<div dir="ltr">Thank you Paul.<div><br></div><div>I just upgraded it to 3.20. I built libreswan without specifying any parameter. I don't need klips in my setting anyway. I also added <span style="font-size:12.8px">virtual-private=%v4:</span><a href="http://10.0.0.0/8" rel="noreferrer" target="_blank" style="font-size:12.8px">10.0.0.0/8</a>. Still not working. </div><div>The NAT part, I'm not sure why you say that. I still see same "no <span style="font-size:12.8px">suitable connection for peer '10.0.3.3'" error, but I believe it's found inside of isakmp pkts. I did tcpdump on both machines, the ip was nat'ed. e.g. only see 10.0.3.3 on one side and </span><span style="font-size:12.8px">199.204.218.98</span><span style="font-size:12.8px"> on the peer side.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">I can upload new log if needed.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">Thanks,</span></div><div><span style="font-size:12.8px">Xinwei</span></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 7, 2017 at 1:57 PM, Paul Wouters <span dir="ltr"><<a href="mailto:paul@nohats.ca" target="_blank">paul@nohats.ca</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Fri, 7 Apr 2017, Xinwei Hong wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Thank you Paul. I tried ikepad=no, it does not work.Meanwhile, I tried to setup natt between two mathine running libreswan. It also failed, but probably for different reason.<span class=""><br>
<br>
The log files are here:<br>
<a href="https://www.dropbox.com/s/2381ktqrmshp57s/natt1.log?dl=0" rel="noreferrer" target="_blank">https://www.dropbox.com/s/2381<wbr>ktqrmshp57s/natt1.log?dl=0</a><br>
<a href="https://www.dropbox.com/s/0uzx62mgwq2krgw/natt2.log?dl=0" rel="noreferrer" target="_blank">https://www.dropbox.com/s/0uzx<wbr>62mgwq2krgw/natt2.log?dl=0</a><br>
</span></blockquote>
<br>
Did you compile without KLIPS support? That broke NAT-T and was fixed in<br>
3.19, while you are running 3.18.<span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
configs:<br>
one side is nat'ed. 199.204.218.98 nat to 10.0.3.3<br>
<br>
config setup<br>
protostack=netkey<br>
plutodebug=all<br>
listen=10.0.3.3<br>
conn conn_natt<br>
authby=secret<br>
left=10.0.3.3<br>
right=199.204.217.159<br>
ike=3des-md5;modp1024<br>
phase2alg=3des-md5;modp1024<br>
ikelifetime=28800s<br>
salifetime=3600s<br>
leftsubnet=<a href="http://10.0.0.0/24" rel="noreferrer" target="_blank">10.0.0.0/24</a><br>
rightsubnet=<a href="http://10.0.1.0/24" rel="noreferrer" target="_blank">10.0.1.0/24</a><br>
type=tunnel<br>
auto=start<br>
<br>
<br>
on the peer:<br>
config setup<br>
protostack=netkey<br>
plutodebug=all<br>
listen=199.204.217.159<br>
</blockquote>
<br></span>
This is missing a virtual-private=%v4:<a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">10.0.0.0/8</a><span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
conn conn_vpn-5483483-tunnel<br>
authby=secret<br>
left=199.204.217.159<br>
right=199.204.218.98<br>
ike=3des-md5;modp1024<br>
phase2alg=3des-md5;modp1024<br>
ikelifetime=28800s<br>
salifetime=3600s<br>
conn conn_vpn-5483483-tunnel-VPNRem<wbr>oteRoutedSubnet-tunnel-<a href="http://10.0.0.0/24" target="_blank">10.0.0.<wbr>0/24</a><br>
also=conn_vpn-5483483-tunnel<br>
leftsubnet=<a href="http://10.0.1.0/24" rel="noreferrer" target="_blank">10.0.1.0/24</a><br>
rightsubnet=<a href="http://10.0.0.0/24" rel="noreferrer" target="_blank">10.0.0.0/24</a><br>
</blockquote>
<br></span>
It's always a little tricky to build a subnet tunnel for the subnet you<br>
are. It should work but its easy for some tuning to be missing.<span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Apr 7 12:14:07 xenial33 pluto[5964]: | Notify Message Type: INVALID_ID_INFORMATION (0x12)<br>
</blockquote>
<br></span>
The logs you posted show the original error being:<br>
<br>
Apr 7 19:14:07 vvr-10-69-244-11 pluto[24396]: vpn-5483483: "conn_vpn-5483483-tunnel-VPNRe<wbr>moteRoutedSubnet-tunnel-<a href="http://10.0.0.0/24" target="_blank">10.0.<wbr>0.0/24</a>" #2: no suitable connection for peer '10.0.3.3'<br>
<br>
Looks like your 10.0.3.3 did not get NAT'ed to 199.204.218.98 and so the<br>
conncetion's right= IP value does not match the observed IP.<span class="HOEnZb"><font color="#888888"><br>
<br>
Paul<br>
</font></span></blockquote></div><br></div>