charon: 10[NET] sending packet: from 
2.2.2.2[500] to 1.1.1.1[500] (440 bytes)
Jun 29 01:35:30 irkalla charon: 11[NET] received packet: from 
1.1.1.1[4500] to 2.2.2.2[4500] (496 bytes)
Jun 29 01:35:30 irkalla charon: 11[ENC] parsed IKE_AUTH request 1 [ IDi 
N(INIT_CONTACT) N(MOBIKE_SUP) IDr CPRQ(ADDR DHCP DNS MASK
ADDR6 DHCP6 DNS6) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ]
Jun 29 01:35:30 irkalla charon: 11[CFG] looking for peer configs 
matching 2.2.2.2[some.host.domain]...1.1.1.1[laurens2]
Jun 29 01:35:30 irkalla charon: 11[CFG] selected peer config 
'iOS-radius'
Jun 29 01:35:30 irkalla charon: 11[IKE] initiating EAP_IDENTITY method 
(id 0x00)
Jun 29 01:35:30 irkalla charon: 11[IKE] received 
ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Jun 29 01:35:30 irkalla charon: 11[IKE] peer supports MOBIKE
Jun 29 01:35:30 irkalla charon: 11[IKE] authentication of 
'some.host.domain' (myself) with RSA signature successful
Jun 29 01:35:30 irkalla charon: 11[IKE] sending end entity cert 
"CN=some.host.domain"
Jun 29 01:35:30 irkalla charon: 11[ENC] generating IKE_AUTH response 1 [ 
IDr CERT AUTH EAP/REQ/ID ]
Jun 29 01:35:30 irkalla charon: 11[NET] sending packet: from 
2.2.2.2[4500] to 1.1.1.1[4500] (1648 bytes)
Jun 29 01:35:30 irkalla charon: 14[NET] received packet: from 
1.1.1.1[4500] to 2.2.2.2[4500] (96 bytes)
Jun 29 01:35:30 irkalla charon: 14[ENC] parsed IKE_AUTH request 2 [ 
EAP/RES/ID ]
Jun 29 01:35:30 irkalla charon: 14[IKE] received EAP identity 'laurens2'
Jun 29 01:35:30 irkalla charon: 14[CFG] sending RADIUS Access-Request to 
server 'server-a'
Jun 29 01:35:30 irkalla charon: 14[CFG] received RADIUS Access-Challenge 
from server 'server-a'
Jun 29 01:35:30 irkalla charon: 14[IKE] initiating EAP_MD5 method (id 
0x01)
Jun 29 01:35:30 irkalla charon: 14[ENC] generating IKE_AUTH response 2 [ 
EAP/REQ/MD5 ]
Jun 29 01:35:30 irkalla charon: 14[NET] sending packet: from 
2.2.2.2[4500] to 1.1.1.1[4500] (96 bytes)
Jun 29 01:35:30 irkalla charon: 05[NET] received packet: from 
1.1.1.1[4500] to 2.2.2.2[4500] (80 bytes)
Jun 29 01:35:30 irkalla charon: 05[ENC] parsed IKE_AUTH request 3 [ 
EAP/RES/NAK ]
Jun 29 01:35:30 irkalla charon: 05[CFG] sending RADIUS Access-Request to 
server 'server-a'
Jun 29 01:35:30 irkalla charon: 05[CFG] received RADIUS Access-Challenge 
from server 'server-a'
Jun 29 01:35:30 irkalla charon: 05[ENC] generating IKE_AUTH response 3 [ 
EAP/REQ/MSCHAPV2 ]
Jun 29 01:35:30 irkalla charon: 05[NET] sending packet: from 
2.2.2.2[4500] to 1.1.1.1[4500] (112 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 04[NET] sending packet: from 
2.2.2.2[500] to 1.1.1.1[51959] (38 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 04[NET] received packet: from 
1.1.1.1[40108] to 2.2.2.2[500] (732 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 04[ENC] parsed IKE_SA_INIT request 
0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N((16431)) 
N(REDIR_SUP) ]
Jun 29 01:35:30 irkalla ipsec[13556]: 04[IKE] 1.1.1.1 is initiating an 
IKE_SA
Jun 29 01:35:30 irkalla ipsec[13556]: 04[IKE] remote host is behind NAT
Jun 29 01:35:30 irkalla ipsec[13556]: 04[IKE] DH group ECP_256 
inacceptable, requesting MODP_2048
