The setup is two gateways with IPsec channels setup in tunnel mode to bridge networks 10.255.255.0/24 and 10.254.255.0/24. Traffic from server-east:enc0 does not match a SA in place when trying to connect to httpd on server-west.
Setup in ASCII art: em0:203.0.113.50 -~-~- ipsec tunnel -~-~-~- vio0:100.64.1.92 | SERVER-WEST | | SERVER-EAST | enc0:10.255.255.1/24 enc0:10.254.255.1/24 When traffic sources from 10.254.255.1 to server-west's httpd, the initial SYN goes out 100.64.1.92 and does not match the ipsec SA in place: flow esp out from 10.254.255.0/24 to 10.255.255.0/24 peer 203.0.113.50 srcid FQDN/server-east.example.com dstid FQDN/server-west.example.com type require However, return traffic on server-west matches an SA already in place and is sent back over the tunnel to server-east. Here is a pcap from server-west showing the initial connection; the second packet is the response from server-west to server-east over the tunnel, etc. 11:15:07.595477 100.64.1.92.53545 > 203.0.113.50.80: SWE 466527235:466527235(0) win 16384 <mss 1460,nop,nop,sackOK,nop,wscale 6,nop,nop,timestamp 3005156378 0> (DF) 11:15:07.641673 203.0.113.50 > 100.64.1.92: esp spi 0x5787a1ca seq 1 len 80 (DF) 11:15:07.641901 100.64.1.92 > 203.0.113.50: esp spi 0x9a987eb3 seq 1 len 76 11:15:11.959583 100.64.1.92.63317 > 203.0.113.50.80: SWE 321626718:321626718(0) win 16384 <mss 1460,nop,nop,sackOK,nop,wscale 6,nop,nop,timestamp 891794631 0> (DF) 11:15:12.005730 203.0.113.50 > 100.64.1.92: esp spi 0x5787a1ca seq 2 len 80 (DF) The SA being match on server-west is: esp tunnel from 203.0.113.50 to 100.64.1.92 spi 0x5787a1ca enc aes-256-gcm Is something missing in my configs or does anything look obviously broken? Many thanks in advance for any help. PF RULES ======== # server-west pf match in all scrub (no-df random-id max-mss 1440) match out on em0 inet from 10.255.255.0/24 to any nat-to (em0) round-robin block drop in log on ! em0 inet from 203.0.113.48/30 to any block drop log all pass out proto tcp all modulate state pass out proto udp from any to any port = 500 pass out proto udp from any to any port = 4500 pass out proto esp all pass out proto ah all pass out all modulate state block drop in log from urpf-failed to any label "uRPF" block drop in log from no-route to any pass in proto udp from any to 203.0.113.50 port = 500 keep state pass in proto udp from any to 203.0.113.50 port = 4500 keep state pass in proto esp from any to 203.0.113.50 pass in proto ah from any to 203.0.113.50 pass in inet proto tcp from any to 203.0.113.50 port = 80 flags S/SA synproxy state (source-track rule, max-src-conn 256, max-src-conn-rate 40/2, overload <abusive> flush, src.track 2) pass in inet proto tcp from 100.64.1.92 to 203.0.113.50 port = 5201 flags S/SA # server-east pf match in all scrub (no-df random-id max-mss 1440) match out on vio0 inet from 10.254.255.0/24 to any nat-to (vio0) round-robin block drop in log on ! vio0 inet from 100.64.0.0/23 to any block drop log all pass out proto tcp all modulate state pass out proto udp from any to any port = 500 pass out proto udp from any to any port = 4500 pass out proto esp all pass out proto ah all pass out all modulate state block drop in log from urpf-failed to any label "uRPF" block drop in log from no-route to any pass in inet proto udp from any to 100.64.1.92 port = 500 keep state pass in inet proto udp from any to 100.64.1.92 port = 4500 keep state pass in inet proto esp from any to 100.64.1.92 pass in inet proto ah from any to 100.64.1.92 pass on enc0 all flags S/SA modulate state (if-bound) tagged VPN.SERVER-WEST pass on enc0 all flags S/SA modulate state (if-bound) pass in inet proto tcp from any to 100.64.1.92 port = 80 flags S/SA synproxy state (source-track rule, max-src-conn 256, max-src-conn-rate 40/2, overload <abusive> flush, src.track 2) pass in inet proto tcp from 203.0.113.50 to 