Oct 08, 2020, updated at 14:05:22 (UTC)

3444

IPSec VPN Server einrichten

Moin,

mir ist heute unter der Dusche etwas durch den Kopf geflogen

Und bin bis vor kurzem noch fest davon ausgegangen, dass es ohne weiteres möglich sein muss.

Ich habe eine VM mit CentOS7 im Netz stehen. Diese hat zwei öffentliche IPv4. Nun dachte ich, ich könnte einen IPSEC IKEv2 darauf einrichten und schon habe ich immer eine Berliner IP Adresse. Auch wenn ich mal in China sein sollte.

Nun habe ich eine kleine Anleitung mir ausgesucht und los geht es ..

yum -y install epel-release strongswan certbot
systemctl stop httpd
certbot certonly --rsa-key-size 4096 --standalone --agree-tos --no-eff-email --email info@domain.de -d ikev2.domain.de
cp /etc/letsencrypt/live/ikev2.domain.de/fullchain.pem /etc/strongswan/ipsec.d/certs/
cp /etc/letsencrypt/live/ikev2.domain.de/privkey.pem /etc/strongswan/ipsec.d/private/
cp /etc/letsencrypt/live/ikev2.domain.de/chain.pem /etc/strongswan/ipsec.d/cacerts/
cd /etc/strongswan/
mv ipsec.conf ipsec.conf.asli
vim ipsec.conf

#global configuration IPsec
#chron logger
config setup
    charondebug="ike 1, knl 1, cfg 0"  
    uniqueids=no

#define new ipsec connection
conn domain-vpn
    auto=add
    compress=no
    type=tunnel
    keyexchange=ikev2
    ike=aes128-sha1-modp1024,aes128-sha1-modp1536,aes128-sha1-modp2048,aes128-sha256-ecp256,aes128-sha256-modp1024,aes128-sha256-modp1536,aes128-sha256-modp2048,aes256-aes128-sha256-sha1-modp2048-modp4096-modp1024,aes256-sha1-modp1024,aes256-sha256-modp1024,aes256-sha256-modp1536,aes256-sha256-modp2048,aes256-sha256-modp4096,aes256-sha384-ecp384,aes256-sha384-modp1024,aes256-sha384-modp1536,aes256-sha384-modp2048,aes256-sha384-modp4096,aes256gcm16-aes256gcm12-aes128gcm16-aes128gcm12-sha256-sha1-modp2048-modp4096-modp1024,3des-sha1-modp1024!
    esp=aes128-aes256-sha1-sha256-modp2048-modp4096-modp1024,aes128-sha1,aes128-sha1-modp1024,aes128-sha1-modp1536,aes128-sha1-modp2048,aes128-sha256,aes128-sha256-ecp256,aes128-sha256-modp1024,aes128-sha256-modp1536,aes128-sha256-modp2048,aes128gcm12-aes128gcm16-aes256gcm12-aes256gcm16-modp2048-modp4096-modp1024,aes128gcm16,aes128gcm16-ecp256,aes256-sha1,aes256-sha256,aes256-sha256-modp1024,aes256-sha256-modp1536,aes256-sha256-modp2048,aes256-sha256-modp4096,aes256-sha384,aes256-sha384-ecp384,aes256-sha384-modp1024,aes256-sha384-modp1536,aes256-sha384-modp2048,aes256-sha384-modp4096,aes256gcm16,aes256gcm16-ecp384,3des-sha1!
    fragmentation=yes
    forceencaps=yes
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%any
    leftid=@ikev2.domain.de
    leftcert=fullchain.pem
    leftsendcert=always
    leftsubnet=0.0.0.0/0
    right=%any
    rightid=%any
    rightauth=eap-mschapv2
    rightsourceip=10.15.1.0/24
    rightdns=1.1.1.1 # 8.8.8.8 BITTE NICHT VERWENDEN!
    rightsendcert=never
    eap_identity=%identity

vim ipsec.secrets

: RSA "privkey.pem"  
Benutzer : EAP "Passwort"  

Da ich iptables verwende musste einwenig improvesieren.
Hinzu kommt, dass es mir bei MASQUERADE die option -t nicht angenommen hat. Also erstmal ausgemacht.

iptables: Trying to reload firewall rules: iptables-restore v1.4.21: The -t option (seen in line 27) cannot be
Error occurred at line: 27
Try `iptables-restore -h' or 'iptables-restore --help' for more information.  
[FEHLGESCHLAGEN]
Firewall rules are not changed.

### VPN IPsec IKEv2 ###
#-A POSTROUTING -t nat -o venet0 -j MASQUERADE
-A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A INPUT -i venet0 -p udp -d 200.200.200.200 --sport 1024:65535 --dport 500 -j ACCEPT
-A INPUT -i venet0 -p udp -d 200.200.200.200 --sport 1024:65535 --dport 4500 -j ACCEPT
-A INPUT -p esp -j ACCEPT

vim /etc/sysctl.conf

net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

sysctl -p
systemctl start strongswan

Beim Test mit Android bekomme ich folgende Fehlermeldungen:
Server:

Oct  8 12:42:09 SERVER charon: 11[IKE] sending end entity cert "CN=ikev2.domain.de"  
Oct  8 12:42:09 SERVER charon: 11[IKE] sending issuer cert "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"  
Oct  8 12:42:09 SERVER charon: 11[ENC] generating IKE_AUTH response 1 [ IDr CERT CERT AUTH EAP/REQ/ID ]
Oct  8 12:42:09 SERVER charon: 11[ENC] splitting IKE message (3468 bytes) into 3 fragments
Oct  8 12:42:09 SERVER charon: 11[ENC] generating IKE_AUTH response 1 [ EF(1/3) ]
Oct  8 12:42:09 SERVER charon: 11[ENC] generating IKE_AUTH response 1 [ EF(2/3) ]
Oct  8 12:42:09 SERVER charon: 11[ENC] generating IKE_AUTH response 1 [ EF(3/3) ]
Oct  8 12:42:09 SERVER charon: 11[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[18320] (1248 bytes)
Oct  8 12:42:09 SERVER charon: 11[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[18320] (1248 bytes)
Oct  8 12:42:09 SERVER charon: 11[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[18320] (1120 bytes)
Oct  8 12:42:10 SERVER charon: 10[NET] received packet: from 150.150.150.150[18320] to 200.200.200.200[4500] (92 bytes)
Oct  8 12:42:10 SERVER charon: 10[ENC] parsed IKE_AUTH request 2 [ EAP/RES/ID ]
Oct  8 12:42:10 SERVER charon: 10[IKE] received EAP identity 'Benutzer'  
Oct  8 12:42:10 SERVER charon: 10[IKE] initiating EAP_MSCHAPV2 method (id 0x88)
Oct  8 12:42:10 SERVER charon: 10[ENC] generating IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]
Oct  8 12:42:10 SERVER charon: 10[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[18320] (108 bytes)
Oct  8 12:42:10 SERVER charon: 12[NET] received packet: from 150.150.150.150[18320] to 200.200.200.200[4500] (140 bytes)
Oct  8 12:42:10 SERVER charon: 12[ENC] parsed IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]
Oct  8 12:42:10 SERVER charon: 12[ENC] generating IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]
Oct  8 12:42:10 SERVER charon: 12[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[18320] (140 bytes)
Oct  8 12:42:10 SERVER charon: 13[NET] received packet: from 150.150.150.150[18320] to 200.200.200.200[4500] (76 bytes)
Oct  8 12:42:10 SERVER charon: 13[ENC] parsed IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]
Oct  8 12:42:10 SERVER charon: 13[IKE] EAP method EAP_MSCHAPV2 succeeded, MSK established
Oct  8 12:42:10 SERVER charon: 13[ENC] generating IKE_AUTH response 4 [ EAP/SUCC ]
Oct  8 12:42:10 SERVER charon: 13[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[18320] (76 bytes)
Oct  8 12:42:10 SERVER charon: 15[NET] received packet: from 150.150.150.150[18320] to 200.200.200.200[4500] (92 bytes)
Oct  8 12:42:10 SERVER charon: 15[ENC] parsed IKE_AUTH request 5 [ AUTH ]
Oct  8 12:42:10 SERVER charon: 15[IKE] authentication of 'Benutzer' with EAP successful  
Oct  8 12:42:10 SERVER strongswan: 07[ENC] generating IKE_SA_INIT response 0 [ N(INVAL_KE) ]
Oct  8 12:42:10 SERVER strongswan: 07[NET] sending packet: from 200.200.200.200[500] to 150.150.150.150[18314] (38 bytes)
Oct  8 12:42:10 SERVER strongswan: 04[NET] received packet: from 150.150.150.150[18314] to 200.200.200.200[500] (908 bytes)
Oct  8 12:42:10 SERVER strongswan: 04[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Oct  8 12:42:10 SERVER strongswan: 04[IKE] 150.150.150.150 is initiating an IKE_SA
Oct  8 12:42:10 SERVER strongswan: 04[IKE] remote host is behind NAT
Oct  8 12:42:10 SERVER strongswan: 04[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(MULT_AUTH) ]
Oct  8 12:42:10 SERVER strongswan: 04[NET] sending packet: from 200.200.200.200[500] to 150.150.150.150[18314] (464 bytes)
Oct  8 12:42:10 SERVER strongswan: 08[NET] received packet: from 150.150.150.150[18320] to 200.200.200.200[4500] (1360 bytes)
Oct  8 12:42:10 SERVER strongswan: 08[ENC] parsed IKE_AUTH request 1 [ EF(1/3) ]
Oct  8 12:42:10 SERVER strongswan: 08[ENC] received fragment #1 of 3, waiting for complete IKE message
Oct  8 12:42:10 SERVER strongswan: 09[NET] received packet: from 150.150.150.150[18320] to 200.200.200.200[4500] (1360 bytes)
Oct  8 12:42:10 SERVER strongswan: 09[ENC] parsed IKE_AUTH request 1 [ EF(2/3) ]
Oct  8 12:42:10 SERVER strongswan: 09[ENC] received fragment #2 of 3, waiting for complete IKE message
Oct  8 12:42:10 SERVER strongswan: 11[NET] received packet: from 150.150.150.150[18320] to 200.200.200.200[4500] (992 bytes)
Oct  8 12:42:10 SERVER strongswan: 11[ENC] parsed IKE_AUTH request 1 [ EF(3/3) ]
Oct  8 12:42:10 SERVER strongswan: 11[ENC] received fragment #3 of 3, reassembled fragmented IKE message (3580 bytes)
Oct  8 12:42:10 SERVER strongswan: 11[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ CPRQ(ADDR ADDR6 DNS DNS6) N(ESP_TFC_PAD_N) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
Oct  8 12:42:10 SERVER strongswan: 11[IKE] received 157 cert requests for an unknown ca
Oct  8 12:42:10 SERVER strongswan: 11[IKE] initiating EAP_IDENTITY method (id 0x00)
Oct  8 12:42:10 SERVER strongswan: 11[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Oct  8 12:42:10 SERVER strongswan: 11[IKE] peer supports MOBIKE
Oct  8 12:42:10 SERVER strongswan: 11[IKE] authentication of 'ikev2.domain.de' (myself) with RSA_EMSA_PKCS1_SHA2_384 successful  
Oct  8 12:42:10 SERVER strongswan: 11[IKE] sending end entity cert "CN=ikev2.domain.de"  
Oct  8 12:42:10 SERVER strongswan: 11[IKE] sending issuer cert "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"  
Oct  8 12:42:10 SERVER strongswan: 11[ENC] generating IKE_AUTH response 1 [ IDr CERT CERT AUTH EAP/REQ/ID ]
Oct  8 12:42:10 SERVER strongswan: 11[ENC] splitting IKE message (3468 bytes) into 3 fragments
Oct  8 12:42:10 SERVER charon: 15[IKE] authentication of 'ikev2.domain.de' (myself) with EAP  
Oct  8 12:42:10 SERVER strongswan: 11[ENC] generating IKE_AUTH response 1 [ EF(1/3) ]
Oct  8 12:42:10 SERVER strongswan: 11[ENC] generating IKE_AUTH response 1 [ EF(2/3) ]
Oct  8 12:42:10 SERVER strongswan: 11[ENC] generating IKE_AUTH response 1 [ EF(3/3) ]
Oct  8 12:42:10 SERVER strongswan: 11[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[18320] (1248 bytes)
Oct  8 12:42:10 SERVER strongswan: 11[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[18320] (1248 bytes)
Oct  8 12:42:10 SERVER strongswan: 11[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[18320] (1120 bytes)
Oct  8 12:42:10 SERVER strongswan: 10[NET] received packet: from 150.150.150.150[18320] to 200.200.200.200[4500] (92 bytes)
Oct  8 12:42:10 SERVER strongswan: 10[ENC] parsed IKE_AUTH request 2 [ EAP/RES/ID ]
Oct  8 12:42:10 SERVER strongswan: 10[IKE] received EAP identity 'Benutzer'  
Oct  8 12:42:10 SERVER strongswan: 10[IKE] initiating EAP_MSCHAPV2 method (id 0x88)
Oct  8 12:42:10 SERVER strongswan: 10[ENC] generating IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]
Oct  8 12:42:10 SERVER strongswan: 10[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[18320] (108 bytes)
Oct  8 12:42:10 SERVER strongswan: 12[NET] received packet: from 150.150.150.150[18320] to 200.200.200.200[4500] (140 bytes)
Oct  8 12:42:10 SERVER strongswan: 12[ENC] parsed IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]
Oct  8 12:42:10 SERVER strongswan: 12[ENC] generating IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]
Oct  8 12:42:10 SERVER strongswan: 12[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[18320] (140 bytes)
Oct  8 12:42:10 SERVER strongswan: 13[NET] received packet: from 150.150.150.150[18320] to 200.200.200.200[4500] (76 bytes)
Oct  8 12:42:10 SERVER strongswan: 13[ENC] parsed IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]
Oct  8 12:42:10 SERVER strongswan: 13[IKE] EAP method EAP_MSCHAPV2 succeeded, MSK established
Oct  8 12:42:10 SERVER strongswan: 13[ENC] generating IKE_AUTH response 4 [ EAP/SUCC ]
Oct  8 12:42:10 SERVER strongswan: 13[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[18320] (76 bytes)
Oct  8 12:42:10 SERVER strongswan: 15[NET] received packet: from 150.150.150.150[18320] to 200.200.200.200[4500] (92 bytes)
Oct  8 12:42:10 SERVER strongswan: 15[ENC] parsed IKE_AUTH request 5 [ AUTH ]
Oct  8 12:42:10 SERVER strongswan: 15[IKE] authentication of 'Benutzer' with EAP successful  
Oct  8 12:42:10 SERVER strongswan: 15[IKE] authentication of 'ikev2.domain.de' (myself) with EAP  
Oct  8 12:42:10 SERVER strongswan: 15[IKE] IKE_SA domain-vpn[6] established between 200.200.200.200[ikev2.domain.de]...150.150.150.150[Benutzer]
Oct  8 12:42:10 SERVER strongswan: 15[IKE] peer requested virtual IP %any
Oct  8 12:42:10 SERVER strongswan: 15[IKE] assigning virtual IP 10.0.1.1 to peer 'Benutzer'  
Oct  8 12:42:10 SERVER strongswan: 15[IKE] peer requested virtual IP %any6
Oct  8 12:42:10 SERVER strongswan: 15[IKE] no virtual IP found for %any6 requested by 'Benutzer'  
Oct  8 12:42:10 SERVER strongswan: 15[KNL] received netlink error: Protocol not supported (93)
Oct  8 12:42:10 SERVER charon: 15[IKE] IKE_SA domain-vpn[6] established between 200.200.200.200[ikev2.domain.de]...150.150.150.150[Benutzer]
Oct  8 12:42:10 SERVER strongswan: 15[KNL] unable to add SAD entry with SPI c85fa096 (FAILED)
Oct  8 12:42:10 SERVER charon: 15[IKE] peer requested virtual IP %any
Oct  8 12:42:10 SERVER charon: 15[IKE] assigning virtual IP 10.0.1.1 to peer 'Benutzer'  
Oct  8 12:42:10 SERVER charon: 15[IKE] peer requested virtual IP %any6
Oct  8 12:42:10 SERVER charon: 15[IKE] no virtual IP found for %any6 requested by 'Benutzer'  
Oct  8 12:42:10 SERVER charon: 15[KNL] received netlink error: Protocol not supported (93)
Oct  8 12:42:10 SERVER charon: 15[KNL] unable to add SAD entry with SPI c85fa096 (FAILED)
Oct  8 12:42:10 SERVER charon: 15[KNL] received netlink error: Protocol not supported (93)
Oct  8 12:42:10 SERVER charon: 15[KNL] unable to add SAD entry with SPI 0edde137 (FAILED)
Oct  8 12:42:10 SERVER charon: 15[IKE] unable to install inbound and outbound IPsec SA (SAD) in kernel
Oct  8 12:42:10 SERVER charon: 15[IKE] failed to establish CHILD_SA, keeping IKE_SA
Oct  8 12:42:10 SERVER charon: 15[KNL] deleting policy 10.0.1.1/32 === 0.0.0.0/0 in failed, not found
Oct  8 12:42:10 SERVER charon: 15[KNL] deleting policy 10.0.1.1/32 === 0.0.0.0/0 fwd failed, not found
Oct  8 12:42:10 SERVER charon: 15[ENC] generating IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS DNS) N(MOBIKE_SUP) N(ADD_4_ADDR) N(NO_PROP) ]
Oct  8 12:42:10 SERVER charon: 15[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[18320] (156 bytes)
Oct  8 12:42:10 SERVER charon: 05[NET] received packet: from 150.150.150.150[18320] to 200.200.200.200[4500] (76 bytes)
Oct  8 12:42:10 SERVER charon: 05[ENC] parsed INFORMATIONAL request 6 [ D ]
Oct  8 12:42:10 SERVER charon: 05[IKE] received DELETE for IKE_SA domain-vpn[6]
Oct  8 12:42:10 SERVER charon: 05[IKE] deleting IKE_SA domain-vpn[6] between 200.200.200.200[ikev2.domain.de]...150.150.150.150[Benutzer]
Oct  8 12:42:10 SERVER charon: 05[IKE] IKE_SA deleted
Oct  8 12:42:10 SERVER charon: 05[ENC] generating INFORMATIONAL response 6 [ ]
Oct  8 12:42:10 SERVER charon: 05[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[18320] (76 bytes)

Ich glaube da stimmt etwas mit der Virtualen IP nicht. Aber was kann ich da machen?

Please also mark the comments that contributed to the solution of the article

Content-Key: 611184

Url: https://administrator.de/contentid/611184

Printed on: April 19, 2024 at 20:04 o'clock

9 Comments

Latest comment

Das "failed to establish CHILD_SA, keeping IKE_SA" sagt schon alles. Deine SA Netzwerk Credentials sind auf beiden Seiten nicht identisch. IP Netzwerk Adressen und/oder Masken. Das ergibt dann einen SA Mismatich und der Tunnel kommt nicht zustande.
Siehe für die IPsec Grundlagen dazu auch hier:
IPsec IKEv2 Standort VPN Vernetzung mit Cisco, pfSense OPNsense und Mikrotik
IPsec IKEv2 VPN für mobile Benutzer auf der pfSense oder OPNsense Firewall einrichten
IPsec VPN Praxis mit Standort Vernetzung Cisco, Mikrotik, pfSense, FritzBox u.a
usw.
Nebenbei: Google DNS zu verwenden machen heutzutage nur noch Dummies. Jeder weiss ja das damit ein Profil deiner Internetgewohheiten erstellt und vermarktet wird mit Dritten. Sollte man besser im Eigeninteresse ändern.
https://www.heise.de/newsticker/meldung/Quad9-Datenschutzfreundliche-Alt ...

Moin aqui,

Zitat von @aqui:

Das "failed to establish CHILD_SA, keeping IKE_SA" sagt schon alles. Deine SA Netzwerk Credentials sind auf beiden Seiten nicht identisch. IP Netzwerk Adressen und/oder Masken. Das ergibt dann einen SA Mismatich und der Tunnel kommt nicht zustande.

Du meinnst mit Sicher heit das hier "deleting policy 10.0.1.1/32 === 0.0.0.0/0 in failed, not found" Das heißt ich muss die IP irgend wo auf dem Android Client hinterlegen? Habe da nichts zu gefunden....

