Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can't get IPSEC to connect, been trying for days.

    Scheduled Pinned Locked Moved IPsec
    6 Posts 3 Posters 763 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      Sunka
      last edited by

      Trying whole days to make working VPN tunnel between 2 computers, here is the log:
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 08[CFG] received stroke: initiate 'hosttohost'
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[MGR] checkout IKE_SA by config
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[MGR] created IKE_SA (unnamed)[7]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] queueing IKE_VENDOR task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] queueing IKE_INIT task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] queueing IKE_NATD task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] queueing IKE_CERT_PRE task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] queueing IKE_AUTH task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] queueing IKE_CERT_POST task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] queueing IKE_CONFIG task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] queueing IKE_AUTH_LIFETIME task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] queueing IKE_MOBIKE task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] queueing IKE_ME task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] queueing CHILD_CREATE task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] activating new tasks
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] activating IKE_VENDOR task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] activating IKE_INIT task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] activating IKE_NATD task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] activating IKE_CERT_PRE task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] activating IKE_ME task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] activating IKE_AUTH task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] activating IKE_CERT_POST task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] activating IKE_CONFIG task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] activating CHILD_CREATE task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] activating IKE_AUTH_LIFETIME task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] activating IKE_MOBIKE task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] initiating IKE_SA hosttohost[7] to fd00:4444:5555:6666::2
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[IKE] IKE_SA hosttohost[7] state change: CREATED => CONNECTING
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[CFG] configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072, IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/AES_CTR_128/AES_CTR_192/AES_CTR_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/HMAC_SHA1_96/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/CURVE_25519/CURVE_448/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048, IKE:AES_CCM_16_128/AES_CCM_16_192/AES_CCM_16_256/AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/CHACHA20_POLY1305/AES_CCM_8_128/AES_CCM_8_192/AES_CCM_8_256/AES_CCM_12_128/AES_CCM_12_192/AES_CCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/CURVE_25519/CURVE_448/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[CFG] sending supported signature hash algorithms: sha256 sha384 sha512 identity
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[NET] sending packet: from fd00:1111:2222:3333::2[500] to fd00:4444:5555:6666::2[500] (1300 bytes)
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[MGR] checkin IKE_SA hosttohost[7]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 05[MGR] checkin of IKE_SA successful
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 03[NET] sending packet: from fd00:1111:2222:3333::2[500] to fd00:4444:5555:6666::2[500]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 02[NET] received packet: from fd00:4444:5555:6666::2[500] to fd00:1111:2222:3333::2[500]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 02[NET] waiting for data on sockets
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[MGR] checkout IKEv2 SA by message with SPIs 79c5638936e5f6dd_i a63d729544ce77ba_r
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[MGR] IKE_SA hosttohost[7] successfully checked out
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[NET] received packet: from fd00:4444:5555:6666::2[500] to fd00:1111:2222:3333::2[500] (625 bytes)
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[IKE] received FRAGMENTATION_SUPPORTED notify
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[IKE] received SIGNATURE_HASH_ALGORITHMS notify
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[IKE] received CHILDLESS_IKEV2_SUPPORTED notify
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[CFG] selecting proposal:
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[CFG] proposal matches
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[CFG] received proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[CFG] configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072, IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/AES_CTR_128/AES_CTR_192/AES_CTR_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/HMAC_SHA1_96/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/CURVE_25519/CURVE_448/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048, IKE:AES_CCM_16_128/AES_CCM_16_192/AES_CCM_16_256/AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/CHACHA20_POLY1305/AES_CCM_8_128/AES_CCM_8_192/AES_CCM_8_256/AES_CCM_12_128/AES_CCM_12_192/AES_CCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/CURVE_25519/CURVE_448/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[CFG] received supported signature hash algorithms: sha256 sha384 sha512 identity
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[IKE] received cert request for "CN=CA"
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[IKE] reinitiating already active tasks
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[IKE] IKE_CERT_PRE task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[IKE] IKE_AUTH task
