Hi,<br><br>I am using your shrewsoft VPN client 2.15 version on my windows (vista / 7) machines to connect to a VPN router which is running openswan.2.6.24.rc4. The first phase ISAKMP is established successfully. After this phase on the shrewsoft client it shows that connection is established. But on the openswan side, it is waiting for the pahse 2 (IPSec SA). And I see the below error repeatedly. Shrewsoft is behind a NAT router and the subnet is <a href="http://192.168.3.0/24">192.168.3.0/24</a>. The VPN router's local net is <a href="http://192.168.0.0/24">192.168.0.0/24</a> and WAN IP is 192.168.5.112. The NAT router's WAN IP is 192.168.5.114 and connected to the VPN router's WAN port.<br>
<br>I am not using the certification authentication, I am using PSK. What can cause this error? I searched on your support site and the openswan mailing list archives, but I couldn't find any solution. The same configuration of VPN router is working fine with the Greenbow VPN client and Openswan Linux client, but it is failing with shrewsoft with the below error.<br>
<br>Regards,<br>Murat Sezgin<br><br><br>remote-user-psk"[2] 192.168.5.114 #1: the peer proposed: <a href="http://0.0.0.0/0:0/0">0.0.0.0/0:0/0</a> -> <a href="http://192.168.3.100/32:0/0">192.168.3.100/32:0/0</a><br>
| find_client_connection starting with remote-user-psk<br>| looking for <a href="http://0.0.0.0/0:0/0">0.0.0.0/0:0/0</a> -> <a href="http://192.168.3.100/32:0/0">192.168.3.100/32:0/0</a><br>| concrete checking against sr#0 <a href="http://192.168.0.0/24">192.168.0.0/24</a> -> <a href="http://192.168.3.100/32">192.168.3.100/32</a><br>
| match_id a=192.168.3.100<br>| b=192.168.3.100<br>| results matched<br>| trusted_ca called with a=(empty) b=(empty)<br>| fc_try trying remote-user-psk:<a href="http://0.0.0.0/0:0/0">0.0.0.0/0:0/0</a> -> <a href="http://192.168.3.100/32:0/0">192.168.3.100/32:0/0</a> vs remote-user-psk:<a href="http://192.168.0.0/24:0/0">192.168.0.0/24:0/0</a> -> <a href="http://192.168.3.100/32:0/0">192.168.3.100/32:0/0</a><br>
| our client(<a href="http://192.168.0.0/24">192.168.0.0/24</a>) not in our_net (<a href="http://0.0.0.0/0">0.0.0.0/0</a>)<br>| fc_try concluding with none [0]<br>| fc_try remote-user-psk gives none<br>| find_host_pair: comparing to <a href="http://192.168.5.112:500">192.168.5.112:500</a> <a href="http://0.0.0.0:500">0.0.0.0:500</a> <br>
| checking hostpair <a href="http://192.168.0.0/24">192.168.0.0/24</a> -> <a href="http://192.168.3.100/32">192.168.3.100/32</a> is found<br>| match_id a=192.168.3.100<br>| b=(none)<br>| results matched<br>
| trusted_ca called with a=(empty) b=(empty)<br>| fc_try trying remote-user-psk:<a href="http://0.0.0.0/0:0/0">0.0.0.0/0:0/0</a> -> <a href="http://192.168.3.100/32:0/0">192.168.3.100/32:0/0</a> vs remote-user-psk:<a href="http://192.168.0.0/24:0/0">192.168.0.0/24:0/0</a> -> <a href="http://192.168.3.100/32:0/0">192.168.3.100/32:0/0</a><br>
| our client(<a href="http://192.168.0.0/24">192.168.0.0/24</a>) not in our_net (<a href="http://0.0.0.0/0">0.0.0.0/0</a>)<br>| fc_try concluding with none [0]<br>| concluding with d = none<br>"remote-user-psk"[2] 192.168.5.114 #1:<span style="color: rgb(255, 0, 0);"> cannot respond to IPsec SA request because no connection is known for <a href="http://0.0.0.0/0===192.168.5.112...192.168.5.114[192.168.3.100]===192.168.3.100/32">0.0.0.0/0===192.168.5.112...192.168.5.114[192.168.3.100]===192.168.3.100/32</a></span><br>
| complete state transition with (null)<br>"remote-user-psk"[2] 192.168.5.114 #1: sending encrypted notification INVALID_ID_INFORMATION to <a href="http://192.168.5.114:55034">192.168.5.114:55034</a><br><br>