100.64.1.92 port = 5201 flags S/SA IPSEC FLOWS =========== # server-west flows FLOWS: flow esp in from 10.254.255.0/24 to 10.255.255.0/24 peer 100.64.1.92 srcid FQDN/server-west.example.com dstid FQDN/server-east.example.com type require flow esp in from 100.64.1.92 to 203.0.113.50 peer 100.64.1.92 srcid FQDN/server-west.example.com dstid FQDN/server-east.example.com type require flow esp out from 10.255.255.0/24 to 10.254.255.0/24 peer 100.64.1.92 srcid FQDN/server-west.example.com dstid FQDN/server-east.example.com type require flow esp out from 203.0.113.50 to 100.64.1.92 peer 100.64.1.92 srcid FQDN/server-west.example.com dstid FQDN/server-east.example.com type require SAD: esp tunnel from 203.0.113.50 to 100.64.1.92 spi 0x5787a1ca enc aes-256-gcm esp tunnel from 100.64.1.92 to 203.0.113.50 spi 0x9a987eb3 enc aes-256-gcm # server-east flows FLOWS: flow esp in from 10.255.255.0/24 to 10.254.255.0/24 peer 203.0.113.50 srcid FQDN/server-east.example.com dstid FQDN/server-west.example.com type require flow esp in from 203.0.113.50 to 100.64.1.92 peer 203.0.113.50 srcid FQDN/server-east.example.com dstid FQDN/server-west.example.com type require flow esp out from 10.254.255.0/24 to 10.255.255.0/24 peer 203.0.113.50 srcid FQDN/server-east.example.com dstid FQDN/server-west.example.com type require flow esp out from 100.64.1.92 to 203.0.113.50 peer 203.0.113.50 srcid FQDN/server-east.example.com dstid FQDN/server-west.example.com type require SAD: esp tunnel from 203.0.113.50 to 100.64.1.92 spi 0x5787a1ca enc aes-256-gcm esp tunnel from 100.64.1.92 to 203.0.113.50 spi 0x9a987eb3 enc aes-256-gcm IKED OUTPUT =========== # server-west `iked -dvv` create_ike: using unknown for peer server-east.example.com ikev2 "SERVER-EAST_INET4_NETS" active tunnel esp inet from 10.255.255.0/24 to 10.254.255.0/24 from 203.0.113.50 to 100.64.1.92 local 203.0.113.50 peer 100.64.1.92 ikesa enc aes-256-gcm-12 prf hmac-sha2-512 group ecp521 childsa enc aes-256-gcm group ecp521 esn noesn srcid server-west.example.com dstid server-east.example.com lifetime 14400 bytes 4294967296 psk 0x4935535056446657336c2f4643625779364c7075414b764f526a4146545a763332562b79787058657a78454e314d6b34737a6c53434b3863522f3564686b68486443534369445145694d6a756b6f646153654f594c766755427479664c495550 tag "VPN.ORD" /etc/iked.conf: loaded 1 configuration rules ca_privkey_serialize: type RSA_KEY length 1192 ca_pubkey_serialize: type RSA_KEY length 270 ca_privkey_to_method: type RSA_KEY method RSA_SIG ca_getkey: received private key type RSA_KEY length 1192 ca_getkey: received public key type RSA_KEY length 270 ca_dispatch_parent: config reset ca_reload: loaded cert file server-west.example.com.crt ca_validate_cert: /C=XX/ST=XXXXXXX/L=XXXXX/O=ANYORG/OU=NA/CN=server-west.example.com/emailAddress=r...@example.com unable to get local issuer certificate ca_reload: local cert type RSA_KEY config_getocsp: ocsp_url none tolerate 0 maxage -1 ikev2_dispatch_cert: updated local CERTREQ type RSA_KEY length 0 config_getpolicy: received policy config_getpfkey: received pfkey fd 3 config_getcompile: compilation done config_getsocket: received socket fd 4 config_getsocket: received socket fd 5 config_getsocket: received socket fd 6 config_getsocket: received socket fd 7 config_getstatic: dpd_check_interval 60 config_getstatic: no enforcesingleikesa config_getstatic: no fragmentation config_getstatic: mobike config_getstatic: nattport 4500 config_getstatic: no stickyaddress policy_lookup: setting policy 'SERVER-EAST_INET4_NETS' spi=0x128173a042dfdc03: recv IKE_SA_INIT req 0 peer 100.64.1.92:500 local 203.0.113.50:500, 314 bytes, policy 'SERVER-EAST_INET4_NETS' ikev2_recv: ispi 0x128173a042dfdc03 rspi 0x0000000000000000 ikev2_policy2id: srcid FQDN/server-west.example.com length 23 ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x0000000000000000 nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x08 