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[IKE] sending cert request for "CN=CA"
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[IKE] authentication of 'O=OU, CN=computer1' (myself) with RSA_EMSA_PKCS1_SHA2_256 successful
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[IKE] sending end entity cert "O=OU, CN=computer1"
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[CFG] proposing traffic selectors for us:
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[CFG] fd00:1111:2222:3333::2/128
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[CFG] proposing traffic selectors for other:
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[CFG] dynamic
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[CFG] configured proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ, ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/HMAC_SHA1_96/AES_XCBC_96/NO_EXT_SEQ, ESP:AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[IKE] establishing CHILD_SA hosttohost{5}
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[KNL] got SPI c89f5905
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[ENC] generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH N(USE_TRANSP) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[ENC] splitting IKE message (2016 bytes) into 2 fragments
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[ENC] generating IKE_AUTH request 1 [ EF(1/2) ]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[ENC] generating IKE_AUTH request 1 [ EF(2/2) ]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[NET] sending packet: from fd00:1111:2222:3333::2[4500] to fd00:4444:5555:6666::2[4500] (1220 bytes)
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[NET] sending packet: from fd00:1111:2222:3333::2[4500] to fd00:4444:5555:6666::2[4500] (868 bytes)
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[MGR] checkin IKE_SA hosttohost[7]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 06[MGR] checkin of IKE_SA successful
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 03[NET] sending packet: from fd00:1111:2222:3333::2[4500] to fd00:4444:5555:6666::2[4500]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 03[NET] sending packet: from fd00:1111:2222:3333::2[4500] to fd00:4444:5555:6666::2[4500]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 02[NET] received packet: from fd00:4444:5555:6666::2[4500] to fd00:1111:2222:3333::2[4500]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 02[NET] waiting for data on sockets
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 10[MGR] checkout IKEv2 SA by message with SPIs 79c5638936e5f6dd_i a63d729544ce77ba_r
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 10[MGR] IKE_SA hosttohost[7] successfully checked out
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 10[NET] received packet: from fd00:4444:5555:6666::2[4500] to fd00:1111:2222:3333::2[4500] (80 bytes)
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 10[ENC] parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 10[IKE] received AUTHENTICATION_FAILED notify error
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 10[KNL] deleting SAD entry with SPI c89f5905
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 10[KNL] deleted SAD entry with SPI c89f5905
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 10[MGR] checkin and destroy IKE_SA hosttohost[7]
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 10[IKE] IKE_SA hosttohost[7] state change: CONNECTING => DESTROYING
      May 22 19:07:31 martin-Legion-5-15IAH7H charon: 10[MGR] checkin and destroy of IKE_SA successful
      May 22 19:07:35 martin-Legion-5-15IAH7H charon: 09[MGR] checkout IKEv2 SA with SPIs 79c5638936e5f6dd_i 0000000000000000_r
      May 22 19:07:35 martin-Legion-5-15IAH7H charon: 09[MGR] IKE_SA checkout not successful
      May 22 19:07:35 martin-Legion-5-15IAH7H charon: 04[MGR] checkout IKEv2 SA with SPIs 79c5638936e5f6dd_i a63d729544ce77ba_r
      May 22 19:07:35 martin-Legion-5-15IAH7H charon: 04[MGR] IKE_SA checkout not successful
      And here is the log from computer1 when computer2 tries to connect to computer1:
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 02[NET] received packet: from fd00:4444:5555:6666::2[500] to fd00:1111:2222:3333::2[500]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 02[NET] waiting for data on sockets
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[MGR] checkout IKEv2 SA by message with SPIs 046f7b4c3be7ab7e_i 0000000000000000_r
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[MGR] created IKE_SA (unnamed)[8]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[NET] received packet: from fd00:4444:5555:6666::2[500] to fd00:1111:2222:3333::2[500] (1300 bytes)
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[CFG] looking for an IKEv2 config for fd00:1111:2222:3333::2...fd00:4444:5555:6666::2
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[CFG] candidate: fd00:1111:2222:3333::2...fd00:4444:5555:6666::2, prio 3100
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[CFG] candidate: fd00:1111:2222:3333::2...fd00:4444:5555:6666::2, prio 3100
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[CFG] candidate: fd00:1111:2222:3333::2...fd00:4444:5555:6666::2, prio 3096
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[CFG] found matching ike config: fd00:1111:2222:3333::2...fd00:4444:5555:6666::2 with prio 3100
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[IKE] local endpoint changed from 0.0.0.0[500] to fd00:1111:2222:3333::2[500]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[IKE] remote endpoint changed from 0.0.0.0 to fd00:4444:5555:6666::2[500]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[IKE] fd00:4444:5555:6666::2 is initiating an IKE_SA
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[IKE] IKE_SA (unnamed)[8] state change: CREATED => CONNECTING
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[CFG] selecting proposal:
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[CFG] proposal matches
