2

I'm trying to setup a Cisco router (881H) to act as a head end for an IPsec IKEv2 VPN. The target setup is meant to be used by StrongSWan clients (currently testing on Android smartphone), and we wish to use certificate + EAP authentication. The EAP authentication is done with a Radius server.

For some reason, the setup is not working. I see some errors on the IOS side at the processing INITIAL_CONTACT stage, as well as some more generic errors like "a supplied parameter is incorrect".

Here below you will find the router configuration (relevant parts, full configuration available if needed), IOS logs, and client logs.

Router configuration:

aaa new-model
!
!
aaa group server radius nas
 server name nas
!
aaa authentication login ipsec-radius group nas
aaa authentication enable default none
aaa authorization exec default none 
aaa authorization commands 0 default none 
aaa authorization commands 15 default none 
aaa authorization network default if-authenticated 

aaa session-id common
memory-size iomem 10

crypto pki trustpoint pki_ca_home
 enrollment terminal pem
 revocation-check none
!
crypto pki trustpoint pki_crt_rtr.example.net
 subject-name CN=rtr.example.net,OU=Private,L=Brussels,C=BE
 chain-validation continue pki_ca_home
 revocation-check none
 rsakeypair pki_crt_rtr.example.net 2048
 auto-enroll
!
!
!
crypto pki certificate map crp_ph1_crt-map 10
 subject-name co @example.net
!         
crypto pki certificate chain pki_ca_home
 certificate ca CERT_SERIAL
  CONTENT_REMOVED
    quit
crypto pki certificate chain pki_crt_rtr.example.net
 certificate CERT_SERIAL
  CONTENT_REMOVED
    quit
 certificate ca CERT_SERIAL
  CONTENT_REMOVED
    quit
!
crypto ikev2 proposal crp_ph1_proposal 
 encryption aes-cbc-256
 integrity sha256
 group 14 15 16 19
!
crypto ikev2 policy crp_ph1_policy 
 proposal crp_ph1_proposal
!
!
crypto ikev2 profile crp_ph1_profile
 match certificate crp_ph1_crt-map
 identity local fqdn rtr.example.net
 authentication remote rsa-sig
 authentication remote eap query-identity
 authentication local rsa-sig
 pki trustpoint pki_crt_rtr.example.net
 aaa authentication eap ipsec-radius
 virtual-template 2
!
no crypto ikev2 http-url cert
!
!
!
crypto ipsec transform-set crp_ph2_ts esp-aes 256 esp-sha-hmac 
 mode tunnel
!
crypto ipsec profile crp_ph2_profile
 set transform-set crp_ph2_ts 
 set ikev2-profile crp_ph1_profile

interface Virtual-Template2 type tunnel
 ip unnumbered Vlan10
 ip mtu 1000
 tunnel source Vlan10
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile crp_ph2_profile
!
interface Vlan10
 description DMZ LAN
 ip address 192.168.10.1 255.255.255.0
 ip access-group acl4_in_dmz in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip pim sparse-dense-mode
 ip nat inside
 ip virtual-reassembly in
 ipv6 address FE80::2000:1 link-local
 ipv6 address IPV6_PREFIX_1::1/64
 ipv6 enable
 ipv6 traffic-filter acl6_in_dmz in
 ipv6 traffic-filter acl6_out_dmz out
!         

interface Dialer1
 mtu 1492
 ip address negotiated
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly in
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 ipv6 address FE80::10 link-local
 ipv6 address autoconfig default
 ipv6 enable
 ipv6 dhcp client pd prefix_wan
 ipv6 traffic-filter acl6_out_wan out
 ppp authentication pap chap callin
 ppp chap hostname LOGIN
 ppp chap password 7 PASSWORD
 ppp pap sent-username LOGIN password 7 PASSWORD
 no cdp enable
!
no ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip radius source-interface Vlan10 
!
!
radius server nas
 address ipv4 192.168.10.5 auth-port 1812 acct-port 1813
 key 7 RAD_KEY
!