msgid 0 length 314 response 0 ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 40 ikev2_pld_sa: more 0 reserved 0 length 36 proposal #1 protoid IKE spisize 0 xforms 3 spi 0 ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12 ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_521 ikev2_pld_xform: more 0 reserved 0 length 8 type PRF id HMAC_SHA2_512 ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 140 ikev2_pld_ke: dh group ECP_521 reserved 0 ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00 length 36 ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP ikev2_nat_detection: peer source 0x128173a042dfdc03 0x0000000000000000 100.64.1.92:500 ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_DESTINATION_IP ikev2_nat_detection: peer destination 0x128173a042dfdc03 0x0000000000000000 203.0.113.50:500 ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length 14 ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS ikev2_pld_notify: signature hash SHA2_256 (2) ikev2_pld_notify: signature hash SHA2_384 (3) ikev2_pld_notify: signature hash SHA2_512 (4) proposals_negotiate: score 3 policy_lookup: setting policy 'SERVER-EAST_INET4_NETS' spi=0x128173a042dfdc03: sa_state: INIT -> SA_INIT proposals_negotiate: score 3 sa_stateok: SA_INIT flags 0x0000, require 0x0000 sa_stateflags: 0x0000 -> 0x0020 sa (required 0x0000 ) spi=0x128173a042dfdc03: ikev2_sa_keys: DHSECRET with 66 bytes ikev2_sa_keys: SKEYSEED with 64 bytes spi=0x128173a042dfdc03: ikev2_sa_keys: S with 80 bytes ikev2_prfplus: T1 with 64 bytes ikev2_prfplus: T2 with 64 bytes ikev2_prfplus: T3 with 64 bytes ikev2_prfplus: T4 with 64 bytes ikev2_prfplus: T5 with 64 bytes ikev2_prfplus: Tn with 320 bytes ikev2_sa_keys: SK_d with 64 bytes ikev2_sa_keys: SK_ei with 36 bytes ikev2_sa_keys: SK_er with 36 bytes ikev2_sa_keys: SK_pi with 64 bytes ikev2_sa_keys: SK_pr with 64 bytes ikev2_add_proposals: length 36 ikev2_next_payload: length 40 nextpayload KE ikev2_next_payload: length 140 nextpayload NONCE ikev2_next_payload: length 36 nextpayload NOTIFY ikev2_nat_detection: local source 0x128173a042dfdc03 0x22c5f5ccef9637bf 203.0.113.50:500 ikev2_next_payload: length 28 nextpayload NOTIFY ikev2_nat_detection: local destination 0x128173a042dfdc03 0x22c5f5ccef9637bf 100.64.1.92:500 ikev2_next_payload: length 28 nextpayload NOTIFY ikev2_next_payload: length 14 nextpayload NONE ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x20 msgid 0 length 314 response 1 ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 40 ikev2_pld_sa: more 0 reserved 0 length 36 proposal #1 protoid IKE spisize 0 xforms 3 spi 0 ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12 ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_512 ikev2_pld_xform: more 0 reserved 0 length 8 type DH id ECP_521 ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 140 ikev2_pld_ke: dh group ECP_521 reserved 0 ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00 length 36 ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_DESTINATION_IP ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length 14 ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS spi=0x128173a042dfdc03: send IKE_SA_INIT res 0 peer 100.64.1.92:500 local 203.0.113.50:500, 314 bytes config_free_proposals: free 0xbfa96fa9580 spi=0x128173a042dfdc03: recv IKE_AUTH req 1 peer 100.64.1.92:500 local 203.0.113.50:500, 276 bytes, policy 'SERVER-EAST_INET4_NETS' ikev2_recv: ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf ikev2_recv: updated SA to peer 100.64.1.92:500 local 203.0.113.50:500 ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf nextpayload SK version 0x20 exchange IKE_AUTH flags 0x08 msgid 1 length 276 response 0 ikev2_pld_payloads: payload SK nextpayload IDi critical 0x00 length 248 ikev2_msg_decrypt: IV length 8 ikev2_msg_decrypt: encrypted payload length 224 