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[CFG] received proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072, IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/AES_CTR_128/AES_CTR_192/AES_CTR_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/HMAC_SHA1_96/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/MODP_3072/CURVE_25519/CURVE_448/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_4096/MODP_6144/MODP_8192/MODP_2048, IKE:AES_CCM_16_128/AES_CCM_16_192/AES_CCM_16_256/AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/CHACHA20_POLY1305/AES_CCM_8_128/AES_CCM_8_192/AES_CCM_8_256/AES_CCM_12_128/AES_CCM_12_192/AES_CCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/MODP_3072/CURVE_25519/CURVE_448/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_4096/MODP_6144/MODP_8192/MODP_2048
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[CFG] configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072, IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/AES_CTR_128/AES_CTR_192/AES_CTR_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/HMAC_SHA1_96/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/CURVE_25519/CURVE_448/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048, IKE:AES_CCM_16_128/AES_CCM_16_192/AES_CCM_16_256/AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/CHACHA20_POLY1305/AES_CCM_8_128/AES_CCM_8_192/AES_CCM_8_256/AES_CCM_12_128/AES_CCM_12_192/AES_CCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/CURVE_25519/CURVE_448/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[CFG] received supported signature hash algorithms: sha256 sha384 sha512 identity
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[CFG] sending supported signature hash algorithms: sha256 sha384 sha512 identity
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[IKE] sending cert request for "CN=CA"
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[NET] sending packet: from fd00:1111:2222:3333::2[500] to fd00:4444:5555:6666::2[500] (625 bytes)
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[MGR] checkin IKE_SA (unnamed)[8]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 08[MGR] checkin of IKE_SA successful
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 03[NET] sending packet: from fd00:1111:2222:3333::2[500] to fd00:4444:5555:6666::2[500]
      May 22 19:09:09 martin-Legion-5-15IAH7H wpa_supplicant[786]: wlp0s20f3: CTRL-EVENT-SIGNAL-CHANGE above=0 signal=-77 noise=9999 txrate=260000
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 02[NET] received packet: from fd00:4444:5555:6666::2[4500] to fd00:1111:2222:3333::2[4500]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 02[NET] waiting for data on sockets
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 02[NET] received packet: from fd00:4444:5555:6666::2[4500] to fd00:1111:2222:3333::2[4500]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 02[NET] waiting for data on sockets
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 10[MGR] checkout IKEv2 SA by message with SPIs 046f7b4c3be7ab7e_i 05828705f8b6d41d_r
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 10[MGR] IKE_SA (unnamed)[8] successfully checked out
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[MGR] checkout IKEv2 SA by message with SPIs 046f7b4c3be7ab7e_i 05828705f8b6d41d_r
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 10[NET] received packet: from fd00:4444:5555:6666::2[4500] to fd00:1111:2222:3333::2[4500] (1220 bytes)
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 10[ENC] parsed IKE_AUTH request 1 [ EF(1/2) ]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 10[IKE] local endpoint changed from fd00:1111:2222:3333::2[500] to fd00:1111:2222:3333::2[4500]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 10[IKE] remote endpoint changed from fd00:4444:5555:6666::2[500] to fd00:4444:5555:6666::2[4500]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 10[ENC] received fragment #1 of 2, waiting for complete IKE message
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 10[MGR] checkin IKE_SA (unnamed)[8]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 10[MGR] checkin of IKE_SA successful
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[MGR] IKE_SA (unnamed)[8] successfully checked out
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[NET] received packet: from fd00:4444:5555:6666::2[4500] to fd00:1111:2222:3333::2[4500] (884 bytes)
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[ENC] parsed IKE_AUTH request 1 [ EF(2/2) ]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[ENC] received fragment #2 of 2, reassembled fragmented IKE message (2032 bytes)
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[ENC] parsed IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH N(USE_TRANSP) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[IKE] received cert request for "CN=CA"
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[IKE] received end entity cert "O=OU, CN=computer2"
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[CFG] looking for peer configs matching fd00:1111:2222:3333::2[computer1]...fd00:4444:5555:6666::2[O=OU, CN=computer2]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[CFG] no matching peer config found
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[IKE] peer supports MOBIKE
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[IKE] got additional MOBIKE peer address: 192.168.88.246
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[IKE] got additional MOBIKE peer address: 192.168.1.38
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[IKE] got additional MOBIKE peer address: fd00:4444:5555:6666:7379:3fd6:6178:f67d
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[IKE] got additional MOBIKE peer address: fd00:9999:8888:7777:9d4:e1dd:7a3d:502a
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[IKE] got additional MOBIKE peer address: fd00:1111:2222:3333:70cf:7fe3:26c5:7345
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[NET] sending packet: from fd00:1111:2222:3333::2[4500] to fd00:4444:5555:6666::2[4500] (80 bytes)
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[MGR] checkin and destroy IKE_SA (unnamed)[8]
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[IKE] IKE_SA (unnamed)[8] state change: CONNECTING => DESTROYING
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[MGR] checkin and destroy of IKE_SA successful
      May 22 19:09:09 martin-Legion-5-15IAH7H charon: 03[NET] sending packet: from fd00:1111:2222:3333::2[4500] to fd00:4444:5555:6666::2[4500]