Jun 29 01:35:30 irkalla ipsec[13556]: 04[ENC] generating IKE_SA_INIT 
response 0 [ N(INVAL_KE) ]
Jun 29 01:35:30 irkalla ipsec[13556]: 04[NET] sending packet: from 
2.2.2.2[500] to 1.1.1.1[40108] (38 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 08[NET] received packet: from 
1.1.1.1[40108] to 2.2.2.2[500] (732 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 08[ENC] parsed IKE_SA_INIT request 
0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N((16431)) 
N(REDIR_SUP) ]
Jun 29 01:35:30 irkalla ipsec[13556]: 06[NET] received packet: from 
1.1.1.1[40108] to 2.2.2.2[500] (924 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 06[ENC] parsed IKE_SA_INIT request 
0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N((16431)) 
N(REDIR_SUP) ]
Jun 29 01:35:30 irkalla ipsec[13556]: 08[IKE] 1.1.1.1 is initiating an 
IKE_SA
Jun 29 01:35:30 irkalla ipsec[13556]: 08[IKE] remote host is behind NAT
Jun 29 01:35:30 irkalla ipsec[13556]: 08[IKE] DH group ECP_256 
inacceptable, requesting MODP_2048
Jun 29 01:35:30 irkalla ipsec[13556]: 08[ENC] generating IKE_SA_INIT 
response 0 [ N(INVAL_KE) ]
Jun 29 01:35:30 irkalla ipsec[13556]: 08[NET] sending packet: from 
2.2.2.2[500] to 1.1.1.1[40108] (38 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 14[MGR] ignoring request with ID 
0, already processing
Jun 29 01:35:30 irkalla ipsec[13556]: 06[IKE] 1.1.1.1 is initiating an 
IKE_SA
Jun 29 01:35:30 irkalla ipsec[13556]: 06[IKE] remote host is behind NAT
Jun 29 01:35:30 irkalla ipsec[13556]: 06[ENC] generating IKE_SA_INIT 
response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
Jun 29 01:35:30 irkalla ipsec[13556]: 06[NET] sending packet: from 
2.2.2.2[500] to 1.1.1.1[40108] (440 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 12[JOB] deleting half open IKE_SA 
after timeout
Jun 29 01:35:30 irkalla ipsec[13556]: 11[NET] received packet: from 
1.1.1.1[40108] to 2.2.2.2[500] (732 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 11[ENC] parsed IKE_SA_INIT request 
0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N((16431)) 
N(REDIR_SUP) ]
Jun 29 01:35:30 irkalla ipsec[13556]: 11[IKE] 1.1.1.1 is initiating an 
IKE_SA
Jun 29 01:35:30 irkalla ipsec[13556]: 11[IKE] remote host is behind NAT
Jun 29 01:35:30 irkalla ipsec[13556]: 11[IKE] DH group ECP_256 
inacceptable, requesting MODP_2048
Jun 29 01:35:30 irkalla ipsec[13556]: 11[ENC] generating IKE_SA_INIT 
response 0 [ N(INVAL_KE) ]
Jun 29 01:35:30 irkalla ipsec[13556]: 11[NET] sending packet: from 
2.2.2.2[500] to 1.1.1.1[40108] (38 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 08[JOB] deleting half open IKE_SA 
after timeout
Jun 29 01:35:30 irkalla ipsec[13556]: 10[NET] received packet: from 
1.1.1.1[500] to 2.2.2.2[500] (604 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 10[ENC] parsed IKE_SA_INIT request 
0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]
Jun 29 01:35:30 irkalla ipsec[13556]: 10[IKE] 1.1.1.1 is initiating an 
IKE_SA
Jun 29 01:35:30 irkalla ipsec[13556]: 10[IKE] remote host is behind NAT
Jun 29 01:35:30 irkalla ipsec[13556]: 10[ENC] generating IKE_SA_INIT 
response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
Jun 29 01:35:30 irkalla ipsec[13556]: 10[NET] sending packet: from 