ikev2_msg_decrypt: integrity checksum length 12 ikev2_msg_decrypt: AAD length 32 ikev2_msg_decrypt: decrypted payload length 224/224 padding 0 ikev2_pld_payloads: decrypted payload IDi nextpayload AUTH critical 0x00 length 27 ikev2_pld_id: id FQDN/server-east.example.com length 23 ikev2_pld_payloads: decrypted payload AUTH nextpayload SA critical 0x00 length 72 ikev2_pld_auth: method SHARED_KEY_MIC length 64 ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00 length 44 ikev2_pld_sa: more 0 reserved 0 length 40 proposal #1 protoid ESP spisize 4 xforms 3 spi 0x5787a1ca ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_16 ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 ikev2_pld_xform: more 3 reserved 0 length 8 type ESN id ESN ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id NONE ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00 length 40 ikev2_pld_tss: count 2 length 32 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 10.254.255.0 end 10.254.255.255 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 100.64.1.92 end 100.64.1.92 ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00 length 40 ikev2_pld_tss: count 2 length 32 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 10.255.255.0 end 10.255.255.255 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 203.0.113.50 end 203.0.113.50 sa_stateok: SA_INIT flags 0x0000, require 0x0000 spi=0x128173a042dfdc03: sa_state: SA_INIT -> AUTH_REQUEST policy_lookup: peerid 'server-east.example.com' proposals_negotiate: score 3 policy_lookup: setting policy 'SERVER-EAST_INET4_NETS' ikev2_msg_auth: responder auth data length 410 proposals_negotiate: score 2 sa_stateflags: 0x0028 -> 0x0028 auth,sa (required 0x0038 auth,authvalid,sa) ikev2_msg_auth: initiator auth data length 410 ikev2_msg_authverify: method SHARED_KEY_MIC keylen 64 type NONE ikev2_msg_authverify: authentication successful spi=0x128173a042dfdc03: sa_state: AUTH_REQUEST -> AUTH_SUCCESS sa_stateflags: 0x0028 -> 0x0038 auth,authvalid,sa (required 0x0038 auth,authvalid,sa) sa_stateok: VALID flags 0x0038, require 0x0038 auth,authvalid,sa spi=0x128173a042dfdc03: sa_state: AUTH_SUCCESS -> VALID sa_stateok: VALID flags 0x0038, require 0x0038 auth,authvalid,sa sa_stateok: VALID flags 0x0038, require 0x0038 auth,authvalid,sa ikev2_sa_tag: VPN.ORD (7) ikev2_childsa_negotiate: proposal 1 ikev2_childsa_negotiate: key material length 72 ikev2_prfplus: T1 with 64 bytes ikev2_prfplus: T2 with 64 bytes ikev2_prfplus: Tn with 128 bytes pfkey_sa_getspi: spi 0x9a987eb3 pfkey_sa_init: new spi 0x9a987eb3 ikev2_next_payload: length 27 nextpayload AUTH ikev2_next_payload: length 72 nextpayload SA ikev2_add_proposals: length 32 ikev2_next_payload: length 36 nextpayload TSi ikev2_next_payload: length 40 nextpayload TSr ikev2_next_payload: length 40 nextpayload NONE ikev2_next_payload: length 240 nextpayload IDr ikev2_msg_encrypt: decrypted length 215 ikev2_msg_encrypt: padded length 216 ikev2_msg_encrypt: length 216, padding 0, output length 236 ikev2_msg_integr: message length 268 ikev2_msg_integr: integrity checksum length 12 ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf nextpayload SK version 0x20 exchange IKE_AUTH flags 0x20 msgid 1 length 268 response 1 ikev2_pld_payloads: payload SK nextpayload IDr critical 0x00 length 240 ikev2_msg_decrypt: IV length 8 ikev2_msg_decrypt: encrypted payload length 216 ikev2_msg_decrypt: integrity checksum length 12 ikev2_msg_decrypt: AAD length 32 ikev2_msg_decrypt: decrypted payload length 216/216 padding 0 ikev2_pld_payloads: decrypted payload IDr nextpayload AUTH critical 0x00 length 27 ikev2_pld_id: id FQDN/server-west.example.com length 23 ikev2_pld_payloads: decrypted payload AUTH nextpayload SA critical 0x00 length 72 ikev2_pld_auth: method SHARED_KEY_MIC length 64 ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00 length 36 ikev2_pld_sa: more 0 reserved 0 length 32 proposal #1 protoid ESP spisize 4 xforms 2 spi 0x9a987eb3 ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_16 ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id ESN ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00 length 40 ikev2_pld_tss: count 2 length 32 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 10.254.255.0 end 10.254.255.255 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 100.64.1.92 end 100.64.1.92 ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00 length 40 ikev2_pld_tss: count 2 length 32 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 10.255.255.0 end 10.255.255.255 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 203.0.113.50 end 203.0.113.50 spi=0x128173a042dfdc03: send IKE_AUTH res 1 peer 100.64.1.92:500 local 203.0.113.50:500, 268 bytes pfkey_sa_add: update spi 0x9a987eb3 ikev2_childsa_enable: loaded CHILD SA spi 0x9a987eb3 pfkey_sa_add: add spi 0x5787a1ca ikev2_childsa_enable: loaded CHILD SA spi 0x5787a1ca ikev2_childsa_enable: loaded flow 0xbfa96fb1800 ikev2_childsa_enable: loaded flow 0xbfa96fc1c00 ikev2_childsa_enable: loaded flow 0xbfa96fb3c00 ikev2_childsa_enable: loaded flow 0xbfa96fc1000 ikev2_childsa_enable: remember SA peer 100.64.1.92:500 spi=0x128173a042dfdc03: ikev2_childsa_enable: loaded SPIs: 0x9a987eb3, 0x5787a1ca (enc aes-256-gcm esn) spi=0x128173a042dfdc03: ikev2_childsa_enable: loaded flows: ESP-10.255.255.0/24=10.254.255.0/24(0), ESP-203.0.113.50/32=100.64.1.92/32(0) spi=0x128173a042dfdc03: sa_state: VALID -> ESTABLISHED from 100.64.1.92:500 to 203.0.113.50:500 policy 'SERVER-EAST_INET4_NETS' spi=0x128173a042dfdc03: established peer 100.64.1.92:500[FQDN/server-east.example.com] local 203.0.113.50:500[FQDN/server-west.example.com] policy 'SERVER-EAST_INET4_NETS' as responder (enc aes-256-gcm-12 group ecp521 prf hmac-sha2-512) config_free_proposals: free 0xbfa96fa9a00 ikev2_init_ike_sa: "SERVER-EAST_INET4_NETS" is already active config_doreset: flushing policies config_doreset: flushing SAs config_free_proposals: free 0xbfa96fd5180 config_free_proposals: free 0xbfa96fd9200 config_free_childsas: free 0xbfa96fa0600 config_free_childsas: free 0xbfa96fa1800 sa_free_flows: free 0xbfa96fb1800 sa_free_flows: free 0xbfa96fc1c00 sa_free_flows: free 0xbfa96fb3c00 sa_free_flows: free 0xbfa96fc1000 config_free_proposals: free 0xbfa96fa9600 config_free_proposals: free 0xbfa96fa9080 config_free_flows: free 0xbfa96fd7400 config_free_flows: free 0xbfa96fd7000 ca exiting, pid 22311 control exiting, pid 78978 config_doreset: flushing users ikev2 exiting, pid 37133 parent terminating # server-east `iked -dvv` create_ike: using unknown for peer server-west.example.com ikev2 "SERVER-WEST_INET4_NETS" active tunnel esp inet from 10.254.255.0/24 to 10.255.255.0/24 from 100.64.1.92 to 203.0.113.50 local 100.64.1.92 peer 203.0.113.50 ikesa enc aes-256-gcm-12 prf hmac-sha2-512 group ecp521 childsa enc aes-256-gcm group ecp521 esn noesn srcid server-east.example.com dstid SERVER-WEST.example.com lifetime 14400 bytes 4294967296 psk 0x4935535056446657336c2f4643625779364c7075414b764f526a4146545a763332562b79787058657a78454e314d6b34737a6c53434b3863522f3564686b68486443534369445145694d6a756b6f646153654f594c766755427479664c495550 tag "VPN.SERVER-WEST" /etc/iked.conf: loaded 1 configuration rules ca_privkey_serialize: type RSA_KEY length 1191 ca_pubkey_serialize: type RSA_KEY length 270 ca_privkey_to_method: type RSA_KEY method RSA_SIG ca_getkey: received private key type RSA_KEY length 1191 ca_getkey: received public key type RSA_KEY length 270 ca_dispatch_parent: config reset ca_reload: local cert type RSA_KEY config_getocsp: ocsp_url none tolerate 0 maxage -1 ikev2_dispatch_cert: updated local CERTREQ type RSA_KEY length 0 config_getpolicy: received policy config_getpfkey: received pfkey fd 3 config_getcompile: compilation done