Und es liegt wirklich nicht an den MASQUERADE ??

Zitat von @aqui:
Nebenbei: Google DNS zu verwenden machen heutzutage nur noch Dummies. Jeder weiss ja das damit ein Profil deiner Internetgewohheiten erstellt und vermarktet wird mit Dritten. Sollte man besser im Eigeninteresse ändern.
https://www.heise.de/newsticker/meldung/Quad9-Datenschutzfreundliche-Alt ...

Peinlich für mich aber ja hast du recht. das habe ich so übernommen ... Wollte schnell schnell

Kann das sein, dass da der Server keine LAN-IP konfiguriert hat, kann ich mit diesem keine VPN Verbindung aufbauen?

Guten Morgen,
nun habe ich meinen Fehler unter Iptables erkannt und entsprechend angepasst.

*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o venet0 -j MASQUERADE
COMMIT

Die Ausgabe vom Log hat sich jedoch nicht wirklich verändert.

Okt 09 07:48:44 SERVER charon[19823]: 08[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ CPRQ(ADDR ADDR6 DNS NBNS DNS6) SA TSi TSr N(MOBIKE_SU
Okt 09 07:48:44 SERVER charon[19823]: 08[IKE] received 415 cert requests for an unknown ca
Okt 09 07:48:44 SERVER charon[19823]: 08[IKE] initiating EAP_IDENTITY method (id 0x00)
Okt 09 07:48:44 SERVER charon[19823]: 08[IKE] peer supports MOBIKE
Okt 09 07:48:44 SERVER charon[19823]: 08[IKE] authentication of 'ikev2.domain.de' (myself) with RSA_EMSA_PKCS1_SHA2_384 successful  
Okt 09 07:48:44 SERVER charon[19823]: 08[IKE] sending end entity cert "CN=ikev2.domain.de"  
Okt 09 07:48:44 SERVER strongswan[19817]: 00[DMN] Starting IKE charon daemon (strongSwan 5.7.2, Linux 3.10.0-042stab145.3, x86_64)
Okt 09 07:48:44 SERVER strongswan[19817]: 00[LIB] openssl FIPS mode(2) - enabled
Okt 09 07:48:44 SERVER strongswan[19817]: 00[KNL] unable to set IPSEC_POLICY on socket: Operation not permitted (1)
Okt 09 07:48:44 SERVER strongswan[19817]: 00[NET] installing IKE bypass policy failed
Okt 09 07:48:44 SERVER strongswan[19817]: 00[KNL] unable to set IPSEC_POLICY on socket: Operation not permitted (1)
Okt 09 07:48:44 SERVER strongswan[19817]: 00[NET] installing IKE bypass policy failed
Okt 09 07:48:44 SERVER strongswan[19817]: 00[LIB] loaded plugins: charon pkcs11 tpm aesni aes des rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation c
Okt 09 07:48:44 SERVER strongswan[19817]: 00[JOB] spawning 16 worker threads
Okt 09 07:48:44 SERVER strongswan[19817]: 14[NET] received packet: from 150.150.150.150[42413] to 200.200.200.200[500] (1000 bytes)
Okt 09 07:48:44 SERVER strongswan[19817]: 14[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Okt 09 07:48:44 SERVER strongswan[19817]: 14[IKE] 150.150.150.150 is initiating an IKE_SA
Okt 09 07:48:44 SERVER strongswan[19817]: 14[IKE] remote host is behind NAT
Okt 09 07:48:44 SERVER strongswan[19817]: 14[IKE] DH group ECP_256 unacceptable, requesting MODP_2048
Okt 09 07:48:44 SERVER strongswan[19817]: 14[ENC] generating IKE_SA_INIT response 0 [ N(INVAL_KE) ]
Okt 09 07:48:44 SERVER strongswan[19817]: 14[NET] sending packet: from 200.200.200.200[500] to 150.150.150.150[42413] (38 bytes)
Okt 09 07:48:44 SERVER strongswan[19817]: 05[NET] received packet: from 150.150.150.150[42413] to 200.200.200.200[500] (1192 bytes)
Okt 09 07:48:44 SERVER strongswan[19817]: 05[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Okt 09 07:48:44 SERVER strongswan[19817]: 05[IKE] 150.150.150.150 is initiating an IKE_SA
Okt 09 07:48:44 SERVER strongswan[19817]: 05[IKE] remote host is behind NAT
Okt 09 07:48:44 SERVER strongswan[19817]: 05[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(MULT_AUT
Okt 09 07:48:44 SERVER strongswan[19817]: 05[NET] sending packet: from 200.200.200.200[500] to 150.150.150.150[42413] (464 bytes)
Okt 09 07:48:44 SERVER strongswan[19817]: 15[NET] received packet: from 150.150.150.150[20182] to 200.200.200.200[4500] (1248 bytes)
Okt 09 07:48:44 SERVER strongswan[19817]: 15[ENC] parsed IKE_AUTH request 1 [ EF(1/8) ]
Okt 09 07:48:44 SERVER charon[19823]: 08[IKE] sending issuer cert "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"  
Okt 09 07:48:44 SERVER strongswan[19817]: 15[ENC] received fragment #1 of 8, waiting for complete IKE message
Okt 09 07:48:44 SERVER strongswan[19817]: 09[NET] received packet: from 150.150.150.150[20182] to 200.200.200.200[4500] (1248 bytes)
Okt 09 07:48:44 SERVER strongswan[19817]: 09[ENC] parsed IKE_AUTH request 1 [ EF(2/8) ]
Okt 09 07:48:44 SERVER strongswan[19817]: 09[ENC] received fragment #2 of 8, waiting for complete IKE message
Okt 09 07:48:44 SERVER strongswan[19817]: 06[NET] received packet: from 150.150.150.150[20182] to 200.200.200.200[4500] (1248 bytes)
Okt 09 07:48:44 SERVER strongswan[19817]: 06[ENC] parsed IKE_AUTH request 1 [ EF(3/8) ]
Okt 09 07:48:44 SERVER strongswan[19817]: 06[ENC] received fragment #3 of 8, waiting for complete IKE message
Okt 09 07:48:44 SERVER strongswan[19817]: 07[NET] received packet: from 150.150.150.150[20182] to 200.200.200.200[4500] (1248 bytes)
Okt 09 07:48:44 SERVER strongswan[19817]: 07[ENC] parsed IKE_AUTH request 1 [ EF(4/8) ]
Okt 09 07:48:44 SERVER strongswan[19817]: 07[ENC] received fragment #4 of 8, waiting for complete IKE message
Okt 09 07:48:44 SERVER strongswan[19817]: 10[NET] received packet: from 150.150.150.150[20182] to 200.200.200.200[4500] (1248 bytes)
Okt 09 07:48:44 SERVER strongswan[19817]: 10[ENC] parsed IKE_AUTH request 1 [ EF(5/8) ]
Okt 09 07:48:44 SERVER strongswan[19817]: 10[ENC] received fragment #5 of 8, waiting for complete IKE message
Okt 09 07:48:44 SERVER strongswan[19817]: 16[NET] received packet: from 150.150.150.150[20182] to 200.200.200.200[4500] (1248 bytes)
Okt 09 07:48:44 SERVER strongswan[19817]: 16[ENC] parsed IKE_AUTH request 1 [ EF(6/8) ]
Okt 09 07:48:44 SERVER strongswan[19817]: 16[ENC] received fragment #6 of 8, waiting for complete IKE message
Okt 09 07:48:44 SERVER strongswan[19817]: 13[NET] received packet: from 150.150.150.150[20182] to 200.200.200.200[4500] (464 bytes)
Okt 09 07:48:44 SERVER strongswan[19817]: 13[ENC] parsed IKE_AUTH request 1 [ EF(8/8) ]
Okt 09 07:48:44 SERVER strongswan[19817]: 13[ENC] received fragment #8 of 8, waiting for complete IKE message
Okt 09 07:48:44 SERVER strongswan[19817]: 08[NET] received packet: from 150.150.150.150[20182] to 200.200.200.200[4500] (1248 bytes)
Okt 09 07:48:44 SERVER strongswan[19817]: 08[ENC] parsed IKE_AUTH request 1 [ EF(7/8) ]
Okt 09 07:48:44 SERVER strongswan[19817]: 08[ENC] received fragment #7 of 8, reassembled fragmented IKE message (8748 bytes)
Okt 09 07:48:44 SERVER strongswan[19817]: 08[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ CPRQ(ADDR ADDR6 DNS NBNS DNS6) SA TSi TSr N(MOBIK
Okt 09 07:48:44 SERVER strongswan[19817]: 08[IKE] received 415 cert requests for an unknown ca
Okt 09 07:48:44 SERVER strongswan[19817]: 08[IKE] initiating EAP_IDENTITY method (id 0x00)
Okt 09 07:48:44 SERVER strongswan[19817]: 08[IKE] peer supports MOBIKE
Okt 09 07:48:44 SERVER strongswan[19817]: 08[IKE] authentication of 'ikev2.domain.de' (myself) with RSA_EMSA_PKCS1_SHA2_384 successful  
Okt 09 07:48:44 SERVER strongswan[19817]: 08[IKE] sending end entity cert "CN=ikev2.domain.de"  
Okt 09 07:48:44 SERVER charon[19823]: 08[ENC] generating IKE_AUTH response 1 [ IDr CERT CERT AUTH EAP/REQ/ID ]
Okt 09 07:48:44 SERVER charon[19823]: 08[ENC] splitting IKE message (3468 bytes) into 3 fragments
Okt 09 07:48:44 SERVER charon[19823]: 08[ENC] generating IKE_AUTH response 1 [ EF(1/3) ]
Okt 09 07:48:44 SERVER charon[19823]: 08[ENC] generating IKE_AUTH response 1 [ EF(2/3) ]
Okt 09 07:48:44 SERVER charon[19823]: 08[ENC] generating IKE_AUTH response 1 [ EF(3/3) ]
Okt 09 07:48:44 SERVER charon[19823]: 08[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[20182] (1248 bytes)
Okt 09 07:48:44 SERVER charon[19823]: 08[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[20182] (1248 bytes)
Okt 09 07:48:44 SERVER charon[19823]: 08[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[20182] (1120 bytes)
Okt 09 07:48:45 SERVER charon[19823]: 03[NET] received packet: from 150.150.150.150[20182] to 200.200.200.200[4500] (92 bytes)
Okt 09 07:48:45 SERVER charon[19823]: 03[ENC] parsed IKE_AUTH request 2 [ EAP/RES/ID ]
Okt 09 07:48:45 SERVER charon[19823]: 03[IKE] received EAP identity 'Benutzer'  
Okt 09 07:48:45 SERVER charon[19823]: 03[IKE] initiating EAP_MSCHAPV2 method (id 0x4F)
Okt 09 07:48:45 SERVER charon[19823]: 03[ENC] generating IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]
Okt 09 07:48:45 SERVER charon[19823]: 03[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[20182] (108 bytes)
Okt 09 07:48:45 SERVER charon[19823]: 04[NET] received packet: from 150.150.150.150[20182] to 200.200.200.200[4500] (140 bytes)
Okt 09 07:48:45 SERVER charon[19823]: 04[ENC] parsed IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]
Okt 09 07:48:45 SERVER charon[19823]: 04[ENC] generating IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]
Okt 09 07:48:45 SERVER charon[19823]: 04[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[20182] (140 bytes)
Okt 09 07:48:45 SERVER charon[19823]: 14[NET] received packet: from 150.150.150.150[20182] to 200.200.200.200[4500] (76 bytes)
Okt 09 07:48:45 SERVER charon[19823]: 14[ENC] parsed IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]
Okt 09 07:48:45 SERVER charon[19823]: 14[IKE] EAP method EAP_MSCHAPV2 succeeded, MSK established
Okt 09 07:48:45 SERVER charon[19823]: 14[ENC] generating IKE_AUTH response 4 [ EAP/SUCC ]
Okt 09 07:48:45 SERVER charon[19823]: 14[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[20182] (76 bytes)
Okt 09 07:48:45 SERVER charon[19823]: 05[NET] received packet: from 150.150.150.150[20182] to 200.200.200.200[4500] (92 bytes)
Okt 09 07:48:45 SERVER charon[19823]: 05[ENC] parsed IKE_AUTH request 5 [ AUTH ]
Okt 09 07:48:45 SERVER charon[19823]: 05[IKE] authentication of 'Benutzer' with EAP successful  
Okt 09 07:48:45 SERVER charon[19823]: 05[IKE] authentication of 'ikev2.domain.de' (myself) with EAP  
Okt 09 07:48:45 SERVER charon[19823]: 05[IKE] IKE_SA domain-vpn[2] established between 200.200.200.200[ikev2.domain.de]...150.150.150.150[Benutze
Okt 09 07:48:45 SERVER charon[19823]: 05[IKE] IKE_SA domain-vpn[2] established between 200.200.200.200[ikev2.domain.de]...150.150.150.150[Benutze
Okt 09 07:48:45 SERVER charon[19823]: 05[IKE] peer requested virtual IP %any
Okt 09 07:48:45 SERVER charon[19823]: 05[IKE] assigning virtual IP 10.0.1.1 to peer 'Benutzer'  
Okt 09 07:48:45 SERVER charon[19823]: 05[IKE] peer requested virtual IP %any6
Okt 09 07:48:45 SERVER charon[19823]: 05[IKE] no virtual IP found for %any6 requested by 'Benutzer'  
Okt 09 07:48:45 SERVER charon[19823]: 05[KNL] received netlink error: Protocol not supported (93)
Okt 09 07:48:45 SERVER charon[19823]: 05[KNL] unable to add SAD entry with SPI c648171b (FAILED)
Okt 09 07:48:45 SERVER charon[19823]: 05[KNL] received netlink error: Protocol not supported (93)
Okt 09 07:48:45 SERVER charon[19823]: 05[KNL] unable to add SAD entry with SPI c84432ef (FAILED)
Okt 09 07:48:45 SERVER charon[19823]: 05[IKE] unable to install inbound and outbound IPsec SA (SAD) in kernel
Okt 09 07:48:45 SERVER charon[19823]: 05[IKE] failed to establish CHILD_SA, keeping IKE_SA
Okt 09 07:48:45 SERVER charon[19823]: 05[KNL] deleting policy 10.0.1.1/32 === 200.200.200.200/32 in failed, not found
Okt 09 07:48:45 SERVER charon[19823]: 05[KNL] deleting policy 10.0.1.1/32 === 200.200.200.200/32 fwd failed, not found
Okt 09 07:48:45 SERVER charon[19823]: 05[ENC] generating IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS DNS) N(MOBIKE_SUP) N(ADD_4_ADDR) N(NO_PROP) ]
Okt 09 07:48:45 SERVER charon[19823]: 05[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[20182] (156 bytes)
Okt 09 07:48:45 SERVER charon[19823]: 15[NET] received packet: from 150.150.150.150[20182] to 200.200.200.200[4500] (76 bytes)
Okt 09 07:48:45 SERVER charon[19823]: 15[ENC] parsed INFORMATIONAL request 6 [ D ]
Okt 09 07:48:45 SERVER charon[19823]: 15[IKE] received DELETE for IKE_SA domain-vpn[2]
Okt 09 07:48:45 SERVER charon[19823]: 15[IKE] deleting IKE_SA domain-vpn[2] between 200.200.200.200[ikev2.domain.de]...150.150.150.150[Benutzer]
Okt 09 07:48:45 SERVER charon[19823]: 15[IKE] deleting IKE_SA domain-vpn[2] between 200.200.200.200[ikev2.domain.de]...150.150.150.150[Benutzer]
Okt 09 07:48:45 SERVER charon[19823]: 15[IKE] IKE_SA deleted
Okt 09 07:48:45 SERVER charon[19823]: 15[IKE] IKE_SA deleted
Okt 09 07:48:45 SERVER charon[19823]: 15[ENC] generating INFORMATIONAL response 6 [ ]
Okt 09 07:48:45 SERVER charon[19823]: 15[NET] sending packet: from 200.200.200.200[4500] to 150.150.150.150[20182] (76 bytes)