Router logs:

008702: Oct  1 19:04:10.920: IKEv2:Received Packet [From CLIENT_PUBLIC_IP:20182/To RTR_PUBLIC_IP:500/VRF i0:f0] 
Initiator SPI : B0553C16D0F4AE75 - Responder SPI : 0000000000000000 Message id: 0
IKEv2 IKE_SA_INIT Exchange REQUEST 
Payload contents: 
 SA KE N NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP) NOTIFY(Unknown - 16430) NOTIFY(Unknown - 16431) NOTIFY(REDIRECT_SUPPORTED) 

008703: Oct  1 19:04:10.920: IKEv2:(SESSION ID = 84,SA ID = 1):Verify SA init message
008704: Oct  1 19:04:10.920: IKEv2:(SESSION ID = 84,SA ID = 1):Insert SA
008705: Oct  1 19:04:10.920: IKEv2:Searching Policy with fvrf 0, local address RTR_PUBLIC_IP
008706: Oct  1 19:04:10.920: IKEv2:Found Policy 'crp_ph1_policy'
008707: Oct  1 19:04:10.920: IKEv2:(SESSION ID = 84,SA ID = 1):Processing IKE_SA_INIT message
008708: Oct  1 19:04:10.924: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Retrieve configured trustpoint(s)
008709: Oct  1 19:04:10.924: IKEv2:(SA ID = 1):[PKI -> IKEv2] Retrieved trustpoint(s): 'pki_crt_rtr.example.net'   'pki_ca_home'   
008710: Oct  1 19:04:10.924: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Get Public Key Hashes of trustpoints
008711: Oct  1 19:04:10.924: IKEv2:(SA ID = 1):[PKI -> IKEv2] Getting of Public Key Hashes of trustpoints PASSED
008712: Oct  1 19:04:10.924: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Start PKI Session
008713: Oct  1 19:04:10.924: IKEv2:(SA ID = 1):[PKI -> IKEv2] Starting of PKI Session PASSED
008714: Oct  1 19:04:10.924: IKEv2:(SESSION ID = 84,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH public key, DH Group 19
008715: Oct  1 19:04:10.924: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED
008716: Oct  1 19:04:10.924: IKEv2:(SESSION ID = 84,SA ID = 1):Request queued for computation of DH key
008717: Oct  1 19:04:10.924: IKEv2:(SESSION ID = 84,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH secret key, DH Group 19
008718: Oct  1 19:04:10.956: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED
008719: Oct  1 19:04:10.956: IKEv2:(SESSION ID = 84,SA ID = 1):Request queued for computation of DH secret
008720: Oct  1 19:04:10.956: IKEv2:(SA ID = 1):[IKEv2 -> Crypto Engine] Calculate SKEYSEED and create rekeyed IKEv2 SA
008721: Oct  1 19:04:10.956: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] SKEYSEED calculation and creation of rekeyed IKEv2 SA PASSED
008722: Oct  1 19:04:10.956: IKEv2:IKEv2 responder - no config data to send in IKE_SA_INIT exch
008723: Oct  1 19:04:10.960: IKEv2:(SESSION ID = 84,SA ID = 1):Generating IKE_SA_INIT message
008724: Oct  1 19:04:10.960: IKEv2:(SESSION ID = 84,SA ID = 1):IKE Proposal: 1, SPI size: 0 (initial negotiation), 
Num. transforms: 4
   AES-CBC   SHA256   SHA256   DH_GROUP_256_ECP/Group 19
008725: Oct  1 19:04:10.960: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Retrieve configured trustpoint(s)
008726: Oct  1 19:04:10.960: IKEv2:(SA ID = 1):[PKI -> IKEv2] Retrieved trustpoint(s): 'pki_crt_rtr.example.net'   'pki_ca_home'   
008727: Oct  1 19:04:10.960: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Get Public Key Hashes of trustpoints
008728: Oct  1 19:04:10.960: IKEv2:(SA ID = 1):[PKI -> IKEv2] Getting of Public Key Hashes of trustpoints PASSED 

008729: Oct  1 19:04:10.960: IKEv2:(SESSION ID = 84,SA ID = 1):Sending Packet [To CLIENT_PUBLIC_IP:20182/From RTR_PUBLIC_IP:500/VRF i0:f0] 
Initiator SPI : B0553C16D0F4AE75 - Responder SPI : 40124834C9DC3F39 Message id: 0
IKEv2 IKE_SA_INIT Exchange RESPONSE 
Payload contents: 
 SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP) CERTREQ 

008730: Oct  1 19:04:10.960: IKEv2:(SESSION ID = 84,SA ID = 1):Completed SA init exchange
008731: Oct  1 19:04:10.960: IKEv2:(SESSION ID = 84,SA ID = 1):Starting timer (30 sec) to wait for auth message 