config_getsocket: received socket fd 4 config_getsocket: received socket fd 5 config_getsocket: received socket fd 6 config_getsocket: received socket fd 7 config_getstatic: dpd_check_interval 60 config_getstatic: no enforcesingleikesa config_getstatic: no fragmentation config_getstatic: mobike config_getstatic: nattport 4500 config_getstatic: no stickyaddress ikev2_init_ike_sa: initiating "SERVER-WEST_INET4_NETS" ikev2_policy2id: srcid FQDN/server-east.example.com length 23 ikev2_add_proposals: length 36 ikev2_next_payload: length 40 nextpayload KE ikev2_next_payload: length 140 nextpayload NONCE ikev2_next_payload: length 36 nextpayload NOTIFY ikev2_nat_detection: local source 0x128173a042dfdc03 0x0000000000000000 100.64.1.92:500 ikev2_next_payload: length 28 nextpayload NOTIFY ikev2_nat_detection: local destination 0x128173a042dfdc03 0x0000000000000000 203.0.113.50:500 ikev2_next_payload: length 28 nextpayload NOTIFY ikev2_next_payload: length 14 nextpayload NONE ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x0000000000000000 nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x08 msgid 0 length 314 response 0 ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 40 ikev2_pld_sa: more 0 reserved 0 length 36 proposal #1 protoid IKE spisize 0 xforms 3 spi 0 ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12 ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_521 ikev2_pld_xform: more 0 reserved 0 length 8 type PRF id HMAC_SHA2_512 ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 140 ikev2_pld_ke: dh group ECP_521 reserved 0 ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00 length 36 ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_DESTINATION_IP ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length 14 ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS spi=0x128173a042dfdc03: send IKE_SA_INIT req 0 peer 203.0.113.50:500 local 100.64.1.92:500, 314 bytes spi=0x128173a042dfdc03: sa_state: INIT -> SA_INIT spi=0x128173a042dfdc03: retransmit 1 IKE_SA_INIT req 0 peer 203.0.113.50:500 local 100.64.1.92:500 spi=0x128173a042dfdc03: retransmit 2 IKE_SA_INIT req 0 peer 203.0.113.50:500 local 100.64.1.92:500 spi=0x128173a042dfdc03: recv IKE_SA_INIT res 0 peer 203.0.113.50:500 local 100.64.1.92:500, 314 bytes, policy 'SERVER-WEST_INET4_NETS' ikev2_recv: ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf ikev2_recv: updated SA to peer 203.0.113.50:500 local 100.64.1.92:500 ikev2_policy2id: srcid FQDN/server-east.example.com length 23 ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x20 msgid 0 length 314 response 1 ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 40 ikev2_pld_sa: more 0 reserved 0 length 36 proposal #1 protoid IKE spisize 0 xforms 3 spi 0 ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12 ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_512 ikev2_pld_xform: more 0 reserved 0 length 8 type DH id ECP_521 ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 140 ikev2_pld_ke: dh group ECP_521 reserved 0 ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00 length 36 ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP ikev2_nat_detection: peer source 0x128173a042dfdc03 0x22c5f5ccef9637bf 203.0.113.50:500 ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00 length 28 ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_DESTINATION_IP ikev2_nat_detection: peer destination 0x128173a042dfdc03 0x22c5f5ccef9637bf 100.64.1.92:500 ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length 14 ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS ikev2_pld_notify: signature hash SHA2_256 (2) ikev2_pld_notify: signature hash SHA2_384 (3) ikev2_pld_notify: signature hash SHA2_512 (4) proposals_negotiate: score 3 sa_stateok: SA_INIT flags 0x0000, require 0x0008 auth spi=0x128173a042dfdc03: ikev2_sa_keys: DHSECRET with 66 bytes ikev2_sa_keys: SKEYSEED