      M 1 Reply Last reply Reply Quote 0
      • M
        michmoor LAYER 8 Rebel Alliance @Sunka
        last edited by

        @sunka said in Can't get IPSEC to connect, been trying for days.:

        May 22 19:09:09 martin-Legion-5-15IAH7H charon: 09[CFG] no matching peer config found

        Could that be your problem?

        Firewall: NetGate,Palo Alto-VM,Juniper SRX
        Routing: Juniper, Arista, Cisco
        Switching: Juniper, Arista, Cisco
        Wireless: Unifi, Aruba IAP
        JNCIP,CCNP Enterprise

        1 Reply Last reply Reply Quote 0
        • S
          Sunka
          last edited by

          I though about it but both ipsec.conf are the same.
          It looks like this:
          computer1 ipsec.conf:
          conn hosttohost
          left=fd00:1111:2222:3333::2
          leftcert=computer1.crt
          leftsendcert=always
          leftsubnet=fd00:1111:2222:3333::/64
          leftid=@computer1
          right=fd00:4444:5555:6666::2
          ike=aes256-sha256-modp3072
          esp=aes256-sha256-modp3072
          authby=rsasig
          rightid=@computer2
          rightsourceip=fd00:4444:5555:6666::/64
          rightca=ca.crt
          type=transport
          auto=add

          computer2 ipsec.conf
          conn hosttohost
          left=fd00:4444:5555:6666::2
          leftcert=computer2.crt
          leftsendcert=always
          leftsubnet=fd00:4444:5555:6666::/64
          leftid=@computer2
          leftfirewall=yes
          right=fd00:1111:2222:3333::2
          rightid=@computer1
          ike=aes256-sha256-modp3072
          esp=aes256-sha256-modp3072
          authby=rsasig
          rightca=ca.crt
          type=transport
          auto=start