008732: Oct  1 19:04:11.296: IKEv2:(SESSION ID = 84,SA ID = 1):Received Packet [From CLIENT_PUBLIC_IP:22052/To RTR_PUBLIC_IP:500/VRF i0:f0] 
Initiator SPI : B0553C16D0F4AE75 - Responder SPI : 40124834C9DC3F39 Message id: 1
IKEv2 IKE_AUTH Exchange REQUEST 
Payload contents: 
 IDi CERT NOTIFY(INITIAL_CONTACT) AUTH CFG NOTIFY(ESP_TFC_NO_SUPPORT) SA TSi TSr NOTIFY(Unknown - 16396) NOTIFY(Unknown - 16399) NOTIFY(Unknown - 16417) NOTIFY(Unknown - 16420) 

008733: Oct  1 19:04:11.300: IKEv2:(SESSION ID = 84,SA ID = 1):Stopping timer to wait for auth message
008734: Oct  1 19:04:11.300: IKEv2:(SESSION ID = 84,SA ID = 1):Checking NAT discovery
008735: Oct  1 19:04:11.304: IKEv2:(SESSION ID = 84,SA ID = 1):NAT OUTSIDE found
008736: Oct  1 19:04:11.304: IKEv2:(SESSION ID = 84,SA ID = 1):NAT detected float to init port 22052, resp port 4500
008737: Oct  1 19:04:11.304: IKEv2:(SESSION ID = 84,SA ID = 1):Searching policy based on peer's identity 'e=nicolas@example.net,cn=android-nicolas,ou=Private,o=Private,l=Brussels,st=Belgium,c=BE' of type 'DER ASN1 DN'
008738: Oct  1 19:04:11.308: IKEv2:Optional profile description not updated in PSH
008739: Oct  1 19:04:11.308: IKEv2:Searching Policy with fvrf 0, local address RTR_PUBLIC_IP
008740: Oct  1 19:04:11.308: IKEv2:Found Policy 'crp_ph1_policy'
008741: Oct  1 19:04:11.308: IKEv2:Found matching IKEv2 profile 'crp_ph1_profile'
008742: Oct  1 19:04:11.308: IKEv2:(SESSION ID = 84,SA ID = 1):Verify peer's policy
008743: Oct  1 19:04:11.308: IKEv2:(SESSION ID = 84,SA ID = 1):Peer's policy verified
008744: Oct  1 19:04:11.308: IKEv2:% Received cert hash is invalid, using configured trustpoints from profile for signing

008745: Oct  1 19:04:11.308: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Getting cert chain for the trustpoint pki_crt_rtr.example.net
008746: Oct  1 19:04:11.312: IKEv2:(SA ID = 1):[PKI -> IKEv2] Getting of cert chain for the trustpoint PASSED
008747: Oct  1 19:04:11.312: IKEv2:(SESSION ID = 84,SA ID = 1):Get peer's authentication method
008748: Oct  1 19:04:11.312: IKEv2:(SESSION ID = 84,SA ID = 1):Peer's authentication method is 'RSA'
008749: Oct  1 19:04:11.312: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Validating certificate chain
008750: Oct  1 19:04:11.328: IKEv2:(SA ID = 1):[PKI -> IKEv2] Validation of certificate chain PASSED
008751: Oct  1 19:04:11.328: IKEv2:(SESSION ID = 84,SA ID = 1):Save pubkey
008752: Oct  1 19:04:11.332: IKEv2:(SESSION ID = 84,SA ID = 1):Verify peer's authentication data
008753: Oct  1 19:04:11.332: IKEv2:[IKEv2 -> Crypto Engine] Generate IKEv2 authentication data
008754: Oct  1 19:04:11.332: IKEv2:[Crypto Engine -> IKEv2] IKEv2 authentication data generation PASSED
008755: Oct  1 19:04:11.332: IKEv2:(SA ID = 1):[IKEv2 -> Crypto Engine] Verify signed authenticaiton data
008756: Oct  1 19:04:11.344: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] Verification of signed authentication data PASSED
008757: Oct  1 19:04:11.344: IKEv2:(SESSION ID = 84,SA ID = 1):Processing INITIAL_CONTACT
008758: Oct  1 19:04:11.344: IKEv2:(SESSION ID = 84,SA ID = 1):Received valid config mode data
008759: Oct  1 19:04:11.344: IKEv2:Config data recieved:
008760: Oct  1 19:04:11.344: IKEv2:(SESSION ID = 84,SA ID = 1):Config-type: Config-request 
008761: Oct  1 19:04:11.344: IKEv2:(SESSION ID = 84,SA ID = 1):Error in settig received config mode data
008762: Oct  1 19:04:11.348: IKEv2:(SESSION ID = 84,SA ID = 1):Auth exchange failed
008763: Oct  1 19:04:11.348: IKEv2:(SESSION ID = 84,SA ID = 1):: Auth exchange failed
008764: Oct  1 19:04:11.348: IKEv2:(SESSION ID = 84,SA ID = 1):Abort exchange
008765: Oct  1 19:04:11.348: IKEv2:(SESSION ID = 84,SA ID = 1):Deleting SA
008766: Oct  1 19:04:11.348: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Close PKI Session
008767: Oct  1 19:04:11.348: IKEv2:(SA ID = 1):[PKI -> IKEv2] Closing of PKI Session PASSED
008768: Oct  1 19:04:13.372: IKEv2:Couldn't find matching SA: Detected an invalid IKE SPI 