with 64 bytes spi=0x128173a042dfdc03: ikev2_sa_keys: S with 80 bytes ikev2_prfplus: T1 with 64 bytes ikev2_prfplus: T2 with 64 bytes ikev2_prfplus: T3 with 64 bytes ikev2_prfplus: T4 with 64 bytes ikev2_prfplus: T5 with 64 bytes ikev2_prfplus: Tn with 320 bytes ikev2_sa_keys: SK_d with 64 bytes ikev2_sa_keys: SK_ei with 36 bytes ikev2_sa_keys: SK_er with 36 bytes ikev2_sa_keys: SK_pi with 64 bytes ikev2_sa_keys: SK_pr with 64 bytes ikev2_msg_auth: initiator auth data length 410 sa_stateok: SA_INIT flags 0x0008, require 0x0008 auth ikev2_next_payload: length 27 nextpayload AUTH spi=0x128173a042dfdc03: ikev2_cp_request_configured: no ikev2_next_payload: length 72 nextpayload SA pfkey_sa_getspi: spi 0x5787a1ca pfkey_sa_init: new spi 0x5787a1ca ikev2_add_proposals: length 40 ikev2_next_payload: length 44 nextpayload TSi ikev2_next_payload: length 40 nextpayload TSr ikev2_next_payload: length 40 nextpayload NONE ikev2_next_payload: length 248 nextpayload IDi ikev2_msg_encrypt: decrypted length 223 ikev2_msg_encrypt: padded length 224 ikev2_msg_encrypt: length 224, padding 0, output length 244 ikev2_msg_integr: message length 276 ikev2_msg_integr: integrity checksum length 12 ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf nextpayload SK version 0x20 exchange IKE_AUTH flags 0x08 msgid 1 length 276 response 0 ikev2_pld_payloads: payload SK nextpayload IDi critical 0x00 length 248 ikev2_msg_decrypt: IV length 8 ikev2_msg_decrypt: encrypted payload length 224 ikev2_msg_decrypt: integrity checksum length 12 ikev2_msg_decrypt: AAD length 32 ikev2_msg_decrypt: decrypted payload length 224/224 padding 0 ikev2_pld_payloads: decrypted payload IDi nextpayload AUTH critical 0x00 length 27 ikev2_pld_id: id FQDN/server-east.example.com length 23 ikev2_pld_payloads: decrypted payload AUTH nextpayload SA critical 0x00 length 72 ikev2_pld_auth: method SHARED_KEY_MIC length 64 ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00 length 44 ikev2_pld_sa: more 0 reserved 0 length 40 proposal #1 protoid ESP spisize 4 xforms 3 spi 0x5787a1ca ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_16 ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 ikev2_pld_xform: more 3 reserved 0 length 8 type ESN id ESN ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id NONE ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00 length 40 ikev2_pld_tss: count 2 length 32 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 10.254.255.0 end 10.254.255.255 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 100.64.1.92 end 100.64.1.92 ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00 length 40 ikev2_pld_tss: count 2 length 32 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 10.255.255.0 end 10.255.255.255 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 203.0.113.50 end 203.0.113.50 spi=0x128173a042dfdc03: send IKE_AUTH req 1 peer 203.0.113.50:500 local 100.64.1.92:500, 276 bytes config_free_proposals: free 0xd12437e8780 spi=0x128173a042dfdc03: recv IKE_AUTH res 1 peer 203.0.113.50:500 local 100.64.1.92:500, 268 bytes, policy 'SERVER-WEST_INET4_NETS' ikev2_recv: ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf ikev2_recv: updated SA to peer 203.0.113.50:500 local 100.64.1.92:500 ikev2_pld_parse: header ispi 0x128173a042dfdc03 rspi 0x22c5f5ccef9637bf nextpayload SK version 0x20 exchange IKE_AUTH flags 0x20 msgid 1 length 268 response 1 ikev2_pld_payloads: payload SK nextpayload IDr critical 0x00 length 240 ikev2_msg_decrypt: IV length 8 ikev2_msg_decrypt: encrypted payload length 216 ikev2_msg_decrypt: integrity checksum length 12 ikev2_msg_decrypt: AAD length 32 ikev2_msg_decrypt: decrypted payload length 216/216 padding 0 ikev2_pld_payloads: decrypted payload IDr nextpayload AUTH critical 0x00 length 27 ikev2_pld_id: id FQDN/SERVER-WEST.example.com length 23 ikev2_pld_payloads: decrypted payload AUTH