2.2.2.2[500] to 1.1.1.1[500] (440 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 11[NET] received packet: from 
1.1.1.1[4500] to 2.2.2.2[4500] (496 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 11[ENC] parsed IKE_AUTH request 1 
[ IDi N(INIT_CONTACT) N(MOBIKE_SUP) IDr CPRQ(ADDR DHCP DNS MASK ADDR6 
DHCP6 DNS6) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ]
Jun 29 01:35:30 irkalla ipsec[13556]: 11[CFG] looking for peer configs 
matching 2.2.2.2[some.host.domain]...1.1.1.1[laurens2]
Jun 29 01:35:30 irkalla ipsec[13556]: 11[CFG] selected peer config 
'iOS-radius'
Jun 29 01:35:30 irkalla ipsec[13556]: 11[IKE] initiating EAP_IDENTITY 
method (id 0x00)
Jun 29 01:35:30 irkalla ipsec[13556]: 11[IKE] received 
ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Jun 29 01:35:30 irkalla ipsec[13556]: 11[IKE] peer supports MOBIKE
Jun 29 01:35:30 irkalla ipsec[13556]: 11[IKE] authentication of 
'some.host.domain' (myself) with RSA signature successful
Jun 29 01:35:30 irkalla ipsec[13556]: 11[IKE] sending end entity cert 
"CN=some.host.domain"
Jun 29 01:35:30 irkalla ipsec[13556]: 11[ENC] generating IKE_AUTH 
response 1 [ IDr CERT AUTH EAP/REQ/ID ]
Jun 29 01:35:30 irkalla ipsec[13556]: 11[NET] sending packet: from 
2.2.2.2[4500] to 1.1.1.1[4500] (1648 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 14[NET] received packet: from 
1.1.1.1[4500] to 2.2.2.2[4500] (96 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 14[ENC] parsed IKE_AUTH request 2 
[ EAP/RES/ID ]
Jun 29 01:35:30 irkalla ipsec[13556]: 14[IKE] received EAP identity 
'laurens2'
Jun 29 01:35:30 irkalla ipsec[13556]: 14[CFG] sending RADIUS 
Access-Request to server 'server-a'
Jun 29 01:35:30 irkalla ipsec[13556]: 14[CFG] received RADIUS 
Access-Challenge from server 'server-a'
Jun 29 01:35:30 irkalla ipsec[13556]: 14[IKE] initiating EAP_MD5 method 
(id 0x01)
Jun 29 01:35:30 irkalla ipsec[13556]: 14[ENC] generating IKE_AUTH 
response 2 [ EAP/REQ/MD5 ]
Jun 29 01:35:30 irkalla ipsec[13556]: 14[NET] sending packet: from 
2.2.2.2[4500] to 1.1.1.1[4500] (96 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 05[NET] received packet: from 
1.1.1.1[4500] to 2.2.2.2[4500] (80 bytes)
Jun 29 01:35:30 irkalla ipsec[13556]: 05[ENC] parsed IKE_AUTH request 3 
[ EAP/RES/NAK ]
Jun 29 01:35:30 irkalla ipsec[13556]: 05[CFG] sending RADIUS 
Access-Request to server 'server-a'
Jun 29 01:35:30 irkalla ipsec[13556]: 05[CFG] received RADIUS 
Access-Challenge from server 'server-a'
Jun 29 01:35:30 irkalla charon: 06[NET] received packet: from 
1.1.1.1[4500] to 2.2.2.2[4500] (144 bytes)
Jun 29 01:35:30 irkalla charon: 06[ENC] parsed IKE_AUTH request 4 [ 
EAP/RES/MSCHAPV2 ]
Jun 29 01:35:30 irkalla charon: 06[CFG] sending RADIUS Access-Request to 
server 'server-a'
Jun 29 01:35:30 irkalla charon: 06[CFG] received RADIUS Access-Challenge 
from server 'server-a'
Jun 29 01:35:30 irkalla charon: 06[ENC] generating IKE_AUTH response 4 [ 
EAP/REQ/MSCHAPV2 ]
Jun 29 01:35:30 irkalla charon: 06[NET] sending packet: from 
2.2.2.2[4500] to 1.1.1.1[4500] (128 bytes)
Jun 29 01:35:30 irkalla charon: 04[NET] received packet: from 
1.1.1.1[4500] to 2.2.2.2[4500] (80 bytes)
Jun 29 01:35:30 irkalla charon: 04[ENC] parsed IKE_AUTH request 5 [ 
