<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello,<div class=""><br class=""></div><div class="">I'm trying to connect Linux to AWS VPN Connection using Libreswan 3.25. On the same host IPSec connection already works for a long time. Now I'm adding another one, and I'm stopped o below problem:</div><div class=""><br class=""></div><div class=""><div class=""><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:08.149392: "XXX_tunnel2" #41: initiating Main Mode</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:08.161867: "XXX_tunnel2" #41: STATE_MAIN_I2: sent MI2, expecting MR2</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:08.174565: "XXX_tunnel2" #41: STATE_MAIN_I3: sent MI3, expecting MR3</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:08.185652: "XXX_tunnel2" #41: Peer ID is ID_IPV4_ADDR: '52.214.70.211'</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:08.186215: "XXX_tunnel2" #41: STATE_MAIN_I4: ISAKMP SA established {auth=PRESHARED_KEY cipher=aes_128 integ=sha group=MODP1024}</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:08.186295: "XXX_tunnel2" #42: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO {using isakmp#41 msgid:f741420f proposal=AES_CBC_128-HMAC_SHA1_96-MODP1024 pfsgroup=MODP1024}</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:08.198059: "XXX_tunnel2" #41: ignoring informational payload <b class="">INVALID_ID_INFORMATION</b>, msgid=00000000, length=16</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:08.198091: | ISAKMP Notification Payload</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:08.198103: | 00 00 00 10 00 00 00 01 03 04 00 12</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:08.198112: "XXX_tunnel2" #41: received and ignored informational message</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:08.687396: "XXX_tunnel2" #42: STATE_QUICK_I1: retransmission; will wait 0.5 seconds for response</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:09.188146: "XXX_tunnel2" #42: STATE_QUICK_I1: retransmission; will wait 1 seconds for response</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:10.189374: "XXX_tunnel2" #42: STATE_QUICK_I1: retransmission; will wait 2 seconds for response</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:12.190339: "XXX_tunnel2" #42: STATE_QUICK_I1: retransmission; will wait 4 seconds for response</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:16.194522: "XXX_tunnel2" #42: STATE_QUICK_I1: retransmission; will wait 8 seconds for response</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:24.197845: "XXX_tunnel2" #42: STATE_QUICK_I1: retransmission; will wait 16 seconds for response</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:24.209230: "XXX_tunnel2" #41: ignoring informational payload <b class="">INVALID_HASH_INFORMATION</b>, msgid=00000000, length=12</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:24.209266: | ISAKMP Notification Payload</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:24.209272: | 00 00 00 0c 00 00 00 01 01 00 00 17</font></div><div class=""><font class="" style="font-size: 12px;" face="Courier">Oct 12 11:54:24.209276: "XXX_tunnel2" #41: received and ignored informational message</font></div><div class=""><font face="Courier New" class="" style="font-size: 12px;"><br class=""></font></div></div></div><div class="">Configuration is quite fundamental as proposed by regular AWS setup. I'm using exactly the same for outer working VPN Connection.</div><div class=""><br class=""></div><div class=""><div class=""><font face="Courier" style="font-size: 12px;" class="">conn XXX_tunnel2</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> mark=202/0xffffffff</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> vti-interface=vti202</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> vti-routing=no</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""><br class=""></font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> left=10.196.3.53</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> leftid=140.238.80.46</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> leftsubnet=10.106.0.0/16</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""><br class=""></font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> rightsubnet=0.0.0.0/0</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> right=52.214.70.211</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""><br class=""></font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> type=tunnel</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""><br class=""></font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> authby=secret</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> auto=start</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""><br class=""></font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> dpddelay=10</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> dpdtimeout=30</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> dpdaction=restart_by_peer</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""><br class=""></font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> ikelifetime=8h</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> keylife=1h</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> phase2alg=aes128-sha1;modp1024</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> ike=aes128-sha1;modp1024</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> keyingtries=%forever</font></div><div class=""><font face="Courier" style="font-size: 12px;" class=""> keyexchange=ike</font></div></div><div class=""><br class=""></div><div class="">Appreciate any advice where is the trick. What is wrong? How to further debug?</div><div class=""><br class=""></div><div class="">Regards,</div><div class="">Ryszard</div><div class=""><br class=""></div></body></html>