<div dir="ltr">Thanks again for the info.<div><br></div><div>Originally I oversimplified my testing setup way too much. I just reconfigured everything on separate subnets, etc.</div><div>Server:</div><div> physical interface IP used for IPSec: <a href="http://10.10.3.8/24">10.10.3.8/24</a></div><div> vpn server tunnel endpoint IP: <a href="http://10.10.8.8/24">10.10.8.8/24</a></div><div> private subnet on server: <a href="http://10.10.10.0/24">10.10.10.0/24</a></div><div>Client:</div><div> physical interface IP used for IPSec: <a href="http://10.10.5.5/24">10.10.5.5/24</a></div><div> vpn client tunnel endpoint IP: <a href="http://10.10.15.5/24">10.10.15.5/24</a></div><div> private subnet on client: <a href="http://10.10.50.0/24">10.10.50.0/24</a></div><div><br></div><div>From the client, I can ping the server VPN tunnel endpoint IP, so the connectivity and routing is working.</div><div>(I know, there are way too many 10's in these IPs ;) )</div><div><br></div><div>The configuration below with "rightsubnet=<a href="http://10.10.50.0/24">10.10.50.0/24</a>" in the client config gives the TS_UNACCEPTABLE error. But when I configure the client with "rightsubnet=<a href="http://10.10.15.5/32">10.10.15.5/32</a>" (the right IP) then I dont get the TS_UNACCEPTABLE error, but of course this is not the configuration I want.<br></div><div><br></div><div>TS_UNACCEPTABLE error:<br></div><div><br></div><div> 182 "vpn_client_tunnel" #2: sent IKE_AUTH request {auth=IKEv2 cipher=AES_CBC_256 integ=HMAC_SHA2_256_128 prf=HMAC_SHA2_256 group=MODP2048}<br> 002 "vpn_client_tunnel" #3: IKE_AUTH response contained the error notification TS_UNACCEPTABLE<br></div><div><br></div><div>The pluto.log in the server doesnt provide any more information. Why do I get the TS_UNACCEPTABLE error?</div><div><br></div><div>Server and Client configurations:</div><div><br></div><div>conn vpn_server_tunnel<br> left=10.10.8.8<br> leftid=@<a href="http://vpnserver08.lab.com">vpnserver08.lab.com</a><br> leftsubnet=<a href="http://10.10.10.0/24">10.10.10.0/24</a><br> leftrsasigkey=%cert<br> leftcert=<a href="http://vpnserver08.lab.com">vpnserver08.lab.com</a><br> leftsendcert=always<br><br> right=%any<br> rightrsasigkey=%cert<br> rightid=%fromcert<br> rightca=%same<br><br> dpddelay=30<br> dpdtimeout=120<br> dpdaction=clear<br> auto=add<br> ikev2=insist<br> rekey=no<br> fragmentation=yes<br> ike=aes256-sha2<br> esp=aes256-sha2_512-dh14<br> authby=rsa-sha2_512<br> ikelifetime=86400s<br> salifetime=3600s<br></div><div><br></div><div>conn vpn_client_tunnel<br> left=10.10.8.8<br> leftid=@<a href="http://vpnserver08.lab.com">vpnserver08.lab.com</a><br> leftsubnet=<a href="http://10.10.10.0/24">10.10.10.0/24</a><br> leftrsasigkey=%cert<br><br> right=10.10.15.5<br> rightrsasigkey=%cert<br> rightid=%fromcert<br> rightsubnet=<a href="http://10.10.50.0/24">10.10.50.0/24</a><br> rightcert=<a href="http://vpnclientha05.lab.com">vpnclientha05.lab.com</a><br><br> ikev2=insist<br> rekey=yes<br> fragmentation=yes<br> mobike=yes<br> auto=start<br> ike=aes256-sha2<br> esp=aes256-sha2_512-dh14<br> authby=rsa-sha2_512<br> ikelifetime=86400s<br> salifetime=3600s<br></div><div><br></div><div>Regards,</div><div><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><b>Brady Johnson</b><div><a href="mailto:brady.johnson@redhat.com" target="_blank">brady.johnson@redhat.com</a><br></div><div><div><br></div><div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Mar 28, 2022 at 3:18 PM Tuomo Soini <<a href="mailto:tis@foobar.fi">tis@foobar.fi</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Mon, 28 Mar 2022 11:47:07 +0200<br>
Brady Johnson <<a href="mailto:bradyjoh@redhat.com" target="_blank">bradyjoh@redhat.com</a>> wrote:<br>
<br>
> Tuomi,<br>
> <br>
> Thank you for your reply.<br>
> <br>
> I will put the client on a different subnet, but as it is now it is<br>
> creating a working tunnel between the 2 hosts.<br>
<br>
No. server and client being in same subnet is not your issue - the<br>
protected subnets are your issue - you need to understand basic<br>
networking - IPsec is policy based but still network connection must be<br>
routable. So you must have different subnets on different ends of the<br>
tunnel.<br>
<br>
about <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> - that is default route.<br>
<br>
-- <br>
Tuomo Soini <<a href="mailto:tis@foobar.fi" target="_blank">tis@foobar.fi</a>><br>
Foobar Linux services<br>
+358 40 5240030<br>
Foobar Oy <<a href="https://foobar.fi/" rel="noreferrer" target="_blank">https://foobar.fi/</a>><br>
_______________________________________________<br>
Swan mailing list<br>
<a href="mailto:Swan@lists.libreswan.org" target="_blank">Swan@lists.libreswan.org</a><br>
<a href="https://lists.libreswan.org/mailman/listinfo/swan" rel="noreferrer" target="_blank">https://lists.libreswan.org/mailman/listinfo/swan</a><br>
<br>
</blockquote></div>