Ich hätte ja gedacht, manchmal hilft es eine Nach darüber zu schlafen. Mir hat es leider nicht geholfen.

Könnte mir bitte jemand eine näheren Hinweis geben, also für einen nooby

..."failed to establish CHILD_SA, keeping IKE_SA" zeigt ja immer noch das du einen SA Mismatch hast. Da stimmt also irgendwas nicht mit deinen lokalen und remoten IP Netzen bzw. deren Subnetzmasken.
Der Mismatch bedeutet das kein Tunnel etabliert wird.
Übrigens NAT im Tunnel IP Netz zu machen ist keine gute Idee. Niemals will man ja seine lokalen IP Netze NATen, denn das bedeutet immer das man eine Routing technische Einbahnstrasse hat.
Soll das ein IKEv2 Client Dialin sein für mobile Clients oder eine IKEv2 Site to Site Kopplung ??
Für eine IKEv2 Client Einwahl kannst du vergleichsweise einmal das o.a._Tutorial zu Rate ziehen.
Interessant wäre nich zu wissen welchen IKEv2 Client du benutzt and was dort auf dem Client im Fehlerlog steht ?!!

Zitat von @aqui:

..."failed to establish CHILD_SA, keeping IKE_SA" zeigt ja immer noch das du einen SA Mismatch hast. Da stimmt also irgendwas nicht mit deinen lokalen und remoten IP Netzen bzw. deren Subnetzmasken.
Der Mismatch bedeutet das kein Tunnel etabliert wird.

Übrigens NAT im Tunnel IP Netz zu machen ist keine gute Idee. Niemals will man ja seine lokalen IP Netze NATen, denn das bedeutet immer das man eine Routing technische Einbahnstrasse hat.

Habe ich vielleicht die falsche Anleitung mir ausgesucht? :/
Verstehe ich richtig, dass ich dann den hinzugefügten Absatz wieder entfernen muss?

*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o venet0 -j MASQUERADE
COMMIT

Soll das ein IKEv2 Client Dialin sein für mobile Clients oder eine IKEv2 Site to Site Kopplung ??

Ich möchte nicht zwei Netzwerke zusammen fügen. Viel mehr möchte ich die IP Adresse des Servers zum Zugriff im Internet benutzen.

Für eine IKEv2 Client Einwahl kannst du vergleichsweise einmal das o.a._Tutorial zu Rate ziehen.

Diese Anleitung habe ich bereits gestern und heute morgen versucht zu verstehen. Da ich jedoch nur Bruchteile verstehe was da passiert. Kann ich das auf die Umsetzung mit einer VM im Internet nicht umsetzen.

Interessant wäre nich zu wissen welchen IKEv2 Client du benutzt and was dort auf dem Client im Fehlerlog steht ?!!

Also mit Android kommt das hier raus:

Oct  9 18:32:50 00[DMN] +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Oct  9 18:32:50 00[DMN] Starting IKE service (strongSwan 5.8.4, Android 8.0.0 - WAS-LX1A 8.0.0.390(C432)/2019-03-01, WAS-LX1A - HUAWEI/WAS-LX1A/HUAWEI, Linux 4.4.23+, aarch64)
Oct  9 18:32:50 00[LIB] loaded plugins: androidbridge charon android-log openssl fips-prf random nonce pubkey chapoly curve25519 pkcs1 pkcs8 pem xcbc hmac socket-default revocation eap-identity eap-mschapv2 eap-md5 eap-gtc eap-tls x509
Oct  9 18:32:50 00[JOB] spawning 16 worker threads
Oct  9 18:32:50 08[IKE] initiating IKE_SA android[1] to 200.200.200.200
Oct  9 18:32:50 08[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Oct  9 18:32:50 08[NET] sending packet: from 192.168.1.11[42828] to 200.200.200.200[500] (716 bytes)
Oct  9 18:32:50 04[NET] received packet: from 200.200.200.200[500] to 192.168.1.11[42828] (38 bytes)
Oct  9 18:32:50 04[ENC] parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]
Oct  9 18:32:50 04[IKE] peer didn't accept DH group ECP_256, it requested MODP_2048  
Oct  9 18:32:50 04[IKE] initiating IKE_SA android[1] to 200.200.200.200
Oct  9 18:32:50 04[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Oct  9 18:32:50 04[NET] sending packet: from 192.168.1.11[42828] to 200.200.200.200[500] (908 bytes)
Oct  9 18:32:50 05[NET] received packet: from 200.200.200.200[500] to 192.168.1.11[42828] (464 bytes)
Oct  9 18:32:50 05[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(MULT_AUTH) ]
Oct  9 18:32:50 05[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
Oct  9 18:32:50 05[IKE] local host is behind NAT, sending keep alives
Oct  9 18:32:50 05[IKE] remote host is behind NAT
Oct  9 18:32:50 05[CFG] loaded crl issued by 'O=Digital Signature Trust Co., CN=DST Root CA X3'  
Oct  9 18:32:50 05[IKE] sending cert request for "C=CN, O=WoSign CA Limited, CN=CA WoSign ECC Root"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=Internet Security Research Group, CN=ISRG Root X1"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=FR, O=Certinomis, OU=0002 433998903, CN=Certinomis - Autorit?? Racine"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=IdenTrust, CN=IdenTrust Public Sector Root CA 1"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden EV Root CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign"  
Oct  9 18:32:50 05[IKE] sending cert request for "CN=internal-ca, C=DE, ST=Berlin, L=Berlin, O=Stoffe, OU=IT"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=FR, O=OpenTrust, CN=OpenTrust Root CA G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=IT, L=Milan, O=Actalis S.p.A./03358520967, CN=Actalis Authentication Root CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=JP, O=Japanese Government, OU=ApplicationCA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=FR, O=OpenTrust, CN=OpenTrust Root CA G1"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=TW, O=Chunghwa Telecom Co., Ltd., OU=ePKI Root Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=RO, O=certSIGN, OU=certSIGN ROOT CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=GR, L=Athens, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions RootCA 2015"  
Oct  9 18:32:50 05[IKE] sending cert request for "CN=loc, C=DE, ST=Berlin, L=Berlin, O=loc, OU=IT"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=FR, O=Dhimyotis, CN=Certigna"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Universal CA 2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=CN, O=WoSign CA Limited, CN=Certification Authority of WoSign G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=NO, O=Buypass AS-983163327, CN=Buypass Class 2 Root CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=Amazon, CN=Amazon Root CA 1"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=TR, L=Ankara, O=E-Tu??ra EBG Bili??im Teknolojileri ve Hizmetleri A.??., OU=E-Tugra Sertifikasyon Merkezi, CN=E-Tugra Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=TR, L=Gebze - Kocaeli, O=T??rkiye Bilimsel ve Teknolojik Ara??t??rma Kurumu - T??B??TAK, OU=Ulusal Elektronik ve Kriptoloji Ara??t??rma Enstit??s?? - UEKAE, OU=Kamu Sertifikasyon Merkezi, CN=T??B??TAK UEKAE K??k Sertifika Hizmet Sa??lay??c??s?? - S??r??m 3"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R1"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=CH, O=SwissSign AG, CN=SwissSign Gold CA - G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=SecureTrust Corporation, CN=SecureTrust CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Trusted Certificate Services"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Qualified CA Root"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=GR, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions RootCA 2011"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "CN=ACCVRAIZ1, OU=PKIACCV, O=ACCV, C=ES"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 G3"  
Oct  9 18:32:50 05[IKE] sending cert request for "O=Cybertrust, Inc, CN=Cybertrust Global Root"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Global Root CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root CA 2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root CA 1"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=HK, O=Hongkong Post, CN=Hongkong Post Root CA 1"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=IL, O=StartCom Ltd., CN=StartCom Certification Authority G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Global CA 2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA - G3"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=HU, L=Budapest, O=Microsec Ltd., CN=Microsec e-Szigno Root CA 2009, E=info@e-szigno.hu"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=AffirmTrust, CN=AffirmTrust Commercial"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=ES, O=Agencia Catalana de Certificacio (NIF Q-0801176-I), OU=Serveis Publics de Certificacio, OU=Vegeu https://www.catcert.net/verarrel (c)03, OU=Jerarquia Entitats de Certificacio Catalanes, CN=EC-ACC"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=FR, O=OpenTrust, CN=OpenTrust Root CA G3"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=FR, O=Certinomis, OU=0002 433998903, CN=Certinomis - Root CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Services Root Certificate Authority - G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 EV 2009"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=ES, CN=Autoridad de Certificacion Firmaprofesional CIF A62634068"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=FR, O=Certplus, CN=Certplus Root CA G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root EV CA 2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=thawte, Inc., OU=(c) 2007 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA - G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=Digital Signature Trust, OU=DST ACES, CN=DST ACES CA X6"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=CH, O=WISeKey, OU=OISTE Foundation Endorsed, CN=OISTE WISeKey Global Root GB CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=ES, O=IZENPE S.A., CN=Izenpe.com"  
Oct  9 18:32:50 05[IKE] sending cert request for "CN=Atos TrustedRoot 2011, O=Atos, C=DE"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=FR, O=Certplus, CN=Certplus Root CA G1"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=EU, L=Madrid (see current address at www.camerfirma.com/address), SN=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=FR, O=Certplus, CN=Class 2 Primary CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=TR, L=Ankara, O=T??RKTRUST Bilgi ??leti??im ve Bili??im G??venli??i Hizmetleri A.??., CN=T??RKTRUST Elektronik Sertifika Hizmet Sa??lay??c??s?? H6"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=ES, O=FNMT-RCM, OU=AC RAIZ FNMT-RCM"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=GeoTrust Inc., OU=(c) 2007 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root G3"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Secure Certificate Services"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=JP, O=SECOM Trust Systems CO.,LTD., OU=Security Communication EV RootCA1"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=TR, L=Ankara, O=T??RKTRUST Bilgi ??leti??im ve Bili??im G??venli??i Hizmetleri A.??., CN=T??RKTRUST Elektronik Sertifika Hizmet Sa??lay??c??s?? H5"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=VISA, OU=Visa International Service Association, CN=Visa eCommerce Root"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=HU, L=Budapest, O=NetLock Kft., OU=Tan??s??tv??nykiad??k (Certification Services), CN=NetLock Arany (Class Gold) F??tan??s??tv??ny"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=FI, O=Sonera, CN=Sonera Class2 CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 1 G3"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=Amazon, CN=Amazon Root CA 2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2007 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G4"  
Oct  9 18:32:50 05[IKE] sending cert request for "OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=GB, O=Trustis Limited, OU=Trustis FPS Root CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G3"  
Oct  9 18:32:50 05[IKE] sending cert request for "CN=ACEDICOM Root, OU=PKI, O=EDICOM, C=ES"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=CN, O=WoSign CA Limited, CN=Certification Authority of WoSign"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA 2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "O=Digital Signature Trust Co., CN=DST Root CA X3"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2008 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA - G3"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3 G3"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Public CA Root"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=JP, O=Japan Certification Services, Inc., CN=SecureSign RootCA11"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=SecureTrust Corporation, CN=Secure Global CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Global CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 3"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=CH, O=WISeKey, OU=Copyright (c) 2005, OU=OISTE Foundation Endorsed, CN=OISTE WISeKey Global Root GA CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=EE, O=AS Sertifitseerimiskeskus, CN=EE Certification Centre Root CA, E=pki@sk.ee"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=JP, O=SECOM Trust Systems CO.,LTD., OU=Security Communication RootCA2"  
