<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">So both agree on the tunnel and the traffic counters. It looks operational.<div><br></div><div>I wonder if there is some kind of firewall on the network that allows the initial packets but then starts blocking things ?</div><div><br><div dir="ltr">Sent using a virtual keyboard on a phone</div><div dir="ltr"><br><blockquote type="cite">On Jan 31, 2023, at 12:40, ud@blueaquan.com wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><br>Hi Paul<br>Kindly find the output of ipsec whack --showstates from both sides please.<br><br><br><strong>At HO</strong><br><br><span style="font-size: 9pt;">000 #5: "PLUTOSUBNET":1208 STATE_V2_ESTABLISHED_IKE_SA (established IKE SA); EVENT_SA_REKEY in 28511s; newest ISAKMP; idle;</span><br><span style="font-size: 9pt;">000 #6: "PLUTOSUBNET":1208 STATE_V2_ESTABLISHED_CHILD_SA (IPsec SA established); EVENT_SA_REKEY in 28511s; newest IPSEC; eroute owner; isakmp#5; idle;</span><br><span style="font-size: 9pt;">000 #6: "PLUTOSUBNET" esp.e4688f53@W.X.Y.Z esp.910e3384@A.B.C.D tun.0@W.X.Y.Z tun.0@A.B.C.D Traffic: ESPin=168B ESPout=168B! ESPmax=0B </span><br><br><br><strong>At Site Office</strong><br><br><span style="font-size: 9pt;">000 #1: "PLSUBNET":4500 STATE_V2_ESTABLISHED_IKE_SA (established IKE SA); EVENT_SA_REKEY in 27743s; newest ISAKMP; idle;</span><br><span style="font-size: 9pt;">000 #2: "PLSUBNET":4500 STATE_V2_ESTABLISHED_CHILD_SA (IPsec SA established); EVENT_SA_REKEY in 27984s; newest IPSEC; eroute owner; isakmp#1; idle;</span><br><span style="font-size: 9pt;">000 #2: "PLSUBNET" esp.910e3384@A.B.C.D <a href="mailto:esp.e4688f53@10.10.128.100">esp.e4688f53@10.10.128.100</a> tun.0@A.B.C.D <a href="mailto:tun.0@10.10.128.100">tun.0@10.10.128.100</a> Traffic: ESPin=168B ESPout=168B! ESPmax=0B </span><br><br><br><br>Thanks, Best<br>BA<br><br><br><br>On 2023-01-31 22:01, Paul Wouters wrote:
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">On Mon, 30 Jan 2023, <a href="mailto:ud@blueaquan.com">ud@blueaquan.com</a> wrote:<br><br>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">I changed the HO's statement to auto=add while keeping auto=start at the Site Office. Also removed encapsulation statement at both<br>ends, However there is no change in status, both machines are unable to reach each other. The tunnel is getting established as<br>always, attaching the logs from both sides FYI.</blockquote>
<br>Once the tunnel is not working, can you run on both ends:<br><br>ipsec whack --showstates<br><br>Let's see if both ends are still thinking the tunnel is up or not.<br><br>Paul</blockquote>
</div>
</div></blockquote></div></body></html>