IPSec IKEv2 with certificate (client to site) with StrongSwan under NAT (LOCAL IP MISMATCH)

QuiteSmart

Hello,

i'm trying to configure an IPSEC IKEv2 VPN with certificate (client to site, without L2TP).

The server is an ATP the client in an android device with StrongSwan.

The firewall is under a router (and i feel that this is the problem since the same configuration works in other places where the firewall is directly responsible of the internet connection), the router is set to forward anything to the firewall (DMZ).

The error is LOCAL IP MISMATCH:

in the strongswan log the most relevant entries are:

invalid notify data lenght for NO__PROPOSAL_CHOSEN (48)

notify verification failed

could not decrypt payloads

message verification failed

IKE_AUTH response with message ID 1 processing failed"

PHASE 1:

PHASE 2:

Any hint?

@PeterUK i fell you have the solution, is it?

PeterUK

You seem to of used a subnet 0.0.0.0/0 try host 0.0.0.0 for local policy

ENGA

Hi everyone,

I have the same issue, same error, and no resolution.

With the same settings on a firewall with direct internet access (and a public IP on the WAN interface), everything works perfectly: the VPN in Windows 11 connects to the firewall without warnings or errors.

However, with the same firewall version and firmware, if the firewall is behind a router with a DMZ from the router to the WAN of the firewall, and the certificate is correctly configured with the name of the public connection (using an A record), the VPN doesn’t connect to the firewall.

I’ve attached screenshots.

Thank you all in advance.

Andrea

ENGA

Hi everyone,

I have the same issue, same error, and no resolution.

With the same settings on a firewall with direct internet access (and a public IP on the WAN interface), everything works perfectly: the VPN in Windows 11 connects to the firewall without warnings or errors.

However, with the same firewall version and firmware, if the firewall is behind a router with a DMZ from the router to the WAN of the firewall, and the certificate is correctly configured with the name of the public connection (using an A record), the VPN doesn’t connect to the firewall.

I’ve attached screenshots.

Thank you all in advance.

Andrea

ENGA

ENGA

The date of the comment is

February 2025

not 2024

 

Zyxel_Melen

Hi @ENGA,

Since changing to behind NAT scenario, please change your "My address" setting from the "domain name/IPv4" to "Interface option."

The certificate setting doesn't need to change. Hope it helps.