Oct  9 18:32:50 05[IKE] sending cert request for "OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=PL, O=Krajowa Izba Rozliczeniowa S.A., CN=SZAFIR ROOT CA2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=GR, L=Athens, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions ECC RootCA 2015"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=NO, O=Buypass AS-983163327, CN=Buypass Class 3 Root CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=AffirmTrust, CN=AffirmTrust Premium"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, OU=www.xrampsecurity.com, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=CN, O=China Internet Network Information Center, CN=China Internet Network Information Center EV Certificates Root"  
Oct  9 18:32:50 05[IKE] sending cert request for "O=TeliaSonera, CN=TeliaSonera Root CA v1"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Universal CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=Wells Fargo WellsSecure, OU=Wells Fargo Bank NA, CN=WellsSecure Public Root Certificate Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=Amazon, CN=Amazon Root CA 4"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=HU, L=Budapest, O=Microsec Ltd., OU=e-Szigno CA, CN=Microsec e-Szigno Root CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "OU=GlobalSign ECC Root CA - R5, O=GlobalSign, CN=GlobalSign"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=DE, O=Deutsche Telekom AG, OU=T-TeleSec Trust Center, CN=Deutsche Telekom Root CA 2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust ECC Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Global Chambersign Root"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2012 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - EC1"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=CH, O=SwissSign AG, CN=SwissSign Silver CA - G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=PL, O=Unizeto Sp. z o.o., CN=Certum CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=Amazon, CN=Amazon Root CA 3"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=LU, O=LuxTrust S.A., CN=LuxTrust Global Root 2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=TW, O=Government Root Certification Authority"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=EU, L=Madrid (see current address at www.camerfirma.com/address), SN=A82743287, O=AC Camerfirma S.A., CN=Global Chambersign Root - 2008"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA - G2"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=CN, O=China Financial Certification Authority, CN=CFCA EV ROOT"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA"  
Oct  9 18:32:50 05[IKE] sending cert request for "CN=T??RKTRUST Elektronik Sertifika Hizmet Sa??lay??c??s??, C=TR, L=Ankara, O=T??RKTRUST Bilgi ??leti??im ve Bili??im G??venli??i Hizmetleri A.??. (c) Aral??k 2007"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Chambers of Commerce Root"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=CN, O=WoSign CA Limited, CN=CA ???????????????"  
Oct  9 18:32:50 05[IKE] sending cert request for "C=US, O=AffirmTrust, CN=AffirmTrust Networking"  
Oct  9 18:32:50 05[IKE] establishing CHILD_SA android{1}
Oct  9 18:32:50 05[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ CPRQ(ADDR ADDR6 DNS DNS6) N(ESP_TFC_PAD_N) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
Oct  9 18:32:50 05[ENC] splitting IKE message (3580 bytes) into 3 fragments
Oct  9 18:32:50 05[ENC] generating IKE_AUTH request 1 [ EF(1/3) ]
Oct  9 18:32:50 05[ENC] generating IKE_AUTH request 1 [ EF(2/3) ]
Oct  9 18:32:50 05[ENC] generating IKE_AUTH request 1 [ EF(3/3) ]
Oct  9 18:32:50 05[NET] sending packet: from 192.168.1.11[43268] to 200.200.200.200[4500] (1360 bytes)
Oct  9 18:32:50 05[NET] sending packet: from 192.168.1.11[43268] to 200.200.200.200[4500] (1360 bytes)
Oct  9 18:32:50 05[NET] sending packet: from 192.168.1.11[43268] to 200.200.200.200[4500] (992 bytes)
Oct  9 18:32:50 09[NET] received packet: from 200.200.200.200[4500] to 192.168.1.11[43268] (1248 bytes)
Oct  9 18:32:50 09[ENC] parsed IKE_AUTH response 1 [ EF(1/3) ]
Oct  9 18:32:50 09[ENC] received fragment #1 of 3, waiting for complete IKE message
Oct  9 18:32:50 12[NET] received packet: from 200.200.200.200[4500] to 192.168.1.11[43268] (1248 bytes)
Oct  9 18:32:50 12[ENC] parsed IKE_AUTH response 1 [ EF(2/3) ]
Oct  9 18:32:50 12[ENC] received fragment #2 of 3, waiting for complete IKE message
Oct  9 18:32:50 10[NET] received packet: from 200.200.200.200[4500] to 192.168.1.11[43268] (1120 bytes)
Oct  9 18:32:50 10[ENC] parsed IKE_AUTH response 1 [ EF(3/3) ]
Oct  9 18:32:50 10[ENC] received fragment #3 of 3, reassembled fragmented IKE message (3468 bytes)
Oct  9 18:32:50 10[ENC] parsed IKE_AUTH response 1 [ IDr CERT CERT AUTH EAP/REQ/ID ]
Oct  9 18:32:50 10[IKE] received end entity cert "CN=ikev2.domain.de"  
Oct  9 18:32:50 10[IKE] received issuer cert "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"  
Oct  9 18:32:50 10[CFG]   using certificate "CN=ikev2.domain.de"  
Oct  9 18:32:50 10[CFG]   using untrusted intermediate certificate "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"  
Oct  9 18:32:50 10[CFG] checking certificate status of "CN=ikev2.domain.de"  
Oct  9 18:32:50 10[CFG]   requesting ocsp status from 'http://ocsp.int-x3.letsencrypt.org' ...  
Oct  9 18:33:00 10[LIB] failed to fetch from 'http://ocsp.int-x3.letsencrypt.org'  
Oct  9 18:33:00 10[CFG] ocsp request to http://ocsp.int-x3.letsencrypt.org failed
Oct  9 18:33:00 10[CFG] ocsp check failed, fallback to crl
Oct  9 18:33:00 10[CFG] certificate status is not available
Oct  9 18:33:00 10[CFG]   using trusted ca certificate "O=Digital Signature Trust Co., CN=DST Root CA X3"  
Oct  9 18:33:00 10[CFG] checking certificate status of "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"  
Oct  9 18:33:00 10[CFG]   requesting ocsp status from 'http://isrg.trustid.ocsp.identrust.com' ...  
Oct  9 18:33:04 10[CFG] nonce in ocsp response doesn't match  
Oct  9 18:33:04 10[CFG] ocsp check failed, fallback to crl
Oct  9 18:33:04 10[CFG]   using trusted certificate "O=Digital Signature Trust Co., CN=DST Root CA X3"  
Oct  9 18:33:04 10[CFG]   crl correctly signed by "O=Digital Signature Trust Co., CN=DST Root CA X3"  
Oct  9 18:33:04 10[CFG]   crl is valid: until Nov 06 20:27:28 2020
Oct  9 18:33:04 10[CFG]   using cached crl
Oct  9 18:33:04 10[CFG] certificate status is good
Oct  9 18:33:04 10[CFG]   reached self-signed root ca with a path length of 1
Oct  9 18:33:04 10[IKE] authentication of 'ikev2.domain.de' with RSA_EMSA_PKCS1_SHA2_384 successful  
Oct  9 18:33:04 10[IKE] server requested EAP_IDENTITY (id 0x00), sending 'Benutzer'  
Oct  9 18:33:04 10[ENC] generating IKE_AUTH request 2 [ EAP/RES/ID ]
Oct  9 18:33:04 10[NET] sending packet: from 192.168.1.11[43268] to 200.200.200.200[4500] (92 bytes)
Oct  9 18:33:04 04[NET] received packet: from 200.200.200.200[4500] to 192.168.1.11[43268] (108 bytes)
Oct  9 18:33:04 04[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]
Oct  9 18:33:04 04[IKE] server requested EAP_MSCHAPV2 authentication (id 0xBE)
Oct  9 18:33:04 04[ENC] generating IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]
Oct  9 18:33:04 04[NET] sending packet: from 192.168.1.11[43268] to 200.200.200.200[4500] (140 bytes)
Oct  9 18:33:04 07[NET] received packet: from 200.200.200.200[4500] to 192.168.1.11[43268] (140 bytes)
Oct  9 18:33:04 07[ENC] parsed IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]
Oct  9 18:33:04 07[IKE] EAP-MS-CHAPv2 succeeded: 'Welcome2strongSwan'  
Oct  9 18:33:04 07[ENC] generating IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]
Oct  9 18:33:04 07[NET] sending packet: from 192.168.1.11[43268] to 200.200.200.200[4500] (76 bytes)
Oct  9 18:33:04 05[NET] received packet: from 200.200.200.200[4500] to 192.168.1.11[43268] (76 bytes)
Oct  9 18:33:04 05[ENC] parsed IKE_AUTH response 4 [ EAP/SUCC ]
Oct  9 18:33:04 05[IKE] EAP method EAP_MSCHAPV2 succeeded, MSK established
Oct  9 18:33:04 05[IKE] authentication of 'Benutzer' (myself) with EAP  
Oct  9 18:33:04 05[ENC] generating IKE_AUTH request 5 [ AUTH ]
Oct  9 18:33:04 05[NET] sending packet: from 192.168.1.11[43268] to 200.200.200.200[4500] (92 bytes)
Oct  9 18:33:04 06[NET] received packet: from 200.200.200.200[4500] to 192.168.1.11[43268] (156 bytes)
Oct  9 18:33:04 06[ENC] parsed IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS DNS) N(MOBIKE_SUP) N(ADD_4_ADDR) N(NO_PROP) ]
Oct  9 18:33:04 06[IKE] authentication of 'ikev2.domain.de' with EAP successful  
Oct  9 18:33:04 06[IKE] IKE_SA android[1] established between 192.168.1.11[Benutzer]...200.200.200.200[ikev2.domain.de]
Oct  9 18:33:04 06[IKE] scheduling rekeying in 35658s
Oct  9 18:33:04 06[IKE] maximum IKE_SA lifetime 37458s
Oct  9 18:33:04 06[IKE] installing DNS server 1.1.1.1
Oct  9 18:33:04 06[IKE] installing DNS server 1.0.0.1
Oct  9 18:33:04 06[IKE] installing new virtual IP 10.0.1.1
Oct  9 18:33:04 06[IKE] received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built
Oct  9 18:33:04 06[IKE] closing IKE_SA due CHILD_SA setup failure
Oct  9 18:33:04 06[IKE] peer supports MOBIKE
Oct  9 18:33:04 09[IKE] deleting IKE_SA android[1] between 192.168.1.11[Benutzer]...200.200.200.200[ikev2.domain.de]
Oct  9 18:33:04 09[IKE] sending DELETE for IKE_SA android[1]
Oct  9 18:33:04 09[ENC] generating INFORMATIONAL request 6 [ D ]
Oct  9 18:33:04 09[NET] sending packet: from 192.168.1.11[43268] to 200.200.200.200[4500] (76 bytes)
Oct  9 18:33:04 12[NET] received packet: from 200.200.200.200[4500] to 192.168.1.11[43268] (76 bytes)
Oct  9 18:33:04 12[ENC] parsed INFORMATIONAL response 6 [ ]
Oct  9 18:33:04 12[IKE] IKE_SA deleted