          1 Reply Last reply Reply Quote 0
          • S
            Sunka
            last edited by

            In the end i found that problem is this but idk how to solve it.
            May 22 20:53:04 martin-Legion-5-15IAH7H charon: 05[ENC] parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]
            May 22 20:53:04 martin-Legion-5-15IAH7H charon: 05[IKE] received AUTHENTICATION_FAILED notify error

            S 1 Reply Last reply Reply Quote 0
            • S
              SteveITS Galactic Empire @Sunka
              last edited by

              @sunka

              did you read through https://docs.netgate.com/pfsense/en/latest/troubleshooting/ipsec-connections.html#tunnel-does-not-establish

              or there are various examples at https://docs.netgate.com/pfsense/en/latest/recipes/#ipsec

              When you say "two computers" this is a site to site VPN?

              Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
              When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
              Upvote 👍 helpful posts!

              1 Reply Last reply Reply Quote 0
              • S
                Sunka
                last edited by Sunka

                Thank you for your response, but i am still on the same thing.
                in log
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 10[ENC] received fragment #1 of 2, waiting for complete IKE message
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 10[MGR] checkin IKE_SA (unnamed)[2]
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 10[MGR] checkin of IKE_SA successful
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[MGR] checkout IKEv2 SA by message with SPIs d026565155dc83e0_i 76c33ab5aa293765_r
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[MGR] IKE_SA (unnamed)[2] successfully checked out
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[NET] received packet: from fd00:4444:5555:6666::2[4500] to fd00:1111:2222:3333::2[4500] (772 bytes)
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[ENC] parsed IKE_AUTH request 1 [ EF(2/2) ]
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[ENC] received fragment #2 of 2, reassembled fragmented IKE message (1920 bytes)
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[ENC] parsed IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[IKE] received cert request for "C=CZ, ST=Czech republic, L=FrydekMistek, O=OU, OU=OU, CN=My CA, E=sasinka.martin@gmail.com"
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[IKE] received end entity cert "C=CZ, ST=Czech republic, L=FrydekMistek, O=OU, OU=OU, CN=computer2, E=sasinka.martin@gmail.com"
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[CFG] looking for peer configs matching fd00:1111:2222:3333::2[computer1]...fd00:4444:5555:6666::2[C=CZ, ST=Czech republic, L=FrydekMistek, O=OU, OU=OU, CN=computer2, E=sasinka.martin@gmail.com]
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[CFG] no matching peer config found
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[IKE] peer supports MOBIKE
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[IKE] got additional MOBIKE peer address: 192.168.88.246
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[IKE] got additional MOBIKE peer address: 192.168.1.48
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[IKE] got additional MOBIKE peer address: fd00:1111:2222:3333:70cf:7fe3:26c5:7345
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[IKE] got additional MOBIKE peer address: fd00:9999:8888:7777:9d4:e1dd:7a3d:502a
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[IKE] got additional MOBIKE peer address: fd00:4444:5555:6666:7379:3fd6:6178:f67d
                Jul 17 15:20:12 martin-Legion-5-15IAH7H charon: 11[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
                So the problem is no matching peer config found

                computer1 ipsec.conf
                conn hosttohost
                left=fd00:1111:2222:3333::2
                leftcert=server-cert.pem
                leftsubnet=fd00:1111:2222:3333::/64
                leftid=@computer1
                right=fd00:4444:5555:6666::2
                rightsubnet=fd00:4444:5555:6666::/64
                rightid=@computer2
                keyexchange=ikev2
                ike=aes256-sha256-modp3072
                esp=aes256gcm16-sha384-modp3072
                authby=rsasig
                type=tunnel
                auto=add

                computer2 ipsec.conf
                conn hosttohost
                left=fd00:4444:5555:6666::2
                leftcert=client-cert.pem
                leftsubnet=fd00:4444:5555:6666::/64
                leftid=@computer2
                right=fd00:1111:2222:3333::2
                rightid=@computer1
                keyexchange=ikev2
                ike=aes256-sha256-modp3072
                esp=aes256gcm16-sha384-modp3072
                authby=rsasig
                type=tunnel
                auto=add
                Any ideas please?

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.