008769: Oct  1 19:04:13.372: IKEv2:(SESSION ID = 0,SA ID = 0):Received Packet [From CLIENT_PUBLIC_IP:22052/To RTR_PUBLIC_IP:4500/VRF i0:f0] 
Initiator SPI : B0553C16D0F4AE75 - Responder SPI : 40124834C9DC3F39 Message id: 1
IKEv2 IKE_AUTH Exchange REQUEST
008770: Oct  1 19:04:13.372: IKEv2:: A supplied parameter is incorrect
008771: Oct  1 19:04:16.084: IKEv2:Couldn't find matching SA: Detected an invalid IKE SPI 

008772: Oct  1 19:04:16.084: IKEv2:(SESSION ID = 0,SA ID = 0):Received Packet [From CLIENT_PUBLIC_IP:22052/To RTR_PUBLIC_IP:4500/VRF i0:f0] 
Initiator SPI : B0553C16D0F4AE75 - Responder SPI : 40124834C9DC3F39 Message id: 1
IKEv2 IKE_AUTH Exchange REQUEST
008773: Oct  1 19:04:16.088: IKEv2:: A supplied parameter is incorrect
008774: Oct  1 19:04:20.096: IKEv2:Couldn't find matching SA: Detected an invalid IKE SPI 

008775: Oct  1 19:04:20.100: IKEv2:(SESSION ID = 0,SA ID = 0):Received Packet [From CLIENT_PUBLIC_IP:22052/To RTR_PUBLIC_IP:4500/VRF i0:f0] 
Initiator SPI : B0553C16D0F4AE75 - Responder SPI : 40124834C9DC3F39 Message id: 1
IKEv2 IKE_AUTH Exchange REQUEST
008776: Oct  1 19:04:20.100: IKEv2:: A supplied parameter is incorrect 

008777: Oct  1 19:04:25.524: IKEv2:Received Packet [From CLIENT_PUBLIC_IP:20182/To RTR_PUBLIC_IP:500/VRF i0:f0] 
Initiator SPI : 3B6C85C9F0377B8C - Responder SPI : 0000000000000000 Message id: 0
IKEv2 IKE_SA_INIT Exchange REQUEST 
Payload contents: 
 SA KE N NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP) NOTIFY(Unknown - 16430) NOTIFY(Unknown - 16431) NOTIFY(REDIRECT_SUPPORTED) 