Und mit majaro gibt das hier aus .. (musste vielle Zeilen zur den Zertifikat entfernen):

Okt 09 18:20:15 reisen audit[710]: USYS_CONFIG pid=710 uid=0 auid=4294967295 ses=4294967295 msg='op=connection-activate uuid=424d756f-2371-4600-b148-1b28d118f2e9 name="domain-VPN" pid=1508 uid=1000 result=su>  
Okt 09 18:20:15 reisen NetworkManager[710]: <info>  [1602260415.9529] audit: op="connection-activate" uuid="424d756f-2371-4600-b148-1b28d118f2e9" name="domain-VPN" pid=1508 uid=1000 result="success"  
Okt 09 18:20:15 reisen kernel: audit: type=1111 audit(1602260415.944:104): pid=710 uid=0 auid=4294967295 ses=4294967295 msg='op=connection-activate uuid=424d756f-2371-4600-b148-1b28d118f2e9 name="domain-VPN">  
Okt 09 18:20:15 reisen NetworkManager[710]: <info>  [1602260415.9573] vpn-connection[0x55b09a218370,424d756f-2371-4600-b148-1b28d118f2e9,"domain-VPN",0]: Saw the service appear; activating connection  
Okt 09 18:20:16 reisen NetworkManager[710]: <info>  [1602260416.1100] vpn-connection[0x55b09a218370,424d756f-2371-4600-b148-1b28d118f2e9,"domain-VPN",0]: VPN connection: (ConnectInteractive) reply received  
Okt 09 18:20:16 reisen charon-nm[9034]: 04[CFG] received initiate for NetworkManager connection domain-VPN
Okt 09 18:20:16 reisen charon-nm[9034]: 04[LIB]   file coded in unknown format, discarded
Okt 09 18:20:16 reisen charon-nm[9034]: 04[LIB] building CRED_CERTIFICATE - X509 failed, tried 5 builders
Okt 09 18:20:16 reisen charon-nm[9034]: 04[CFG] loading CA certificate '/etc/ssl/certs/java/cacerts' failed  
Okt 09 18:20:16 reisen charon-nm[9034]: 04[CFG] using gateway identity 'ikev2.domain.de'  
Okt 09 18:20:16 reisen charon-nm[9034]: 04[IKE] initiating IKE_SA domain-VPN[2] to 200.200.200.200
Okt 09 18:20:16 reisen charon-nm[9034]: 04[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 04[NET] sending packet: from 192.168.1.10[50677] to 200.200.200.200[500] (1000 bytes)
Okt 09 18:20:16 reisen NetworkManager[710]: <info>  [1602260416.3064] vpn-connection[0x55b09a218370,424d756f-2371-4600-b148-1b28d118f2e9,"domain-VPN",0]: VPN plugin: state changed: starting (3)  
Okt 09 18:20:16 reisen charon-nm[9034]: 15[NET] received packet: from 200.200.200.200[500] to 192.168.1.10[50677] (38 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 15[ENC] parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 15[IKE] peer didn't accept DH group ECP_256, it requested MODP_2048  
Okt 09 18:20:16 reisen charon-nm[9034]: 15[IKE] initiating IKE_SA domain-VPN[2] to 200.200.200.200
Okt 09 18:20:16 reisen charon-nm[9034]: 15[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 15[NET] sending packet: from 192.168.1.10[50677] to 200.200.200.200[500] (1192 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 06[NET] received packet: from 200.200.200.200[500] to 192.168.1.10[50677] (464 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 06[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(MULT_AUTH) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 06[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] local host is behind NAT, sending keep alives
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] remote host is behind NAT
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] sending cert request for "C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority"  
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] sending cert request for "C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority"  
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] sending cert request for "C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 3"  
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] sending cert request for "C=GR, L=Athens, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions ECC RootCA>  
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] sending cert request for "C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority"  
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] sending cert request for "C=JP, O=SECOM Trust Systems CO.,LTD., OU=Security Communication RootCA2"  
…
…
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] sending cert request for "OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign"  
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] sending cert request for "C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA"  
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] sending cert request for "C=US, O=Google Trust Services LLC, CN=GTS Root R2"  
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] sending cert request for "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Cert>  
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] sending cert request for "OU=GlobalSign Root CA - R6, O=GlobalSign, CN=GlobalSign"  
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] sending cert request for "C=HK, ST=Hong Kong, L=Hong Kong, O=Hongkong Post, CN=Hongkong Post Root CA 3"  
Okt 09 18:20:16 reisen charon-nm[9034]: 06[IKE] establishing CHILD_SA domain-VPN{2}
Okt 09 18:20:16 reisen charon-nm[9034]: 06[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ CPRQ(ADDR ADDR6 DNS NBNS DNS6) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_>
Okt 09 18:20:16 reisen charon-nm[9034]: 06[ENC] splitting IKE message (8748 bytes) into 8 fragments
Okt 09 18:20:16 reisen charon-nm[9034]: 06[ENC] generating IKE_AUTH request 1 [ EF(1/8) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 06[ENC] generating IKE_AUTH request 1 [ EF(2/8) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 06[ENC] generating IKE_AUTH request 1 [ EF(3/8) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 06[ENC] generating IKE_AUTH request 1 [ EF(4/8) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 06[ENC] generating IKE_AUTH request 1 [ EF(5/8) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 06[ENC] generating IKE_AUTH request 1 [ EF(6/8) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 06[ENC] generating IKE_AUTH request 1 [ EF(7/8) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 06[ENC] generating IKE_AUTH request 1 [ EF(8/8) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 06[NET] sending packet: from 192.168.1.10[38633] to 200.200.200.200[4500] (1248 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 06[NET] sending packet: from 192.168.1.10[38633] to 200.200.200.200[4500] (1248 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 06[NET] sending packet: from 192.168.1.10[38633] to 200.200.200.200[4500] (1248 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 06[NET] sending packet: from 192.168.1.10[38633] to 200.200.200.200[4500] (1248 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 06[NET] sending packet: from 192.168.1.10[38633] to 200.200.200.200[4500] (1248 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 06[NET] sending packet: from 192.168.1.10[38633] to 200.200.200.200[4500] (1248 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 06[NET] sending packet: from 192.168.1.10[38633] to 200.200.200.200[4500] (1248 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 06[NET] sending packet: from 192.168.1.10[38633] to 200.200.200.200[4500] (464 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 07[NET] received packet: from 200.200.200.200[4500] to 192.168.1.10[38633] (1248 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 07[ENC] parsed IKE_AUTH response 1 [ EF(1/3) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 07[ENC] received fragment #1 of 3, waiting for complete IKE message
Okt 09 18:20:16 reisen charon-nm[9034]: 05[NET] received packet: from 200.200.200.200[4500] to 192.168.1.10[38633] (1248 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 05[ENC] parsed IKE_AUTH response 1 [ EF(2/3) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 05[ENC] received fragment #2 of 3, waiting for complete IKE message
Okt 09 18:20:16 reisen charon-nm[9034]: 08[NET] received packet: from 200.200.200.200[4500] to 192.168.1.10[38633] (1120 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 08[ENC] parsed IKE_AUTH response 1 [ EF(3/3) ]
Okt 09 18:20:16 reisen charon-nm[9034]: 08[ENC] received fragment #3 of 3, reassembled fragmented IKE message (3468 bytes)
Okt 09 18:20:16 reisen charon-nm[9034]: 08[ENC] parsed IKE_AUTH response 1 [ IDr CERT CERT AUTH EAP/REQ/ID ]
Okt 09 18:20:16 reisen charon-nm[9034]: 08[IKE] received end entity cert "CN=ikev2.domain.de"  
Okt 09 18:20:16 reisen charon-nm[9034]: 08[IKE] received issuer cert "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"  
Okt 09 18:20:16 reisen charon-nm[9034]: 08[CFG]   using certificate "CN=ikev2.domain.de"  
Okt 09 18:20:16 reisen charon-nm[9034]: 08[CFG]   using untrusted intermediate certificate "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"  
Okt 09 18:20:16 reisen charon-nm[9034]: 08[CFG] checking certificate status of "CN=ikev2.domain.de"  
Okt 09 18:20:16 reisen charon-nm[9034]: 08[CFG]   requesting ocsp status from 'http://ocsp.int-x3.letsencrypt.org' ...  
Okt 09 18:20:21 reisen charon-nm[9034]: 08[CFG] nonce in ocsp response doesn't match  
Okt 09 18:20:21 reisen charon-nm[9034]: 08[CFG] ocsp check failed, fallback to crl
Okt 09 18:20:21 reisen charon-nm[9034]: 08[CFG] certificate status is not available
Okt 09 18:20:21 reisen charon-nm[9034]: 08[CFG]   using trusted ca certificate "O=Digital Signature Trust Co., CN=DST Root CA X3"  
Okt 09 18:20:21 reisen charon-nm[9034]: 08[CFG] checking certificate status of "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"  
Okt 09 18:20:21 reisen charon-nm[9034]: 08[CFG]   requesting ocsp status from 'http://isrg.trustid.ocsp.identrust.com' ...  
Okt 09 18:20:22 reisen charon-nm[9034]: 08[CFG] nonce in ocsp response doesn't match  
Okt 09 18:20:22 reisen charon-nm[9034]: 08[CFG] ocsp check failed, fallback to crl
Okt 09 18:20:22 reisen charon-nm[9034]: 08[CFG]   using trusted certificate "O=Digital Signature Trust Co., CN=DST Root CA X3"  
Okt 09 18:20:22 reisen charon-nm[9034]: 08[CFG]   crl correctly signed by "O=Digital Signature Trust Co., CN=DST Root CA X3"  
Okt 09 18:20:22 reisen charon-nm[9034]: 08[CFG]   crl is valid: until Nov 06 20:27:28 2020
Okt 09 18:20:22 reisen charon-nm[9034]: 08[CFG]   using cached crl
Okt 09 18:20:22 reisen charon-nm[9034]: 08[CFG] certificate status is good
Okt 09 18:20:22 reisen charon-nm[9034]: 08[CFG] certificate policy 2.23.140.1.2.1 for 'CN=ikev2.domain.de' not allowed by trustchain, ignored  
Okt 09 18:20:22 reisen charon-nm[9034]: 08[CFG] certificate policy 1.3.6.1.4.1.44947.1.1.1 for 'CN=ikev2.domain.de' not allowed by trustchain, ignored  
Okt 09 18:20:22 reisen charon-nm[9034]: 08[CFG]   reached self-signed root ca with a path length of 1
Okt 09 18:20:22 reisen charon-nm[9034]: 08[IKE] authentication of 'ikev2.domain.de' with RSA_EMSA_PKCS1_SHA2_384 successful  
Okt 09 18:20:22 reisen charon-nm[9034]: 08[IKE] server requested EAP_IDENTITY (id 0x00), sending 'Benutzer'  
Okt 09 18:20:22 reisen charon-nm[9034]: 08[ENC] generating IKE_AUTH request 2 [ EAP/RES/ID ]
Okt 09 18:20:22 reisen charon-nm[9034]: 08[NET] sending packet: from 192.168.1.10[38633] to 200.200.200.200[4500] (92 bytes)
Okt 09 18:20:22 reisen charon-nm[9034]: 10[NET] received packet: from 200.200.200.200[4500] to 192.168.1.10[38633] (108 bytes)
Okt 09 18:20:22 reisen charon-nm[9034]: 10[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]
Okt 09 18:20:22 reisen charon-nm[9034]: 10[IKE] server requested EAP_MSCHAPV2 authentication (id 0xB5)
Okt 09 18:20:22 reisen charon-nm[9034]: 10[ENC] generating IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]
Okt 09 18:20:22 reisen charon-nm[9034]: 10[NET] sending packet: from 192.168.1.10[38633] to 200.200.200.200[4500] (140 bytes)
Okt 09 18:20:22 reisen charon-nm[9034]: 14[NET] received packet: from 200.200.200.200[4500] to 192.168.1.10[38633] (140 bytes)
Okt 09 18:20:22 reisen charon-nm[9034]: 14[ENC] parsed IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]
Okt 09 18:20:22 reisen charon-nm[9034]: 14[IKE] EAP-MS-CHAPv2 succeeded: 'Welcome2strongSwan'  
Okt 09 18:20:22 reisen charon-nm[9034]: 14[ENC] generating IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]
Okt 09 18:20:22 reisen charon-nm[9034]: 14[NET] sending packet: from 192.168.1.10[38633] to 200.200.200.200[4500] (76 bytes)
Okt 09 18:20:22 reisen charon-nm[9034]: 13[NET] received packet: from 200.200.200.200[4500] to 192.168.1.10[38633] (76 bytes)
Okt 09 18:20:22 reisen charon-nm[9034]: 13[ENC] parsed IKE_AUTH response 4 [ EAP/SUCC ]
Okt 09 18:20:22 reisen charon-nm[9034]: 13[IKE] EAP method EAP_MSCHAPV2 succeeded, MSK established
Okt 09 18:20:22 reisen charon-nm[9034]: 13[IKE] authentication of 'Benutzer' (myself) with EAP  
Okt 09 18:20:22 reisen charon-nm[9034]: 13[ENC] generating IKE_AUTH request 5 [ AUTH ]
Okt 09 18:20:22 reisen charon-nm[9034]: 13[NET] sending packet: from 192.168.1.10[38633] to 200.200.200.200[4500] (92 bytes)
Okt 09 18:20:22 reisen charon-nm[9034]: 15[NET] received packet: from 200.200.200.200[4500] to 192.168.1.10[38633] (156 bytes)
Okt 09 18:20:22 reisen charon-nm[9034]: 15[ENC] parsed IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS DNS) N(MOBIKE_SUP) N(ADD_4_ADDR) N(NO_PROP) ]
Okt 09 18:20:22 reisen charon-nm[9034]: 15[IKE] authentication of 'ikev2.domain.de' with EAP successful  
Okt 09 18:20:22 reisen charon-nm[9034]: 15[IKE] IKE_SA domain-VPN[2] established between 192.168.1.10[Benutzer]...200.200.200.200[ikev2.domain.de]
Okt 09 18:20:22 reisen charon-nm[9034]: 15[IKE] scheduling rekeying in 35692s
Okt 09 18:20:22 reisen charon-nm[9034]: 15[IKE] maximum IKE_SA lifetime 36292s
Okt 09 18:20:22 reisen charon-nm[9034]: 15[IKE] installing new virtual IP 10.0.1.1
Okt 09 18:20:22 reisen charon-nm[9034]: 15[IKE] received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built
Okt 09 18:20:22 reisen charon-nm[9034]: 15[IKE] failed to establish CHILD_SA, keeping IKE_SA
Okt 09 18:20:22 reisen audit: MAC_IPSEC_EVENT op=SAD-delete auid=4294967295 ses=4294967295 src=200.200.200.200 dst=192.168.1.10 spi=3439101291(0xccfc856b) res=1
Okt 09 18:20:22 reisen audit[9034]: SYSCALL arch=c000003e syscall=44 success=yes exit=40 a0=8 a1=7f5e4bff65d0 a2=28 a3=0 items=0 ppid=1 pid=9034 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 f>
Okt 09 18:20:22 reisen audit: PROCTITLE proctitle="/usr/lib/strongswan/charon-nm"  
Okt 09 18:20:22 reisen charon-nm[9034]: 15[IKE] peer supports MOBIKE
Okt 09 18:20:22 reisen NetworkManager[710]: <warn>  [1602260422.5469] vpn-connection[0x55b09a218370,424d756f-2371-4600-b148-1b28d118f2e9,"domain-VPN",0]: VPN plugin: failed: connect-failed (1)  
Okt 09 18:20:22 reisen charon-nm[9034]: 05[IKE] deleting IKE_SA domain-VPN[2] between 192.168.1.10[Benutzer]...200.200.200.200[ikev2.domain.de]
Okt 09 18:20:22 reisen NetworkManager[710]: <warn>  [1602260422.5470] vpn-connection[0x55b09a218370,424d756f-2371-4600-b148-1b28d118f2e9,"domain-VPN",0]: VPN plugin: failed: connect-failed (1)  
Okt 09 18:20:22 reisen charon-nm[9034]: 05[IKE] sending DELETE for IKE_SA domain-VPN[2]
Okt 09 18:20:22 reisen NetworkManager[710]: <info>  [1602260422.5472] vpn-connection[0x55b09a218370,424d756f-2371-4600-b148-1b28d118f2e9,"domain-VPN",0]: VPN plugin: state changed: stopping (5)  
Okt 09 18:20:22 reisen charon-nm[9034]: 05[ENC] generating INFORMATIONAL request 6 [ D ]
Okt 09 18:20:22 reisen NetworkManager[710]: <info>  [1602260422.5473] vpn-connection[0x55b09a218370,424d756f-2371-4600-b148-1b28d118f2e9,"domain-VPN",0]: VPN plugin: state changed: stopped (6)  
Okt 09 18:20:22 reisen charon-nm[9034]: 05[NET] sending packet: from 192.168.1.10[38633] to 200.200.200.200[4500] (76 bytes)
Okt 09 18:20:22 reisen kernel: audit: type=1415 audit(1602260422.544:105): op=SAD-delete auid=4294967295 ses=4294967295 src=200.200.200.200 dst=192.168.1.10 spi=3439101291(0xccfc856b) res=1
Okt 09 18:20:22 reisen kernel: audit: type=1300 audit(1602260422.544:105): arch=c000003e syscall=44 success=yes exit=40 a0=8 a1=7f5e4bff65d0 a2=28 a3=0 items=0 ppid=1 pid=9034 auid=4294967295 uid=0 gid=0 euid=0>
Okt 09 18:20:22 reisen kernel: audit: type=1327 audit(1602260422.544:105): proctitle="/usr/lib/strongswan/charon-nm"  
Okt 09 18:20:22 reisen charon-nm[9034]: 08[NET] received packet: from 200.200.200.200[4500] to 192.168.1.10[38633] (76 bytes)
Okt 09 18:20:22 reisen charon-nm[9034]: 08[ENC] parsed INFORMATIONAL response 6 [ ]
Okt 09 18:20:22 reisen charon-nm[9034]: 08[IKE] IKE_SA deleted
Okt 09 18:20:22 reisen NetworkManager[710]:

Bitte lasse den Unsinn hier ellenlange Error Logs zu posten mit wenig bis keiner Information. Das ist wenig zielführend.

Es reichen die relevanten als Auszug !
received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built
Zeigt das du einen Proposal Mismatch hast zwischen deinem Client und dem Server !!
Hier stimmt etwas mit den Crypto Credentials nicht. Z.B. Client kann nur AES 128 und SHA1 aber der Server will AES 256 und SHA256. DH Groups könnten nicht identisch sein 2 zu 14 o.ä. Da gibt es viele Optionen.
Dazu müsste man...

a) wissen mit welchen Client du zugreifst und wie dieser eingestellt ist. (Deshalb das pfSense Tutorial mit dem Windows Teil !!)
b) wissen wie der Server eingestellt ist. Idealerweise sollte der eine größeres Bündel von Crypto Credentials den Clients anbieten, denn diese negotiaten dynamisch !

Kann ich das auf die Umsetzung mit einer VM im Internet nicht umsetzen.

Mmmh...dann wird das nicht einfach...

Aber es gibt im Strongswan Forum diverse Anleitungen wie ein Client Dialin für IKEv2 Clients aussehen muss unter Strongswan:
https://wiki.strongswan.org/projects/strongswan/wiki/IKEv2Examples
https://wiki.strongswan.org/issues/2808
http://www.nwlab.net/tutorials/strongSwan-Windows-7-VPN/

Guten Tag.

leider hat es mich ganz dol erwischt gehabt, so habe ich die letzte Woche im Bett verbracht. Daher erstmals Entschuldigung, dass ich so spät antworte.

Zitat von @aqui:

Kann ich das auf die Umsetzung mit einer VM im Internet nicht umsetzen.

Mmmh...dann wird das nicht einfach...

Nicht einfach ist ja nicht unmöglich. Oder? oO

Zitat von @aqui:

Bitte lasse den Unsinn hier ellenlange Error Logs zu posten mit wenig bis keiner Information. Das ist wenig zielführend.

Es reichen die relevanten als Auszug !

Ich weiß doch nicht welchen Teil du davon sehen möchtest

Zitat von @aqui:
received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built
Zeigt das du einen Proposal Mismatch hast zwischen deinem Client und dem Server !!
Hier stimmt etwas mit den Crypto Credentials nicht. Z.B. Client kann nur AES 128 und SHA1 aber der Server will AES 256 und SHA256. DH Groups könnten nicht identisch sein 2 zu 14 o.ä. Da gibt es viele Optionen.
Dazu müsste man...

a) wissen mit welchen Client du zugreifst und wie dieser eingestellt ist. (Deshalb das pfSense Tutorial mit dem Windows Teil !!)

Hab doch gleich oben mit geschrieben

Also ich versuche es derzeit mit Android und Linux, Mit den Geräten mit den es zum Beispiel bei eine PfSense funktioniert.

* b) wissen wie der Server eingestellt ist. Idealerweise sollte der eine größeres Bündel von Crypto Credentials den Clients anbieten, denn diese negotiaten dynamisch !

Ich habe da glaube ich nichts verändert. Wie komme ich an diese Informationen? Sollte doch eigentlich mit der Configuration festgelegt werden. Oder?

Viele Grüße

Ich

Ich weiß doch nicht welchen Teil du davon sehen möchtest

Nur den relevanten mit den Error Meldungen...

Wie komme ich an diese Informationen?

Glauben heisst nicht wissen ! Das steht alles in der Strongswan Konfig Datei.
https://wiki.strongswan.org/projects/strongswan/wiki/IKEv2CipherSuites
Bei der pfSense legt man es im GUI bei der Phase 1 und 2 fest.
Die Chiffren und Hashing Verfahren sollten gleich sein auf beiden Seiten.
Einen groben Anhaltspunkt zu einer funktionierenden Strongswan Konfig mit IKEv2 auf eine pfSense FW findest du hier:
IPsec IKEv2 VPN für mobile Benutzer auf der pfSense oder OPNsense Firewall einrichten

German Question Networking Basics Networks

Hotly discussed

Check of ZFW Firewallgleixnerd - 3 Comments

How to set up and configure a Linux GRE tunnelAlexWisha - 3 Comments

WIREGUARD VPN ON UDM PRO BEHIND FRITZBOX - HANDSHAKE DID NOT COMPLETEjstricker - 3 Comments

End of Support dates for Office 2016, 2019 Apps und Productivity ServersDani - 1 Comment