EAP/RES/MSCHAPV2 ]
Jun 29 01:35:30 irkalla charon: 04[CFG] sending RADIUS Access-Request to 
server 'server-a'
Jun 29 01:35:31 irkalla charon: 04[CFG] received RADIUS Access-Accept 
from server 'server-a'
Jun 29 01:35:31 irkalla charon: 04[LIB] 5 bytes insufficient to parse 6 
bytes of data
Jun 29 01:35:31 irkalla charon: 04[IKE] RADIUS authentication of 
'laurens2' successful
Jun 29 01:35:31 irkalla charon: 04[IKE] EAP method EAP_MSCHAPV2 
succeeded, MSK established
Jun 29 01:35:31 irkalla charon: 04[ENC] generating IKE_AUTH response 5 [ 
EAP/SUCC ]
Jun 29 01:35:31 irkalla charon: 04[NET] sending packet: from 
2.2.2.2[4500] to 1.1.1.1[4500] (80 bytes)
Jun 29 01:35:31 irkalla charon: 12[NET] received packet: from 
1.1.1.1[4500] to 2.2.2.2[4500] (112 bytes)
Jun 29 01:35:31 irkalla charon: 12[ENC] parsed IKE_AUTH request 6 [ AUTH 
]
Jun 29 01:35:31 irkalla charon: 12[IKE] authentication of 'laurens2' 
with EAP successful
Jun 29 01:35:31 irkalla charon: 12[IKE] authentication of 
'some.host.domain' (myself) with EAP
Jun 29 01:35:31 irkalla charon: 12[IKE] IKE_SA iOS-radius[66] 
established between 2.2.2.2[some.host.domain]...1.1.1.1[laurens2]
Jun 29 01:35:31 irkalla charon: 12[IKE] scheduling reauthentication in 
10050s
Jun 29 01:35:31 irkalla charon: 12[IKE] maximum IKE_SA lifetime 10590s
Jun 29 01:35:31 irkalla charon: 12[IKE] peer requested virtual IP %any
Jun 29 01:35:31 irkalla charon: 12[IKE] assigning virtual IP 10.1.0.18 
to peer 'laurens2'
Jun 29 01:35:31 irkalla charon: 12[IKE] peer requested virtual IP %any6
Jun 29 01:35:31 irkalla charon: 12[IKE] no virtual IP found for %any6 
requested by 'laurens2'
Jun 29 01:35:31 irkalla charon: 12[IKE] CHILD_SA iOS-radius{5} 
established with SPIs cc688f90_i 08a18ad5_o and TS 0.0.0.0/0 === 
10.1.0.18/32
Jun 29 01:35:31 irkalla charon: 12[CFG] scheduling RADIUS 
Interim-Updates every 300s
Jun 29 01:35:31 irkalla charon: 12[CFG] sending RADIUS 
Accounting-Request to server 'server-a'
Jun 29 01:35:31 irkalla charon: 12[CFG] received RADIUS 
Accounting-Response from server 'server-a'
Jun 29 01:35:31 irkalla charon: 12[ENC] generating IKE_AUTH response 6 [ 
AUTH CPRP(ADDR DNS DNS) SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) 
N(ADD_4_ADDR) N(ADD_4_ADDR) ]
Jun 29 01:35:31 irkalla charon: 12[NET] sending packet: from 
2.2.2.2[4500] to 1.1.1.1[4500] (288 bytes)
Jun 29 01:35:35 irkalla charon: 11[NET] received packet: from 
1.1.1.1[4500] to 2.2.2.2[4500] (80 bytes)
Jun 29 01:35:35 irkalla charon: 11[ENC] parsed INFORMATIONAL request 7 [ 
D ]
Jun 29 01:35:35 irkalla charon: 11[IKE] received DELETE for IKE_SA 
iOS-radius[66]
Jun 29 01:35:35 irkalla charon: 11[IKE] deleting IKE_SA iOS-radius[66] 
between 2.2.2.2[some.host.domain]...1.1.1.1[laurens2]
Jun 29 01:35:35 irkalla charon: 11[IKE] IKE_SA deleted
Jun 29 01:35:35 irkalla charon: 11[CFG] sending RADIUS 
Accounting-Request to server 'server-a'
Jun 29 01:35:35 irkalla charon: 11[CFG] received RADIUS 
Accounting-Response from server 'server-a'
Jun 29 01:35:35 irkalla charon: 11[ENC] generating INFORMATIONAL 
response 7 [ ]
Jun 29 01:35:35 irkalla charon: 11[NET] sending packet: from 
2.2.2.2[4500] to 1.1.1.1[4500] (80 bytes)