008778: Oct  1 19:04:25.524: IKEv2:(SESSION ID = 85,SA ID = 1):Verify SA init message
008779: Oct  1 19:04:25.528: IKEv2:(SESSION ID = 85,SA ID = 1):Insert SA
008780: Oct  1 19:04:25.528: IKEv2:Searching Policy with fvrf 0, local address RTR_PUBLIC_IP
008781: Oct  1 19:04:25.528: IKEv2:Found Policy 'crp_ph1_policy'
008782: Oct  1 19:04:25.528: IKEv2:(SESSION ID = 85,SA ID = 1):Processing IKE_SA_INIT message
008783: Oct  1 19:04:25.528: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Retrieve configured trustpoint(s)
008784: Oct  1 19:04:25.528: IKEv2:(SA ID = 1):[PKI -> IKEv2] Retrieved trustpoint(s): 'pki_crt_rtr.example.net'   'pki_ca_home'   
008785: Oct  1 19:04:25.528: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Get Public Key Hashes of trustpoints
008786: Oct  1 19:04:25.528: IKEv2:(SA ID = 1):[PKI -> IKEv2] Getting of Public Key Hashes of trustpoints PASSED
008787: Oct  1 19:04:25.528: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Start PKI Session
008788: Oct  1 19:04:25.528: IKEv2:(SA ID = 1):[PKI -> IKEv2] Starting of PKI Session PASSED
008789: Oct  1 19:04:25.528: IKEv2:(SESSION ID = 85,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH public key, DH Group 19
008790: Oct  1 19:04:25.528: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED
008791: Oct  1 19:04:25.528: IKEv2:(SESSION ID = 85,SA ID = 1):Request queued for computation of DH key
008792: Oct  1 19:04:25.528: IKEv2:(SESSION ID = 85,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH secret key, DH Group 19
008793: Oct  1 19:04:25.560: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED
008794: Oct  1 19:04:25.560: IKEv2:(SESSION ID = 85,SA ID = 1):Request queued for computation of DH secret
008795: Oct  1 19:04:25.560: IKEv2:(SA ID = 1):[IKEv2 -> Crypto Engine] Calculate SKEYSEED and create rekeyed IKEv2 SA
008796: Oct  1 19:04:25.560: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] SKEYSEED calculation and creation of rekeyed IKEv2 SA PASSED
008797: Oct  1 19:04:25.560: IKEv2:IKEv2 responder - no config data to send in IKE_SA_INIT exch
008798: Oct  1 19:04:25.560: IKEv2:(SESSION ID = 85,SA ID = 1):Generating IKE_SA_INIT message
008799: Oct  1 19:04:25.560: IKEv2:(SESSION ID = 85,SA ID = 1):IKE Proposal: 1, SPI size: 0 (initial negotiation), 
Num. transforms: 4
   AES-CBC   SHA256   SHA256   DH_GROUP_256_ECP/Group 19
008800: Oct  1 19:04:25.564: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Retrieve configured trustpoint(s)
008801: Oct  1 19:04:25.564: IKEv2:(SA ID = 1):[PKI -> IKEv2] Retrieved trustpoint(s): 'pki_crt_rtr.example.net'   'pki_ca_home'   
008802: Oct  1 19:04:25.564: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Get Public Key Hashes of trustpoints
008803: Oct  1 19:04:25.564: IKEv2:(SA ID = 1):[PKI -> IKEv2] Getting of Public Key Hashes of trustpoints PASSED 

008804: Oct  1 19:04:25.564: IKEv2:(SESSION ID = 85,SA ID = 1):Sending Packet [To CLIENT_PUBLIC_IP:20182/From RTR_PUBLIC_IP:500/VRF i0:f0] 
Initiator SPI : 3B6C85C9F0377B8C - Responder SPI : 2ECCC038024F1EB5 Message id: 0
IKEv2 IKE_SA_INIT Exchange RESPONSE 
Payload contents: 
 SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP) CERTREQ 

008805: Oct  1 19:04:25.564: IKEv2:(SESSION ID = 85,SA ID = 1):Completed SA init exchange
008806: Oct  1 19:04:25.564: IKEv2:(SESSION ID = 85,SA ID = 1):Starting timer (30 sec) to wait for auth message
008807: Oct  1 19:04:45 CEST: %SEC-6-IPACCESSLOGP: list acl4_in_users denied udp 192.168.11.6(1024) -> 81.14.202.21(123), 11 packets  
008808: Oct  1 19:04:55.564: IKEv2:(SESSION ID = 85,SA ID = 1):: Failed to receive the AUTH msg before the timer expired
008809: Oct  1 19:04:55.564: IKEv2:(SESSION ID = 85,SA ID = 1):Auth exchange failed
008810: Oct  1 19:04:55.564: IKEv2:(SESSION ID = 85,SA ID = 1):: Auth exchange failed
008811: Oct  1 19:04:55.564: IKEv2:(SESSION ID = 85,SA ID = 1):Abort exchange
008812: Oct  1 19:04:55.564: IKEv2:(SESSION ID = 85,SA ID = 1):Deleting SA
008813: Oct  1 19:04:55.564: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Close PKI Session
008814: Oct  1 19:04:55.564: IKEv2:(SA ID = 1):[PKI -> IKEv2] Closing of PKI Session PASSED

Client log:

Oct  1 20:04:01 00[DMN] Starting IKE charon daemon (strongSwan 5.6.0, Android 7.0 - NRD90M.A510FXXU4CQDL/2017-04-01, SM-A510F - samsung/a5xeltexx/samsung, Linux 3.10.61-11234767, armv8l)
Oct  1 20:04:01 00[LIB] loaded plugins: androidbridge charon android-log openssl fips-prf random nonce pubkey chapoly curve25519 pkcs1 pkcs8 pem xcbc hmac socket-default revocation eap-identity eap-mschapv2 eap-md5 eap-gtc eap-tls x509
Oct  1 20:04:01 00[JOB] spawning 16 worker threads
Oct  1 20:04:01 07[CFG] loaded user certificate 'C=BE, ST=Belgium, L=Brussels, O=Private, OU=Private, CN=android-nicolas, E=nicolas@example.net' and private key
Oct  1 20:04:01 07[CFG] loaded CA certificate 'C=BE, ST=Belgium, L=Brussels, O=Private, OU=Private, CN=proxy.example.net, E=admin@example.net'
Oct  1 20:04:01 07[IKE] initiating IKE_SA android[25] to RTR_PUBLIC_IP
Oct  1 20:04:01 07[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Oct  1 20:04:01 07[NET] sending packet: from 10.200.240.151[46025] to RTR_PUBLIC_IP[500] (746 bytes)
Oct  1 20:04:02 09[NET] received packet: from RTR_PUBLIC_IP[500] to 10.200.240.151[46025] (297 bytes)
Oct  1 20:04:02 09[ENC] parsed IKE_SA_INIT response 0 [ SA KE No V V N(NATD_S_IP) N(NATD_D_IP) CERTREQ ]
Oct  1 20:04:02 09[IKE] received Cisco Delete Reason vendor ID
Oct  1 20:04:02 09[ENC] received unknown vendor ID: 46:4c:45:58:56:50:4e:2d:53:55:50:50:4f:52:54:45:44
Oct  1 20:04:02 09[IKE] local host is behind NAT, sending keep alives
Oct  1 20:04:02 09[IKE] received cert request for "C=BE, ST=Belgium, L=Brussels, O=Private, OU=Private, CN=proxy.example.net, E=admin@example.net"
Oct  1 20:04:02 09[IKE] authentication of 'C=BE, ST=Belgium, L=Brussels, O=Private, OU=Private, CN=android-nicolas, E=nicolas@example.net' (myself) with RSA signature successful
Oct  1 20:04:02 09[IKE] sending end entity cert "C=BE, ST=Belgium, L=Brussels, O=Private, OU=Private, CN=android-nicolas, E=nicolas@example.net"
Oct  1 20:04:02 09[IKE] establishing CHILD_SA android{28}
Oct  1 20:04:02 09[ENC] generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) AUTH CPRQ(ADDR ADDR6 DNS DNS6) N(ESP_TFC_PAD_N) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
Oct  1 20:04:02 09[NET] sending packet: from 10.200.240.151[35037] to RTR_PUBLIC_IP[4500] (1872 bytes)
Oct  1 20:04:04 11[IKE] retransmit 1 of request with message ID 1
Oct  1 20:04:04 11[NET] sending packet: from 10.200.240.151[35037] to RTR_PUBLIC_IP[4500] (1872 bytes)
Oct  1 20:04:07 12[IKE] retransmit 2 of request with message ID 1
Oct  1 20:04:07 12[NET] sending packet: from 10.200.240.151[35037] to RTR_PUBLIC_IP[4500] (1872 bytes)
Oct  1 20:04:11 13[IKE] retransmit 3 of request with message ID 1
Oct  1 20:04:11 13[NET] sending packet: from 10.200.240.151[35037] to RTR_PUBLIC_IP[4500] (1872 bytes)
Oct  1 20:04:16 14[IKE] giving up after 3 retransmits
Oct  1 20:04:16 14[IKE] peer not responding, trying again (2/0)
Oct  1 20:04:16 14[IKE] initiating IKE_SA android[25] to RTR_PUBLIC_IP
Oct  1 20:04:16 14[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Oct  1 20:04:16 14[NET] sending packet: from 10.200.240.151[46025] to RTR_PUBLIC_IP[500] (746 bytes)
Oct  1 20:04:16 16[IKE] destroying IKE_SA in state CONNECTING without notification
  • Could be an IP fragmentation issue (the IKE_AUTH request by the client is quite large so it will get fragmented, if these fragments are dropped by a firewall/router on the way, the responder will never see that request). If IOS supports IKEv2 fragmentation try enabling it (the Android client already has it enabled). – ecdsa Oct 2 '17 at 7:37
  • @ecdsa I'v set crypto ikev2 frag mtu 1280 on the IOS head end device but I still have the same errors. – Nicolas Oct 2 '17 at 17:38
  • Could you update the logs? The IKE_SA_INIT response should show a FRAG_SUP notify in the strongSwan log and large messages should subsequently get fragmented. – ecdsa Oct 4 '17 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.