[strongSwan] Fwd: Re: FritzBox to Strongswan
mirko.parthey at web.de
Fri Nov 25 16:51:53 CET 2016
On Fri, Nov 25, 2016 at 02:55:17PM +0100, post at daniel-pomrehn.de wrote:
> Using your advices for configuration I am back at my first error:
> Nov 25 14:53:25 srv charon: 08[CFG] ike config match: 0 (184.108.40.206
> 220.127.116.11 IKEv1)
> Nov 25 14:53:25 srv charon: 08[IKE] no IKE config found for
> 18.104.22.168...22.214.171.124, sending NO_PROPOSAL_CHOSEN
> I tried to use keyexchange=ike, keyexchange=ikev1, keyexchange=ikev2 in
The FritzBox only supports IKEv1.
> But the message still appears.
Please approach this in a more systematic way.
Revert all config changes and then apply them step by step to find out
which change caused the problem. I suspect it is the removal of "right=".
Since you are using "auto=add", the connection is not started on demand
from the strongSwan end anyway, and you can avoid starting it manually.
Add back the "right=" option if its removal was the cause of the error.
If you need further assistance with this particular issue, please post
the output of "ipsec statusall".
> >With strongSwan as the initiator and FritzBox as the responder, only
> >aggressive mode will work reliably.
It occured to me that I only tested this with dynamic IP addresses on
both ends. Does your strongSwan server have a static IP address? In this
case, it might be worth trying to make strongSwan work as an initiator
with Main Mode, but first things first.
More information about the Users