nextpayload SA critical 0x00 length 72 ikev2_pld_auth: method SHARED_KEY_MIC length 64 ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00 length 36 ikev2_pld_sa: more 0 reserved 0 length 32 proposal #1 protoid ESP spisize 4 xforms 2 spi 0x9a987eb3 ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_16 ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4 ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id ESN ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00 length 40 ikev2_pld_tss: count 2 length 32 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 10.254.255.0 end 10.254.255.255 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 100.64.1.92 end 100.64.1.92 ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00 length 40 ikev2_pld_tss: count 2 length 32 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 10.255.255.0 end 10.255.255.255 ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 0 length 16 startport 0 endport 65535 ikev2_pld_ts: start 203.0.113.50 end 203.0.113.50 spi=0x128173a042dfdc03: sa_state: SA_INIT -> AUTH_REQUEST policy_lookup: peerid 'SERVER-WEST.example.com' proposals_negotiate: score 3 policy_lookup: setting policy 'SERVER-WEST_INET4_NETS' proposals_negotiate: score 2 sa_stateflags: 0x0008 -> 0x0028 auth,sa (required 0x0030 authvalid,sa) ikev2_msg_auth: responder auth data length 410 ikev2_msg_authverify: method SHARED_KEY_MIC keylen 64 type NONE ikev2_msg_authverify: authentication successful spi=0x128173a042dfdc03: sa_state: AUTH_REQUEST -> AUTH_SUCCESS sa_stateflags: 0x0028 -> 0x0038 auth,authvalid,sa (required 0x0030 authvalid,sa) sa_stateok: VALID flags 0x0030, require 0x0030 authvalid,sa spi=0x128173a042dfdc03: sa_state: AUTH_SUCCESS -> VALID sa_stateok: VALID flags 0x0030, require 0x0030 authvalid,sa sa_stateok: VALID flags 0x0030, require 0x0030 authvalid,sa ikev2_sa_tag: VPN.SERVER-WEST (7) ikev2_childsa_negotiate: proposal 1 ikev2_childsa_negotiate: key material length 72 ikev2_prfplus: T1 with 64 bytes ikev2_prfplus: T2 with 64 bytes ikev2_prfplus: Tn with 128 bytes pfkey_sa_add: add spi 0x9a987eb3 ikev2_childsa_enable: loaded CHILD SA spi 0x9a987eb3 pfkey_sa_add: update spi 0x5787a1ca ikev2_childsa_enable: loaded CHILD SA spi 0x5787a1ca ikev2_childsa_enable: loaded flow 0xd12437cd800 ikev2_childsa_enable: loaded flow 0xd12437cd000 ikev2_childsa_enable: loaded flow 0xd12437d4000 ikev2_childsa_enable: loaded flow 0xd12437cd400 ikev2_childsa_enable: remember SA peer 203.0.113.50:500 spi=0x128173a042dfdc03: ikev2_childsa_enable: loaded SPIs: 0x9a987eb3, 0x5787a1ca (enc aes-256-gcm esn) spi=0x128173a042dfdc03: ikev2_childsa_enable: loaded flows: ESP-10.254.255.0/24=10.255.255.0/24(0), ESP-100.64.1.92/32=203.0.113.50/32(0) spi=0x128173a042dfdc03: sa_state: VALID -> ESTABLISHED from 203.0.113.50:500 to 100.64.1.92:500 policy 'SERVER-WEST_INET4_NETS' spi=0x128173a042dfdc03: established peer 203.0.113.50:500[FQDN/SERVER-WEST.example.com] local 100.64.1.92:500[FQDN/server-east.example.com] policy 'SERVER-WEST_INET4_NETS' as initiator (enc aes-256-gcm-12 group ecp521 prf hmac-sha2-512) config_free_proposals: free 0xd12437d7a80 config_doreset: flushing policies config_doreset: flushing SAs config_free_proposals: free 0xd12437e8c80 config_free_proposals: free 0xd12437d7680 config_free_childsas: free 0xd1243801d00 ca exiting, pid 82293 control exiting, pid 62242 config_free_childsas: free 0xd12437f0800 sa_free_flows: free 0xd12437cd800 pfkey_reply: not found sa_free_flows: free 0xd12437cd000 pfkey_reply: not found sa_free_flows: free 0xd12437d4000 pfkey_reply: not found sa_free_flows: free 0xd12437cd400 pfkey_reply: not found config_free_proposals: free 0xd12437e8900 config_free_proposals: free 0xd12437e6000 config_free_flows: free 0xd12437f1000 config_free_flows: free 0xd12437f1c00 config_doreset: flushing users ikev2 exiting, pid 56694 parent terminating
